Question 1

What if Venvera does not get us audit-ready?

Accepted Answer

Follow your onboarding roadmap and if you are not audit-ready for your first framework within 90 days, we refund you in full. We carry that risk for you. Conditions apply, see section 10 of the Terms of Use.

Question 2

Will my price go up at renewal?

Accepted Answer

No. Your price is locked at what you signed for, with no escalator clauses and no renewal surprises. Steep renewal increases are a recurring complaint in public reviews of this category, so we put the opposite in writing.

Question 3

Is there a free trial?

Accepted Answer

Yes. Every plan includes a 14-day free trial with full access to all features in that tier. No credit card required to start.

Question 4

Can I switch plans later?

Accepted Answer

Of course. Upgrade or downgrade any time from Settings > Billing. Upgrades apply immediately with prorated billing; downgrades take effect at the end of your current period.

Question 5

How does pricing work? Are there per-user fees?

Accepted Answer

No per-user fees, and no seat limits - every plan includes unlimited users. Plans are flat-rate per organisation, segmented by company size: Basic is for companies up to 50 employees, Professional up to 250, and Enterprise for larger companies and groups.

Question 6

How do I choose my frameworks?

Accepted Answer

You pick them. Basic covers 2 frameworks of your choice and Professional covers 5, both from our full catalogue, and Enterprise is unlimited across every entity. Most companies have very different framework obligations but very similar functionality needs, so we let you choose the frameworks and price the plans on what the platform does for you. If your obligations change, tell us and we will change your selection.

Question 7

Is SSO available on every plan?

Accepted Answer

Yes. Microsoft 365 and Google Workspace single sign-on are included on every tier - even the trial. SSO enforcement (blocking password-based sign-in) is available from Professional.

Question 8

When does cross-framework control mapping apply?

Accepted Answer

Any time you run more than one framework, which starts on Basic. An access control you implement for ISO 27001 automatically satisfies the equivalent DORA and NIS2 controls, so you prove it once and it counts everywhere it applies.

Question 9

Are there any add-ons or extra modules to buy?

Accepted Answer

No. Everything described in a plan is included in that plan price, for unlimited users. If you need more frameworks or more functionality you move up a tier, and the tier price is the whole price. We do not sell modules on the side.

Question 10

Can Venvera manage a group of companies or a holding structure?

Accepted Answer

Yes, on Enterprise. Company Groups give each legal entity its own registers, evidence and audit trail while the parent gets consolidated scoring and cross-entity reporting in one view. Basic and Professional each cover a single legal entity.

Question 11

Is Access Reviews included on Basic?

Accepted Answer

Yes. Access Reviews is on every plan, including Basic. You get the register of who holds which access over which ICT assets, an automatic risk score from 0 to 11 with published weights, review status derived from the last review date, and scoped review cycles where each decision is recorded with its justification and the risk score at that moment. Several platforms in this category treat access reviews as an upgrade; we do not, because it is one of the controls almost every framework asks for.

Question 12

Which plan includes third-party risk management?

Accepted Answer

The vendor and ICT provider register with criticality classification is on Basic. Full third-party risk management arrives on Professional: five-signal provider risk scoring that re-computes when the data changes, unmetered questionnaire campaigns with automated chasing, and contract clause checking. Sub-outsourcing chain mapping to n-th party and concentration analytics are Enterprise.

Question 13

Which plan includes security awareness training?

Accepted Answer

Professional and Enterprise. You assign training company-wide through one self-enrolment link, staff without a Venvera seat complete it through a login-less link, and you get the completion records that evidence NIS2 Article 21(g), Article 20 management training, ISO 27001 A.6.3 and EU AI Act Article 4. It is never metered per learner and there is no cap on how many people you train.

Question 14

Can I send security questionnaires to my vendors?

Accepted Answer

Yes, from Professional upward. You run questionnaire campaigns from ready-made templates, vendors respond through a secure login-less portal, answers are auto-scored on submission and the whole exchange is logged for audit. It is unmetered, so there is no annual cap on how many you send. Basic includes the vendor and ICT provider register with criticality classification.

Question 15

What happens when my trial ends?

Accepted Answer

You will be prompted to choose a plan. Your data is preserved for 30 days after trial expiry.

Question 16

Where is my data stored?

Accepted Answer

All data is hosted on EU-based infrastructure in Amsterdam. AES-256-GCM at rest, TLS 1.3 in transit, isolated tenant keys.

Question 17

Can I cancel at any time?

Accepted Answer

Yes. Cancel any time, we refund the unused portion of your billing period.

Question 18

Do you offer discounts for non-profits or startups?

Accepted Answer

30% off for registered non-profits and pre-Series A startups. Contact sales@venvera.com.

Platform	Annual cost	Users	Access reviews	Third-party risk	Source
Venvera ProfessionalThis page	€9,588 to €10,788annual or monthly billing, 5 frameworks, published	Unlimited	Included from the entry plan	Included, unmetered questionnaires	this pagePublished by the vendor
Strike Graph Scale	~$21,500plus $2k to $5k per extra framework	Not published	Not published	Questionnaires included at Scale	strikegraph.com/pricingPublished by the vendor
Thoropass	~$30,700median contract value	Not published	Not published	Not published	Vendr deal dataReal contract data
Drata	On requestFoundation tier ~$15k, estimated	Not published	An add-on on Foundation and Advanced	An add-on on Foundation	drata.com/plansPublished by the vendor
Vanta	On request~$20k median; higher with employee and framework count	Priced by employee band	Not published	Some features are an add-on	Vanta help centrePublished by the vendor

	Basicfrom €359/mo	Professionalfrom €799/mo	EnterpriseCustom
Frameworks
Frameworksyou choose which ones, from our full catalogue	2 of your choice	5 of your choice	Unlimited, per entity
Cross-framework control mappingprove a control once, satisfy every framework you run
Limits
Company size (eligibility)	Up to 50 employees	Up to 250	Unlimited
Users	Unlimited	Unlimited	Unlimited
Vendor contracts	30	80	Unlimited
Legal entitiesconsolidated compliance across a group	1	1	Multiple
Compliance core
Gap assessments & scoring
Prioritised compliance roadmap
Cross-framework control mappingprove a control once, satisfy every framework in your plan
Control evidence library
Policy library with framework templates
Unified incident register + reporting clocksDORA 4h · NIS2 24h · GDPR 72h
Task management & deadline reminders
Regulatory updates feedEBA · ESMA · ENISA · ECB + national transposition
Risk management
Risk register with 5x5 scoring
ICT asset inventory
Internal control library with periodic testing
Issues & remediation tracking
Key risk indicatorsauto-computed from live data, with breach handling and a board pack	-
Point-in-time snapshots with diffcompare your risk and control state between any two dates	-	-
Access reviews
Register of user access rights over ICT assetsemployees, contractors, third-party providers and service accounts
Automatic access risk score, 0 to 11published weights, computed in the database, recomputable by hand
Compensating controls reduce the scoreMFA, activity logging and password policy subtract from the risk
Review status derived from the last review datenever reviewed, current, due soon, overdue - nothing to maintain
Scoped review cycles with per-item decisionsapprove, modify or revoke, with justification required
Risk score stamped at the point of decisionwhat makes an old approval defensible a year later
CSV import and evidence-pack export
Third-party risk
Vendor & ICT provider register
Provider criticality classification
Vendor questionnaire campaignslogin-less response portal, unmetered all year	-
Contract clause checkingmandatory outsourcing clauses, with a completeness score	-
Five-signal provider risk scoringcriticality, geography, concentration, contract health, data sensitivity - re-scored automatically	-
Automated questionnaire chasing and escalationreminders and internal escalation without anyone following up by hand	-
Sub-outsourcing chain mapping to n-th party	-	-
Concentration risk analyticsHHI, top-5 and top-10 spend share, sub-outsourcing exposure	-	-
Supervisory filing
Register of Information	-
xBRL-CSV export (all 15 EBA tables)one click, validated before you file	-
Resilience testing programme (Art. 24-27)	-
AI assistance (on your own provider key, never metered by us)
Virtual CISO AI (article-level answers)your own API key - Claude, GPT or DeepSeek
AI policy drafting with citations
AI policy review and auto-implement
AI gap analysis
Automation
Login-less evidence requestscolleagues submit without an account
Evidence expiry tracking
Evidence Autopilotfinds missing and expiring evidence, batches one link per person and chases on its own	-
Security awareness trainingone self-enrolment link for the whole company, login-less completion, never metered per learner	-
Training completion records for auditorscontent version, assignment, completion and the outstanding cohort	-
Trust Centerpublic trust page so buyers self-serve instead of emailing your team	-
Gated document release with an access logtoken links rather than accounts, every request recorded	-
Reporting
Board reports (PDF & DOCX)
Board dashboard + personal liability tracking
Read-only auditor logintime-boxed, so your auditor works in the tool with you
Unified board report across all your frameworks	-
White-label board reports	-	-
Integrations & access
SSO sign-in (Microsoft 365 · Google)
SSO enforcement (SAML / OIDC)	-
Integrations (M365 · Google · AWS · GCP)	-
Custom API integrations	-	-
Role-based access control
Full audit trail
Platform
EU data residency + AES-256 encryption
Five languages (EN · DE · ES · BG · AR)
Uptime SLA	Standard	Standard	99.9%
Support & guarantee
Support	Email · 48h	Priority · 24h	Dedicated specialist
14-day free trial, no credit card
Audit-ready in 90 days, or your money back^*
Price-lock: your renewal never costs moreno escalator clauses, ever

Compliance operations

Risk & incidents

Intelligence & reporting

EU financial

Privacy & security

Regional

By industry

By role

Learn

Free tools & offers

Priced by frameworks, unlimited users.

What a 250-person company pays, across this category.

Every feature, every plan.

Your renewal quote just went up. Ours never will.

What everyone asks before signing.

Try it for fourteen days.
No card.

What a 250-person company pays, across this category.

Every feature, every plan.

Your renewal quote just went up. Ours never will.

What everyone asks before signing.

Try it for fourteen days.No card.

Try it for fourteen days.
No card.