Start free. Two paid plans, the same features.

No. Every plan holds both in one program: one register of systems, HIPAA and AI governance assessments, and the records each calls for. The Free plan includes 1 AI system and 1 system that handles ePHI, and a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only; the Privacy Rule questions and the optional HIPAA packs come with a paid plan, and answers already given are kept. The paid plans differ in how many AI systems and systems that handle ePHI you register, and Watney's fair-use limit scales with the plan.

The Free plan has no time limit and needs no card. You can run assessments against the framework packs, take a system through review and approval, write its model and system cards, and invite the people who review and approve, as many as you need. The Free plan includes 1 AI system and 1 system that handles ePHI, and a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only; the Privacy Rule questions and the optional HIPAA packs come with a paid plan, and answers already given are kept. Watney, exports and scheduled report emails, auditor and guest links, the transparency page and public badge, the API and MCP server, webhooks and SIEM forwarding, and SAML single sign-on and SCIM provisioning come with a paid plan; the download of all your organization's data works on every plan.

A new organization starts on the Free plan, with no time limit. If a paid plan ends, the organization moves to the Free plan; nothing is deleted because a plan ended, and the organization itself is deleted only when an organization admin closes it. We email your organization admins 7 days before a subscription that was canceled ends. An admin can download the organization's data at any time.

The number of AI systems and of systems that handle ePHI, and Watney's fair-use limit, which scales with the plan. Premium includes 1 AI system and 1 system that handles ePHI. Each additional AI system is $49 a month or $499 a year; to add systems that handle ePHI, contact us and we will add them to your plan. Enterprise has no limit on either. Every other feature is the same on both. A system counts in every lifecycle stage except rejected, suspended and retired, and a system that uses AI and handles ePHI counts toward both.

Yes. Watney, the AI assistant, is included on Premium and Enterprise at no extra charge, within fair-use limits. If your organization reaches a limit, Watney pauses, and the pause message says when it resumes or how to turn it back on; approvals, registers and exports never depend on Watney and keep working. It is not part of the Free plan.

Yes. Both paid plans are sold monthly or annually; annual is about two months cheaper.

Premium and Enterprise include these framework packs: NIST AI RMF 1.0, NIST AI 600-1 (Generative AI Profile), NIST Cyber AI Profile (IR 8596 initial preliminary draft), NIST COSAiS Predictive AI (built from NIST's January 2026 outline), ISO/IEC 42001:2023, ISO/IEC 42005:2025, ISO/IEC 23894:2023, EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744), EU AI Act GPAI model obligations (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744), NYC Local Law 144 of 2021 (AEDT), Colorado ADMT Act (C.R.S. 6-1-1701 to 6-1-1709, SB 26-189), California CCPA Regulations on ADMT and Risk Assessments (2025), California Civil Rights Council Regulations on Automated-Decision Systems (2025), Illinois Human Rights Act (775 ILCS 5), as amended by P.A. 103-0804 (HB 3773), Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 2025), Utah AI Laws (Utah Code 13-72, 13-72a, 13-77 and 58-60-118, as amended through 2026), UK AI Cyber Security Code of Practice (2025), Singapore Model AI Governance Framework (2nd ed., 2020), Singapore Model AI Governance Framework for Generative AI (2024), Singapore Model AI Governance Framework for Agentic AI (v1.5, 2026), OWASP Top 10 for LLM Applications 2026, MITRE ATLAS 2026.09, HIPAA Security and Breach Notification Rules (45 CFR 164 Subparts C–D, eCFR 2026-10-06), HIPAA Privacy Rule (45 CFR 164 Subpart E, eCFR 2026-10-06), 42 CFR Part 2 (Substance Use Disorder Patient Records, eCFR 2026-10-05), HHS 405(d) HICP (2023 Edition), NIST SP 800-66 Rev. 2 (February 2024) and ONC Information Blocking (45 CFR 171, eCFR 2026-10-06). The Free plan includes them too, except the HIPAA Privacy Rule and the optional HIPAA packs: a HIPAA assessment on it asks the HIPAA Security and Breach Notification Rules questions only. Assessments run at two levels: your organization's program, and each AI system and each system that handles ePHI.

No. Every plan, the Free plan included, has unlimited team members, because reviews and approvals need several people.

No. Backsplice supports your AI governance and HIPAA program: it keeps the register of systems, runs the assessments, records who approved what and why, and produces the evidence. Whether your organization meets a law or a standard is a judgment for your organization and its advisers.

Watney sends the model provider only what a task needs: the records you typed, documentation you paste in, and the contents of uploaded evidence files (or its earlier summaries of them) when Watney reviews or drafts an answer or summarizes evidence. When it researches a model card or looks up a public model, it also runs web searches through the provider's search tool, written by the model from your request, the model's registry record and the card as it stands on screen. It proposes; it never approves, sets a risk tier, or publishes anything. Watney's card page names the model provider and the models in use; its system card is not published yet.