Priced per institution, so everyone who owns a risk can have a login.
Charging per seat would mean a bank leaving risk owners off the platform to save money, and then the register is not signed by the people the standard names. So we do not charge per seat.
No rate card is published. Figures are quoted in writing against scope. Invoicing available in MWK, NGN, KES, GHS or USD.
One institution. Everyone who owns a risk gets a login.
Single institution
One organisation running its own cycles.
Contact for pricing
Portfolio Most institutions
Advisory firms, vCISOs and banking groups.
Contact for pricing
Enterprise
Where procurement sets the shape.
Custom
In every plan
What every plan includes, without an upgrade.
Unlimited named users
Every risk owner, approver and viewer your institution needs. A signature under clause 6.1.3 should never be a licensing decision.
Per institution, not per seatThe append-only audit trail
Who changed a rating, when, from what to what. Not a premium feature, because without it the register is not evidence.
No update path, no delete pathYour currency and your regulator's calendar
Asset value bands and compliance obligations configured for your institution, in your own currency.
Configuration, not customisationBoard PDF and editable DOCX export
Produced from the live register. Your consultancy's branding, structured the way a board pack expects.
Every planImport of your existing worksheet
We read the register you already keep, flag the rows whose figures cannot be verified, and bring the rest across.
Included in onboardingDeliberately
AI-assisted features are not in any plan.
They are a separately scoped, separately priced module, and that is a considered position rather than a gap.
Independent assessment of this category through 2026 found AI features across GRC platforms over-marketed and under-delivering, with cost and functional limits cited as the barriers to adoption. A half-built assistant inside a risk register is worse than none, because it produces output that looks authoritative and is not. When GUUT ships it, it will be scoped, priced and built properly.
From procurement
The things procurement asks first.
How are you priced, per user or per institution?
Per institution. Named users are unlimited on every plan. The variables are the number of client organisations, the number of assessment cycles, and the deployment requirements.
Is implementation included in the licence?
Onboarding is, including import of your existing register and configuration of your currency, value bands, departments and obligations. Bespoke integration work is quoted separately.
What about data residency?
Hosting region is a deployment decision recorded per client, and several African data protection regimes restrict cross-border transfer. Enterprise plans include residency options. Ask before contract, not after, because it shapes the deployment.
Can we migrate our existing spreadsheet?
Yes, and it is part of onboarding rather than an extra. Rows whose calculated fields were overwritten are flagged for re-scoring instead of being imported as though they were sound, and you get a validation report showing exactly what mapped.
What happens at renewal?
Your assessment content is yours. On termination you export the full register, the audit trail and the reports. There is no hostage period and no fee to leave with your own data.
a written quote
Ask for a written quotation.
Tell us how many organisations, which framework versions and where it needs to be hosted. You get a figure in writing against that scope.