1. Checkout
Your checkout email becomes the written delivery reference for the standard EPI Rail offer you selected.
Purchase EPI Rail
Start with a packaged Duo if you need the standard direct path. Rail Core remains available for narrow BYOL / technical use. Pro remains the breadth / advisor / multi-framework lane.
All standard tiers use the same bundled local Windows reviewer-ready evidence-pack product. What changes is the library scope and commercial lane, not the underlying rail.
EPI Rail is not a continuous-compliance platform, a certification engine, or a cloud evidence-collection platform.
Standard path after purchase
For standard tiers, the path stays local and package-led: checkout selects the versioned offer, delivery stays tied to that tier, and local verify confirms the delivered pack on your Windows machine. Bespoke/custom work stays outside this flow.
2. Delivery
You receive the versioned local Windows package, proof artifacts, and verify path matching the selected standard tier. The current handoff is still issued against the checkout email.
3. Verify locally
Run verify locally, inspect the proof artifacts, and review the packaged baseline through the current verify and proof surfaces. No onboarding call is required for the standard path.
4. Support
Standard clarification stays async by email. Bespoke/custom subsets, overlays, and customer-specific variants are handled separately and typically start with a written reply within 24-48h. No calls.
Current public truth
The preserved March 13, 2026 specimen evidence remains part of product truth.
Current verifier/contract drift relative to that preserved specimen is also part of product truth, but the current public proof and verify surfaces do not yet expose a dedicated drift indicator or artifact. Civitas does not describe current verifier state as unchanged.
Founders Cohort: 50 seats or 60 days (whichever comes first). Prices increase after cohort.
How to read the tiers
The library names below refer to recognized external baselines and their published revisions. Civitas does not claim ownership of ISO, AICPA, NIST, CIS, or similar frameworks.
What you buy from Civitas is the EPI Rail layer around them: the software bundle, package structure, verification workflow, curated preview model, and reviewer-ready delivery architecture.
- Rail Core (BYOL): the narrow BYOL / technical lane if you want the rail, verifier/proof artifacts, and will bring your own mappings. It does not lead direct outbound.
- Any Duo: the packaged readiness path and the direct-purchase lead, with two pinned library baselines for a specific review path.
- Pro Full Suite: the annual breadth / advisor lane for teams that need wider coverage or multi-framework use.
- Bespoke/custom: tailored subsets, overlays, custom library variants, or customer-specific adaptation. This sits outside the fixed tiers and remains manual and email-led.
Standard delivery and bespoke handling
- Standard tiers are fixed, versioned EPI Rail offers selected directly in checkout.
- Standard delivery is issued against the checkout email and follows the exact package, proof artifacts, and verify path attached to the purchased tier.
- Bespoke/custom work covers tailored subsets, overlays, custom library variants, and customer-specific adaptation; that path remains manual and is typically handled in writing within 48h.
- March-April bonus: any Duo can claim one additional library by email (one-time).
- Support: async email-only (24-48h). No calls.
Packaged direct path
EU Readiness Duo
£2,950 / year
Pinned two-library readiness path for one review lane.
Includes
- Vendor Security (80 controls)
- ISO 27001 (93 controls)
March–April bonus: any Duo includes one additional library of your choice (one-time claim via email).
Need a tailored subset, an overlay, or a bespoke variant? That sits outside the fixed Duo offer and is handled separately by email.
Packaged direct path
US Trust Duo
£2,950 / year
Pinned two-library readiness path for one review lane.
Includes
- Vendor Security (80 controls)
- SOC 2 Readiness (100 controls)
March–April bonus: any Duo includes one additional library of your choice (one-time claim via email).
Need a tailored subset, an overlay, or a bespoke variant? That sits outside the fixed Duo offer and is handled separately by email.
Packaged direct path
IR Snapshot Duo
£2,450 / year
Pinned two-library readiness path for one review lane.
Includes
- Vendor Security (80 controls)
- DFIR Incident Response (84 controls)
March–April bonus: any Duo includes one additional library of your choice (one-time claim via email).
Need a tailored subset, an overlay, or a bespoke variant? That sits outside the fixed Duo offer and is handled separately by email.
Breadth / advisor lane
Pro Full Suite
£3,950 / year
Wider annual library coverage for repeat, advisor, or multi-framework use.
Founders price: £3,950/yr until 30 Apr 2026. Then £4,950/yr.
Includes
- Vendor Security (80 controls)
- ISO 27001 (93 controls)
- NIST CSF (80 controls)
- SOC 2 Readiness (100 controls)
- DFIR Incident Response (84 controls)
BYOL / technical lane
Rail Core (BYOL)
£999 one-time (Founders Lifetime)
Narrower rail-only lane for teams bringing their own mapping method.
Includes
- rail + verifier + proof artifacts
- BYOL mappings
- Windows-only
Framework baselines monitored
These libraries remain pinned to recognized external frameworks and their published baseline revisions. Civitas tracks updates and rolls them into versioned releases; the frameworks themselves remain external.
- ISO 27001 is pinned to ISO/IEC 27001:2022 Annex A (93 controls). Control references use 5.1..8.34. We track ISO/IEC 27001:2022/Amd 1:2024 for requirement-level updates; Annex A remains 93.
- Vendor Security is pinned to CIS Controls v8 at control-family level (CIS-1..CIS-18), with 80 controls in this library revision.
- SOC 2 is pinned to AICPA TSC 2017 with Revised Points of Focus 2022 (100 controls).
- NIST is pinned to NIST CSF 1.1 (80 controls).
- DFIR is pinned to DFIR Readiness Baseline v1 with Respond/Recover crosswalk (84 controls).
Support Civitas
If you want to support independent evidence-first work.
Want to inspect the evidence trail first? Review the proof artifacts and the packs/changelog before purchase.