Employee-banded pricing, priced for SMBs
Pay for the band of active employees you actually have. Every plan includes the tamper-evident audit log and the guaranteed-complete offboarding case.
Free
Get started, prove the basics.
- Access record-keeping
- Offboarding checklist
- Tamper-proof audit log
- Up to 10 active employees
Starter
Never fail an access audit again.
- Everything in Free
- Auto-expiring (time-boxed) access
- Four-eyes approval workflow
- Manager-scoped RBAC
- Up to 50 active employees
Growth
Access management runs itself.
- Everything in Starter
- Recurring access reviews
- Automated data-retention enforcement
- SLA-breach email reminders
- Up to 250 active employees
Business
Automatic provisioning & deprovisioning.
- Everything in Growth
- Real connectors (auto provision + revoke)
- Generic SCIM & REST
- Public API & webhooks
- Priority support
- Up to 1,000 active employees
Enterprise
For organizations beyond the top band.
- Everything in Business
- Custom employee volume
- Volume pricing (~$1/active employee)
- Onboarding & priority support
// bands settle at renewal · only ACTIVE employees count · prices from your live plan catalogue
Offline edition
Run Grantledger entirely inside your own infrastructure — for teams whose policy or regulator requires the software and data never leave their network. Same governance engine, self-hosted, with a licensed offline entitlement.
Honest answers
How does employee banding work?
You pay for the band of ACTIVE employees you have (up to 10, 50, 250, or 1,000). Offboarded or erased employees are retained for your records but don't count toward the band. If you cross a band, it settles at your next renewal — no mid-cycle surprise charge.
Do you support [my integration]?
Likely yes. On the Business tier, connectors automatically provision access on approval and revoke it on offboarding — AWS IAM, Okta/Entra/Google via SCIM, GitHub, GitLab, GCP, Azure, HashiCorp Vault, BambooHR/Gusto (HRIS), plus token-based presets (Slack, Zoom, HubSpot, Zendesk and more) and a generic REST connector for any HTTP API. Not connected? That app stays a tracked, revoke-on-a-checklist system of record. We are HRIS-first and cover about a dozen deep — not hundreds shallow. There is also a public API and signed webhooks.
Is this an IGA replacement, or a lighter tool?
A lighter, SMB-focused tool — deliberately. We don't compete with Okta or SailPoint on connector count. We win on being honest, fast to set up, and priced for companies too small for a $50k/year IGA platform but still facing a SOC 2 / ISO 27001 / HIPAA audit.
What's the Offline edition?
A self-hosted deployment for teams that can't use SaaS — the software and all data stay inside your own network, licensed via an offline entitlement. Priced separately from the online tiers; talk to us to set it up.