You upload your evidence (policies, configs, screenshots, ticket samples, narratives) and pick a framework, or all five. The AI assessor reads your evidence under the framework's published assessor guidance and grades each control, the same way a human assessor would. You review the grades, override anything you disagree with, and sign off. Then export the SSP, POAM, and SoA in the formats your assessor expects.

It means the opposite. The rubric didn't change, the referee left. Before, a third-party assessor was the backstop that caught a control you'd graded too generously. Now that grade goes straight into something you attest to, under your name, with real consequences if it's wrong. Self-assessment is cheaper than a C3PAO engagement. It is not easier to get right. Agrimi grades your evidence against the same objective-level DoD guidance a C3PAO would have applied, so the assessment you're signing is one that would have survived the audit that's no longer happening.

Yes. The platform is running today on the foundational customer (SofWerx, a Defense Industrial Base org) and is being staged for self-serve trial access. What's left is multi-tenancy hardening, onboarding polish, and rolling out the cross-framework mappings, not building the core product.

$100 a month, or $1,000 a year. Save $200 by paying annually. One plan. Every framework. Every feature. No add-ons. No tiers. No "talk to sales for Enterprise." If you're an MSP, talk to us about per-managed-client pricing.

Five: CMMC L1, CMMC L2, NIST CSF 2.0, ISO 27001:2022, and CIS Controls v8. The cross-framework mappings published by NIST, CIS, and the AICPA are built in: upload evidence against CIS Control 6 once and we surface the matching CMMC L2 AC controls, NIST CSF PR.AC subcategories, and ISO Annex A.9 items. SOC 2 is post-launch, demand-triggered.

No, and we won't pretend it is. "One-click SSP" produces hollow artifacts that fail audits. There's a clean division of labor: you own the facts (what's actually in place at your org), the AI owns the interpretation (reading evidence under the framework's assessor rubric and grading it), and you review and sign off before anything lands in your system of record.

Different product category. Vanta and Drata are continuous-monitoring tools: agents on your endpoints, read-keys to your cloud, watching for drift. Agrimi puts an AI assessor on top of your evidence: you upload what's real, we grade it under framework guidance, you sign off. For SMBs that don't have 40 SaaS integrations, this is the faster path to a document an auditor will accept.

No, and that's intentional. We don't do continuous monitoring. Agrimi manages your compliance program: evidence references, narratives, POAM, training records, access reviews. It does not pull credentials or read your production systems. Less attack surface for you, no "trust us with prod" conversation for us.

For CMMC L2, there's no longer a C3PAO to replace. For ISO 27001, certification still runs through an accredited certification body, and Agrimi produces the SoA and artifacts they'll review. What Agrimi never replaces is you. The AI grades the evidence and shows its reasoning; you review it, override what you disagree with, and sign off. The judgment and the signature stay yours.

No. Agrimi is hosted on AWS commercial (not GovCloud), and our Terms of Service explicitly forbid CUI uploads. Your CUI lives in your DFARS-compliant environment; Agrimi manages the program that protects it. If you need a CUI-handling deployment later, we'll have a path.

No. The product assumes you don't have one. A technical founder, an IT lead, or a fractional vCISO is enough. Agrimi is built for the practitioner who got handed compliance because they were "the IT person," not for someone with a CISSP who already knows the field.

Yes. There's an MSP plan from day one, not bolted on. Per-managed-client billing, one dashboard across all your clients, and both onboarding flows: stand up new client orgs from your dashboard, or get invited into orgs the client signed up themselves. Reach out before launch to lock in early-partner terms.

Yes. We'd be hypocrites if it weren't. Data is encrypted in transit and at rest, region-pinned to us-east-1, multi-tenant with Postgres row-level security, least-privilege access by default. Our own compliance posture will be public from day one.