Classes match the five category descriptions on the Why Crucible page. Claims reflect publicly published materials from the named representative vendors as of 2026-04-28. See Methodology & Sources for the full citation framework, and Legal Notice for trademark, comparative-claim basis, and the correction-request mechanism.

Dimension Single-practitioner tool
e.g., MedTrainer, Compliancy Group, PowerDMS
Mid-market GRC
e.g., Vanta, Drata, Hyperproof
AI-first legal research
e.g., Harvey AI, Lexis+ AI, Thomson Reuters CoCounsel
Enterprise GRC suite
e.g., ServiceNow GRC, MetricStream, Archer IRM
Accreditor manual
e.g., The Joint Commission, CARF, ACHC
Crucible
Deployment Cloud SaaS Cloud-only multi-tenant Cloud, seat-licensed Cloud-only multi-tenant Printed / PDF
E-Subscription
On-premise. Runs on hardware you own, inside your LAN.
Where your data lives Vendor cloud Vendor cloud Vendor cloud + third-party AI infra Vendor cloud Your file cabinet Your facility. Zero WAN egress. No cloud API calls.
LLM location Cloud (if any) Cloud, vendor-chosen Third-party cloud inference Cloud bolt-on (late 2025+) None Local. Runs on your hardware. Model disclosed.
Regulatory corpus source Generic content library Feed from legislative-tracking vendor Case-law archive Pass-through from same feeds One accreditor's standards Per-client corpus. Sage scrapes your industry + jurisdictions, rebuilds daily.
Citation model Recitation. Policy excerpts paraphrased into the platform. Recitation. AI paraphrases the rule. Recitation. Model can paraphrase or hallucinate. Recitation. AI bolt-on inherits LLM hallucination surface. Citation. Verbatim — it's the book. Citation. Verbatim from corpus. Handler renders text, LLM never generates rule text.
Hallucination posture Low AI surface Policy guardrails Guardrails + disclaimers Policy-level human review N/A Structural. Intent router + deterministic handlers — hallucination impossible on 11 of 12 surfaces.
Gap tracking Breach log Spreadsheet module None Risk register None Element-level. Pass/fail per rule, verification codes, two-role attestation, correction deadlines.
Audit-day output Policy binder Dashboard screenshot Research memo Dashboard export The manual Printable DRP. Agency-scoped document package with verbatim rule text appended.
Pricing model Per-seat / per-facility Per-seat Per-seat Per-seat + per-module Annual manual + Subscription fee Flat per facility. One install covers the compliance team — no seat tax.
Entry price point $2K–$10K / yr $5K–$30K / yr $3K–$6K / seat / yr $45K+ / yr floor $250-$500 manual
$1,500-$3,000 E-Subscription
Free engine + $295–$495/mo Sage subscription. Declining ramp from $495 month 1 down to $295 by month 10, locked at signup.
Per-seat tax as team grows Yes Yes Yes, steep Yes No (physical books, just copies) No. Unlimited users on the compliance team at one flat rate.
When you stop paying Access revoked Access revoked Access revoked Access revoked You keep the book but E-Subscription revoked App keeps running. Updates stop. Client data stays accessible on the client's own hardware.

Methodology & Sources

Every cell in the matrix above can be traced back to a vendor's own publicly published material or a cited third-party source. Below is how those claims were gathered, dated, and bounded.

Source types

  • Vendor public websites, product pages, and pricing pages where published
  • Vendor press releases, SEC filings (where applicable), and annual disclosures
  • Government-procurement disclosures and RFP responses where published list pricing is unavailable
  • Independent analyst-firm reports for class-level pricing norms (e.g., Forrester Wave, Gartner Magic Quadrant write-ups, IDC)
  • The Stanford RegLab study on legal-AI hallucination (Magesh, Surani, Dahl, Suzgun, Manning, Ho 2024) for the AI-first legal research class hallucination claim
  • archive.org snapshots of vendor pages where current pages have changed since retrieval

What we claim — and what we don't

  • We claim: deployment architecture (cloud vs. on-premise), where data resides, where the LLM runs, regulatory-corpus posture, citation model, hallucination posture, gap-tracking model, audit-day output format, pricing model, pricing range, and post-contract data access
  • We do not claim: ease of use, support quality, customer-satisfaction scores, individual-vendor product quality, internal performance benchmarks, or any subjective characterization
  • Claims describe the class as a product category. Individual vendors within a class may differ on a specific dimension; named examples are representative, not exhaustive

Dating and currency

  • This page reflects vendor public materials as retrieved through 2026-04-28
  • Vendors update offerings; this page is reviewed at minimum quarterly. The most recent retrieval date is shown at the top of the matrix and below this section
  • If a named vendor materially changes architecture or pricing model after publication, we update or remove the affected row within the next quarterly review or sooner upon notice

Pricing range methodology

  • Where a vendor publishes list pricing, the lower bound reflects that published starting point
  • Where pricing is "Contact sales," ranges are derived from public RFP responses, government procurement disclosures, and analyst-reported norms for the class
  • Per-seat ranges assume mid-cohort seat counts (10–50 seats) for the relevant class; minimums and enterprise floors apply
  • Crucible's own pricing reflects WalkerNash's free engine + declining-ramp Sage subscription

Three architectures. One choice that matters.

Compliance data is the most sensitive data a regulated facility holds. Where the platform processes it determines everything downstream — audit surface, breach blast radius, vendor lock-in, what happens when the contract ends.

Architecture A

Cloud-hosted SaaS

FACILITY Officer PC Sensitive data PHI / PII answers VENDOR CLOUD Multi-tenant DB LLM API Third-party AI

Queries leave the facility. Data sits in the vendor's cloud alongside other tenants. The LLM runs on third-party infra. Breach blast radius = vendor's entire customer base.

Architecture B

Microsoft 365-native

FACILITY Teams / Outlook Officer PC tenant data M365 TENANT SharePoint / Purview Entra / Defender Workflow layer Copilot (cloud)

Pretty, compliance-shaped, but architecturally it's SharePoint-with-rules. Non-Microsoft shops are locked out. Data still crosses the facility boundary into a cloud tenant.

Architecture C — Crucible

On-premise, air-gap capable

FACILITY LAN — ZERO WAN EGRESS Officer PC CRUCIBLE SERVER Local AI engine bespoke compliance database Facility docs PHI / PII never leaves LAN FIREWALL DROP all WAN allow LAN only Walker Nash database updates pulled by officer

Queries, documents, and LLM inference all stay on the Crucible server. WalkerNash never initiates contact. Regulatory updates are pulled by the compliance officer's PC and sidelined in via LAN. Breach blast radius = your facility alone.

Which class of tool should you actually pick?

Crucible is not right for every compliance team. Here's where each class wins, including where we don't.

Pick A

Single-practitioner tool

A dental office, small MSP, or solo clinic with < $10K/yr compliance budget and a policy binder plus annual HIPAA training as the baseline need. Don't over-invest until your regulatory surface grows.

Pick B

Mid-market GRC platform

A financial-services CCO or mid-size network that needs employee code-of-ethics attestation at scale, policy workflow automation, and vendor ecosystem integrations — and accepts cloud as the architecture.

Pick C

AI-first legal research

You're an AmLaw firm or in-house legal team doing case-law summarization and contract analysis. The research hour is your unit of value. Compliance workflow isn't the use case.

Pick D

Enterprise GRC suite

A Fortune-1000 bank with a dedicated CRO, a risk team, and a SOX / ORM / obligations-management stack budget in six figures. The cloud dashboard is what your board expects. Crucible isn't trying to replace this.

Own it

Accreditor manual

You need it anyway. It's the scoring document. Buy it direct from the accreditor. Crucible cites accreditor standards by reference — we don't resell the manual.

Pick Crucible

Regulated facility that can't push PHI / PII to a cloud tenant

Behavioral health, corrections, DEA-regulated pharmacy, municipal operations, multi-agency surface with no single accreditor. You need cited rule text, element-level gap tracking, and printable audit packets — and your data must stay on your LAN. One flat rate, no seat tax, hardware you own.

One install. One flat rate. Your data, your building.

The compliance-tech category is seat-licensed cloud SaaS with regulatory content pass-through. Crucible is the opposite on every axis — flat-rate, on-premise, per-client corpus, deterministic citation. If your facility can accept cloud, you have good options. If it can't, you have one.

See the product tour Download free engine →