Free compliance software: what is the catch?

Free is a pricing decision, not a favour

Software costs money to build and run, so a free tier exists because it earns something: a pipeline of paying customers, a route into an organisation that will grow, data, or distribution. That is fine. It becomes a problem only when the mechanism is hidden, because then you find it at the worst possible moment - usually two weeks before an audit, with your evidence inside the product.

So the useful question is not whether there is a catch. It is where the catch is, and whether you would mind.

Where free tiers usually get you

In compliance tooling specifically, these are the common mechanisms. Most vendors use one or two of them, and the honest ones say so on the pricing page.

• Seat limits. Three users free. Compliance is not a three-person activity: it needs the IT lead, whoever owns HR onboarding, a director to approve policies, and often an external consultant. The limit is set just below the number of people who actually need to be in the tool.
• Framework paywalls. One framework free, additional frameworks charged. If you are doing Cyber Essentials this year and ISO 27001 next year, that is the whole business model working exactly as designed.
• Evidence and storage caps. A limit on documents, uploads or retained history. Evidence is the one thing that only ever accumulates, and a cap on it is a timer.
• Export lockout. You can put data in, but the audit pack, the evidence bundle or the full data export sits behind the paid tier. This is the one to check hardest, because it converts a tooling decision into a hostage situation.
• Integrations gated. The free tier gives you a place to type things, and the automatic collection from Microsoft 365, Google Workspace or your source control - the part that made the product worth using - is paid. Manual evidence entry is precisely the job you were trying to avoid.
• Audit mode as an upsell. Everything is free until you need to give an assessor access, which is the moment you have no leverage.
• Support upsell. Free means no support at all, on a product where a misunderstood control mapping can cost you an audit finding.
• Data on exit. The terms are quiet on what happens to your data if you stop paying or the account lapses. Sometimes it is deleted after thirty days. Sometimes it is simply unreachable until you pay again.
• Trial dressed as free. A fourteen-day clock, a card required at signup, or a “free plan” that quietly ends when you cross a usage threshold you were not watching.

Questions to ask any vendor, including us

These are short, specific, and hard to answer evasively. Ask them by email so you have the answers in writing.

• What exactly changes on day 366, and what changes if we add a fifth user?
• Can we export everything - controls, policies, evidence files and history - on the free tier, without asking you, and in a format that is useful somewhere else?
• Which frameworks are included, and what is the price of adding one?
• Is evidence storage capped, and what happens when we reach the cap?
• Can an external assessor or auditor be given access without a paid plan?
• Where is our data stored, who can reach it, and can we choose the region?
• What are the support commitments, and is there any SLA at all?
• Who owns the data, and is it used to train anything or to inform anyone else’s benchmarks?
• Is there a data processing agreement available on the free tier?
• What happens to our data if we stop using the product, and for how long is it retrievable?
• What happens if you are acquired?

If the answers are clear, the free tier is probably honest even where it is limited. If they arrive as a call invitation, you have learned something too.

Our own answer

Apexward Assure is free, and the free tier is the whole platform: all six modules, all four frameworks we support - Cyber Essentials, Cyber Essentials Plus, ISO 27001 and the Defence Cyber Certification Level 2 - unmetered evidence, unlimited supplier and training portal links, integrations included, and no card at signup. Evidence packs and exports are part of the product rather than an upgrade, because a compliance tool you cannot get your evidence out of is not a compliance tool.

Apexward earns three ways, none of which requires the free platform to be worse. Some organisations need their own dedicated, self-hosted instance in a region they specify, with a named contact, an SLA and contractual terms including an MSA and DPA. That is Enterprise, and it is priced per deployment. Some want the programme run for them rather than by them, which is managed services. And some want the certification itself, which our sister brand CyberEssentials.AI awards as a certification body. Assure is a platform and does not certify anyone.

The limitation, stated plainly

Free means a workspace on our shared cloud. It runs on UK and EU infrastructure with row-level tenant isolation, but you do not choose the region, and there is no contractual SLA behind it. Support on the free tier is community and in-product rather than a named person with a response time. For most suppliers with 20 to 200 staff, none of that matters. For an organisation with a data residency clause in its own contracts, or one that needs a contractual commitment it can hand to its own auditors, it matters a great deal, and that is the actual reason customers move to Enterprise. It is a deployment decision, not a feature upgrade: the free platform produces the same evidence, the same audit packs and the same Trust Centre.

The other fair criticism of any free tier is durability. We can tell you the intent - the free platform is how we reach the organisations that later need Enterprise, managed services or certification, which makes it a route rather than a loss leader waiting to be closed - but intent is not a guarantee, and you should not take anyone’s word for that. Take the export instead. If you can get your entire programme out on demand, the question of what a vendor might do in three years stops being existential.

If you want to test any of this, the fastest route is to put a real control set into a compliance programme and try to export it. That works on the free tier, which is rather the point.