Pricing
Readiness — You can see what's true · Control — You decide what happens to it · Autonomous — It acts for you
ShipReady Metrics reads your code, cloud, and tooling through least-privilege, documented connectors and turns them into the metrics you’d otherwise dig through every repo to assemble — one fix-first vulnerability queue, tech-debt hotspots, delivery signals, and a board-ready nine-domain score.
Pricing is per active code contributor — you pay for the people who actually write code, not for every login. Reviewers, managers, executives, and auditors are never billed. The ladder reads See → Prove → Fix: see the signal, prove your posture, and let the platform fix what it finds.
See
Readiness
You can see what's true.
Every metric you'd dig through 40 repos for — aggregated, deduped, ranked.
Self-serve · solo developers welcome
- One fix-first queue across every repo — vulnerabilities deduped (the same CVE in 12 repos is 1 item), ranked by real exploitability (CISA KEV / EPSS / CVSS), production vs dev-scoped, with aging
- Technical-debt & complexity hotspots across the estate, ranked
- Delivery signals with zero spreadsheet work — DORA lead time, deploy frequency, PR cycle time, with trend
- End-of-life & dependency radar — runtimes and frameworks past EOL anywhere in the estate
- Slack alerts on material change — a new exploited vulnerability in any repo, a score drop
- The leader roll-up included: org-wide nine-domain score, benchmarking, board PDF export
- Live-verified, least-privilege connectors: GitHub, GitLab, Gitea, Vercel, Supabase, AWS, and Azure (90-day contributor dedup where supported)
- Unlimited viewer seats — viewers are never billed
- Coming soonOne compliance framework in a gap view (e.g. SOC 2)
- Vulnerability workflow (ownership, SLAs, remediation tracking)
- Compliance & Trust Center
- AI governance
- SSO / SCIM (beta)
The trial covers engineering readiness scoring (up to 5 repositories, 1 seat). Compliance and AI governance are in beta — subscribing does not enable them. SSO is in beta.
Prove
Control
You decide what happens to it.
Go deeper on security: own the findings, work them to close, prove the posture.
Self-serve · minimum 5 contributors
The step up is security depth. Readiness shows you the ranked queue; Control is where you work it — every finding owned, on an SLA, tracked to closure or a recorded exception, with per-team accountability and the AI-governance inventory an auditor will ask for.
- Everything in Readiness
- Full vulnerability management: ownership, SLAs, remediation tracking, exceptions
- AI governance — AI system, model, and agent inventory with risk classification and ISO 42001 / EU AI Act / NIST AI RMF readiness (auditor-shareable)
- Per-team scores — each team graded on just its repositories
- Dollar Value at Stake
- SSO / SAML / SCIM (beta, set up with us) + role-based access
- Coming soonAuthorized DAST — dynamic scanning of your running services, authorization-gated
- The full GRC framework suite (Autonomous)
The trial covers engineering readiness scoring (up to 5 repositories, 1 seat). Compliance and AI governance are in beta — subscribing does not enable them. SSO is in beta.
Comply
Autonomous
It acts for you.
GRC readiness across 23 frameworks — starter control sets, continuous evidence collection, and AI-drafted questionnaire answers your team approves.
Self-serve · custom Enterprise above 250 contributors · minimum 5 contributors
- Everything in Control
- All 23 compliance frameworks as starter control sets — continuous evidence collection, control mapping, review. No per-framework fee
- Public Trust Center + AI-drafted security-questionnaire answers (human-approved) + auditor portal
- OSCAL export
- Full trend history
- Coming soonIntelligence-fed scoring from the security & code pipelines
- Coming soonFull data export + API access
The trial covers engineering readiness scoring (up to 5 repositories, 1 seat). Compliance and AI governance are in beta — subscribing does not enable them. SSO is in beta.
Running more than ~250 contributors, or need self-hosting / air-gap? Talk to us about a custom Enterprise plan.
What counts as an active contributor?
- An active contributor is a distinct human who committed source code in the last 90 days.
- Counted across GitHub, GitLab, Azure DevOps, and Gitea, and deduplicated — one person on two providers is one contributor.
- Bots and AI coding agents are excluded from the bill (and shown so you can check).
- Anyone who doesn't commit code — reviewers, managers, viewers — is not counted.
- The count is measured from your connectors, disclosed in-app per person, and contestable.
How buying works today
- Every signup starts an instant 14-day trial — no card required, no waiting on approval.
- There is no self-serve checkout yet. Paid plans are arranged directly with the team — reach us via the enterprise page or info@persooninc.com.
- When a trial ends, the workspace locks until a plan is arranged — your data and score history are kept, not deleted.