Free Tier
What it is
Free is CMDash's $0 tier, for one job: a small defense supplier can do a defensible CMMC self-assessment, affirm it with the Signer's File, and prove it to the prime that asked — for $0. Free never needs a card. Where online card payment is available, the sign-up page offers two choices side by side: a 30-day Command trial (pre-selected; card required, first charge on day 31, cancel anytime before) or Continue with Free (no card). Choosing the trial takes you to Stripe Checkout right after you confirm your email; leaving that page keeps you on Free, with a dismissible reminder to finish starting the trial. A sign-up page that does not show the trial choice lands directly on Free, with no card (sign-ups before 2026-09-29 instead started on a 30-day Starter trial), and a 30-day trial of Starter, Essentials or Command is a separate, later step through Stripe Checkout. Either way the trial collects a card up front and converts to the chosen plan and price on day 31 unless you cancel first, which drops the workspace back to Free — never locked, nothing deleted.
When to use it
Free is the right fit for a single small supplier working through one CMMC self-assessment, affirming it, and proving it to the one prime that asked — solo or with one other preparer, on one connected integration. Once you need a second framework, more than one integration, faster syncing, more than two users, or any AI feature, that's the signal to start a card-backed trial of Starter, Essentials or Command rather than working around Free's limits.
Before you start
- Tier: this page describes the Free tier itself — the lowest of CMDash's tiers, with no price and no checkout.
- Role: every member of a Free workspace sees the same product; only the workspace owner changes billing/plan state (starting a paid subscription moves the workspace off Free).
- New sign-ups that choose Free land here directly, with no card. A sign-up that chose the trial but left Stripe Checkout also lands here, never locked. See Lifecycle below.
What's included
| Included | Limit |
|---|---|
| CMMC Level 1 or Level 2 self-assessment | 1 framework, from cmmc-l1/cmmc-l2 |
| SPRS score, POA&M tracking (items, milestones, status) | POA&M export is Starter+ |
| Proof receipts (measured, self-assessed, or self-attested) | 1 connected integration, synced daily |
| Signer's File (annual affirmation, with the contradiction check) | 1 signed obligation |
| Sharing proof with a relying party | see note below |
| The public proof verifier | — (always free, no login required) |
| Focus navigation (Assess · Prove · Sign) | on by default |
| Users | 2 (the affirming official + one preparer) |
| Evidence storage | 250 MB total, 10 MB per file |
| transactional only (security, requests, deadlines) — no weekly digest | |
| AI features (policy drafting, suggestions, narratives) | none — every AI route and cron skips Free |
Everything else — a second framework, more integrations synced more often, more than 2 users, the C3PAO-ready CMMC package export, AI features, more storage, risk register, posture score, board reports, SSO — is a Starter-and-above feature. The app shows every locked feature in place, so you can see what upgrading unlocks rather than hitting a dead click.
Share limit: a Free workspace can have 3 active shares (live share links plus active relying-party grants). A fourth is refused until you revoke one or upgrade; shares you already issued keep working.
How to
Sign up
- Requires a verified business e-mail address — personal and disposable e-mail providers can't create a workspace.
- Protected by Cloudflare Turnstile.
- One Free workspace per e-mail domain. A colleague at the same domain is asked to request to join the existing workspace rather than create a second one.
- Depending on the platform's current sign-up switch, new Free sign-up may be open, waitlisted (you can still submit the form to join the waitlist), or closed.
Answer a supplier invitation
A company that depends on you can ask for proof through the Relying-Party Desk.
Its e-mail link opens /proof-invite, which offers Create your free workspace (the matching
obligation is pre-selected) or Sign in. A Free workspace is enough to answer: accepting
creates a grant that shares only the statements asked for. To accept you must prove the domain
the request was sent to by DNS TXT record (Free can prove one domain; see
Prove a domain), and be signed in with a verified address at that domain.
Move through the lifecycle
- Days 1–30: a trial of whichever paid plan you selected at signup (Starter, Essentials or Command). A card is required to start it; sign up for Free directly instead if you'd rather not use a card at all.
- Day 31: the workspace moves to Free unless it's paying. Anything above Free's limits turns read-only; nothing is deleted. The owner picks which 2 users stay active if more were invited during the trial.
- After 30 days with no sign-in by any member, the workspace's owners and admins get an e-mail saying the workspace will be permanently deleted, and on which date. A reminder follows 7 days before that date (day 53).
- After 60 days with no sign-in, the workspace goes dormant — background jobs (syncs, receipt refreshes, sweeps, digests) skip it, and its receipts go stale in plain view of any relying party — and it is closed on the date the e-mails named (the 61st day after the last sign-in, UTC). Its data is permanently deleted 14 days after that, and a deletion certificate is issued.
- To keep the workspace, sign in. Any member's sign-in, at any point before the data is deleted, cancels the countdown (and wakes a dormant workspace); the 30-day count then starts again from that sign-in. To take a copy of your data first, sign in and open Data export. A workspace with an active relying-party grant does not go dormant or get deleted, and neither does a paid workspace or one in a trial.
Recognize the cost controls
- AI is off entirely on Free — every AI route (policy drafting, suggestions, board narrative) answers with an upgrade hint, and the crons that generate AI content skip Free workspaces.
- Sync frequency is daily, not the 4-hour default paid tiers get.
- Storage is capped at 250 MB total, 10 MB per file — an upload past the cap is refused with a clear error rather than silently truncated.
- The weekly digest e-mail does not go to Free — only transactional e-mail (security notifications, proof requests, deadlines).
Common questions
Will my data disappear if I don't upgrade? No. At day 31 your workspace simply becomes read-only above the Free limits — nothing is deleted. A Free workspace is deleted only when nobody signs in to it for 60 days, after an e-mail at day 30 and a reminder at day 53 that name the date; signing in at any point cancels it.
Can I pick which framework I keep on Free? Yes — Free allows exactly one framework, from CMMC Level 1 or Level 2.
What if I need a second integration or a faster sync? That's a Starter reason to pay: Starter adds more integrations, a 4-hour sync, a second framework, more users, AI, and the C3PAO-ready export.