Headcount caps and FTE bands

Compliance work grows with people. Every employee is onboarded, trained, given access, reviewed and offboarded, and each of those steps produces evidence. That is why vendors ask for headcount before they quote.

The one published cap

Drata's Compliance Automation Foundation covers up to 50 FTEs. Above that, the plans page points to GRC Advanced and GRC Enterprise, which do not list a headcount limit in our read. Drata is also the vendor that tells you the most about when you will be moved up: the 50 FTE cap and the one-framework rule are both on the card.

Everyone else

The other six vendors publish no headcount limit. Scytale groups its plans into startup bundles and plans for security teams (Scale and Enterprise) without stating a size for either. Sprinto describes Foundation as "For startups on their first certification" and says it serves companies "from Series A to enterprise". Neither is a number.

No published cap does not mean no size-based pricing. It means the size rule is applied in the quote rather than on the page.

Without a number, plan names are the only size signal. Sprinto aims Foundation at a first certification, and Scytale splits its plans into startup bundles and security-team plans. If your company sits between the two groups, ask for a quote on each and compare what changes besides the name: limits, inclusions and services.

FTE, employees or users?

Plans may count full-time equivalents, employees or platform users. These can differ a lot in a company with contractors or part-time staff. Ask how the vendor counts, and whether contractors who need access to in-scope systems count.

Plan for growth

A cap matters most when you are close to it. If you have 40 people and plan to hire 20 this year, a 50 FTE cap will be crossed during the term. Ask what happens at renewal and mid-term:

• Is the price re-set at renewal, or mid-term when we cross the cap?
• Is there a per-employee rate above the cap, or a tier change?
• Can we lock the price for a multi-year term at a stated headcount range?

Headcount and the audit

Headcount also affects the audit, because auditors sample people-related controls such as onboarding, training and access reviews. That cost sits with the audit firm, which is another reason to keep the platform and audit lines separate.

The takeaway

Know three numbers before any call: current headcount, expected headcount at the end of the term, and how many contractors touch in-scope systems. Choose your band in the calculator; it warns when Drata's Foundation cap is exceeded.