Free to prove the problem. Paid to solve it at fleet scale.

Why we tier by employee count

Employee count is the only number that actually predicts cost to serve.

Frameworks the orchestration product maps to

What regulators and auditors actually ask for.

SOC 2 CC6.2

Per-subject access-review evidence satisfies the 2024→2026 auditor sampling shift.

California CCPA / CPRA

45-day DSAR response on former employees with per-subject access history.

NY SHIELD Act

§899-bb reasonable-safeguards evidence and audit logging for residents of New York.

Colorado AI Act

Developer + deployer evidence trail for AI systems employees interact with.

EU AI Act Article 26

Operator records of AI system use by employees, effective August 2026.

NYDFS 23 NYCRR 500

72-hour revocation standard for regulated financial-services entities.

Tenet is an orchestration layer, not an attestation. We produce the evidence your SOC 2 auditor, state-privacy regulator, or EU AI Act operator can read without translation. Your compliance stack (Vanta, Drata, Secureframe) remains your source of attestation truth.

Pricing FAQ

What buyers ask before sending a quote request up the chain.

How does Tenet bill — monthly or annual?

Tenet Orchestration is billed annually. The monthly figure shown on each tier is the effective rate; invoices cover 12 months upfront by default, with quarterly payment available on the Growth and Scale tiers.

Is there a pilot or trial for the paid orchestration product?

Yes. All three paid tiers open with a 30-day paid pilot — full product, full support, priced at one month of the annual rate. If you don't see an order-of-magnitude drop in ghost-account rate or audit-evidence preparation time, we refund the pilot and part ways. Design-partner slots exist for the first 10 customers with extended terms.

What does your security review look like?

Tenet ships with SOC 2 Type I at launch and Type II audit in flight. Penetration-test report available under NDA. The CLI is Apache-2.0 and inspectable end-to-end. The paid product uses service-role keys scoped per customer tenant, deployed in an isolated schema inside our Supabase instance, with encryption at rest and in transit.

Can we cancel? What happens to our audit history?

Yes. Annual contracts can be cancelled with 60 days notice; the remainder of the paid term stays active. On cancellation we produce a complete per-subject audit export in the format your compliance stack expects (Vanta, Drata, or raw JSONL) so you retain every record Tenet captured during the relationship.

Which HRIS and IAM systems does Tenet integrate with on day one?

Launch HRIS: Rippling, BambooHR, Workday, and Gusto. On 2026 roadmap: ADP, UKG, and Justworks. Launch IAM: Okta, Microsoft Entra ID, Google Workspace, and JumpCloud. On roadmap: Ping Identity and OneLogin. Long-tail SaaS apps (300+) connect via SCIM where supported and audited admin-console workflows elsewhere.

Where does customer data live — and can we choose a region?

Tenet's default deployment runs on Supabase in the US-East region. Starter customers inherit the default; Growth and Scale customers can elect EU-West or US-West on request. Data-processing agreements available at signing. No Tenet component writes plaintext employee data to any log — all audit records carry SHA-256 digests only.

What's the implementation time from contract to first audit?

Two to six weeks from kickoff to first orchestrated revocation event. Starter customers typically close their first evidence export in week three; Growth and Scale customers with more custom connectors average four to six weeks. First SOC 2 evidence sampling runs against Tenet data inside 90 days.

What if we already use BetterCloud, Torii, or Zluri?

Tenet is the orchestration layer; those products are SaaS management layers. Most customers adopt Tenet alongside an existing SaaS management tool and deprecate that tool inside the first renewal cycle once the audit trail consolidates. See /compare for honest head-to-head pages on each alternative.