Who did what, where, for how much
Not just a conflict list. The evidence behind it.
Most access tools stop at “this person could do both”. ControlOS shows whether they did, where, and how many dollars went through.
Sample data for a fictional company (Demo Co). Names, vendor and amounts are illustrative.
The key message
Read-only. We never change a thing.
Exactly what ControlOS does, and does not do, in your NetSuite account.
CONTROLOS DOES
- ✓Read users, roles, role permissions and role assignments
- ✓Read the transactions behind a risk, to show the dollars involved
- ✓Run every check on our side and show you the result, including what we could not check
- ✓Tell you what to change, why, and who should own it
CONTROLOS NEVER
- ✕Write, change or delete anything in NetSuite
- ✕Build, edit or assign security roles
- ✕Block, grant or remove anyone’s access
- ✕Store your NetSuite password (tokens are encrypted, and you can revoke them at any time)
What you get
Built for the controller, readable by the auditor
Who did what, where, for how much
Every access risk comes with the evidence: the person, the records, the dates and the dollars. You fix the $48,200 problem first.
Collusion detection
Some conflicts need two people: one changes the vendor, the other pays it. ControlOS finds the pairs, not just the individuals.
Access, controls and KRIs in one place
Segregation of duties and critical access, 56 continuous control-monitoring checks, and key risk indicators, on one screen.
Honest UNKNOWN
If we could not run a check, it says UNKNOWN and tells you why. A check we could not run is never shown as a pass.
Plain language, layer by layer
Risk explained from business impact down to the technical detail, in words a controller and an auditor both read the same way.
Works without API access
Prefer not to connect? Run the read-only Export Kit yourself and upload the files. Same results.
Read-only. We never change a thing.
We never write to NetSuite and never build roles. Your team stays in control of every change.
Ask Mitigo
The in-app assistant answers questions about your own results: why a user is flagged, what to fix first, what it means for audit.
NetSuite and SAP, one vendor
If you also run SAP, MitigoSuite covers it too. One vendor, one way of explaining risk.
How it works
From sign-up to your first scan in an afternoon
Self-serve end to end, with a 5-business-day free trial. Mitigo, our assistant, is on hand at every step.
01
Tell us who you are
Business email, name, company and role. We check it against public company records so the trial goes to a real NetSuite team.
02
Accept the NDA and Software Agreement
Two click-to-accept documents, recorded with a timestamp. Nothing is downloaded or connected before this.
03
Get your data in
Connect read-only with a NetSuite token, or run the Export Kit yourself and upload the files. Your choice.
04
Run your scan
ControlOS maps who can do what, and who did what, by process, and flags conflicts, collusion and critical access.
05
Decide
5 business days, free, no card. To keep going, click Purchase on the Billing page: card or bank, and access continues straight away.
Connect read-only
Your NetSuite admin creates a read-only role, an integration record and an access token, then pastes five values into ControlOS. The app tests each read and shows a checklist, so a missing permission is named, not hidden.
- ✓Stays current: re-scan any time
- ✓Token encrypted on arrival; revoke it in NetSuite whenever you like
Run the Export Kit
Prefer not to grant any API access? Run a short export yourself and upload the files. If you use the kit’s script, you deploy it, it only runs read queries, and you remove it afterwards.
- ✓No connection to your NetSuite at all
- ✓You see every file before you upload it
The Export Kit and the Connection Guide are not public downloads. They appear inside the app after you sign up and accept the NDA and the Software Agreement.
Pricing
What mid-market NetSuite teams pay for access risk today
ControlOS pricing from $6,250/yr, set by company revenue. Every NetSuite user is covered.
| Option | Typical cost | What you get |
|---|---|---|
| Typical access-governance tool | ~$12k–$22k a year for typical deals, $30k–$80k for mid-size deployments¹, plus implementation, often $5k–$15k and up² | Per-user licensing and a rules library you configure and maintain |
| Big-4 or consultant SoD review | ~$25k–$75k per review (our estimate)³; consultant IT-controls reviews $15k–$35k⁴ | A point-in-time snapshot, based on samples, repeated every year |
| ControlOS for NetSuite | 0.025% of revenue in year 1: $25,000 at $100M, then $18,750/yr, or $15,000/yr on a 3-year contract | Every NetSuite user covered, who did what for how much, 56 control checks, read-only, self-serve setup |
| Founding client | $999 a year, locked while you stay subscribed | Everything above, plus a direct line to shape the product |
¹ Buyer-reported data for a leading ERP access-governance tool, Vendr, Feb 2026 (all ERPs and sizes). ² Reported implementation fees for NetSuite access tools, 2026. ³ Our estimate; Big-4 firms do not publish rates. ⁴ Published by a SOX consulting provider, 2026. Market figures are rechecked every six months.
WHY WE PRICE THIS WAY
Most access-risk tools are built and priced for companies with a dedicated SOX team and a six-figure budget, so mid-market NetSuite teams end up with spreadsheets and a once-a-year consultant review. We price by company size, not by user or seat, because your audit exposure grows with your business, and every NetSuite user should be covered, not just the ones you can afford to license. Founding pricing for our first clients: $999 a year for as long as they stay with us, in return for helping us shape the product. May close at any time.
STANDARD PRICING
From $6,250/yr, by company revenue
Year 1 is 0.025% of annual revenue. Renewals are 75% of year 1, or 60% of year 1 per year on a 3-year contract.
| Revenue | Year 1 | Renewal / yr | 3-year / yr |
|---|---|---|---|
| $25M | $6,250 | $4,688 | $3,750 |
| $50M | $12,500 | $9,375 | $7,500 |
| $100Mabout the median public NetSuite company | $25,000 | $18,750 | $15,000 |
Volume discounts: 15% from $125M revenue, 25% from $200M. Under $25M revenue, or more than one production account: talk to us. Prices in US$, taxes extra. The order form governs.
FOUNDING PRICING · FIRST CLIENTS
$999/yr
Locked for life. May close at any time.
Every standard ControlOS NetSuite feature, now and as it grows. Start with the free 5-business-day trial, then click Purchase in the app.
Start free trial“For life” means while you stay continuously subscribed; if the subscription lapses, standard pricing applies when you return. Covers one NetSuite production account (sandboxes included), subject to fair use (normal refresh cadence and API limits, no reselling). In return we ask for a short feedback call and permission to name you as a customer or publish an anonymised case study. Non-transferable. Places are confirmed at purchase; the order form governs.
The Manual
Everything the app does, explained
Every screen, what it shows and what to do next. The full Manual opens inside the app.
CHAPTER 1
Getting started
Your workspace, inviting your team, and the three access levels.
CHAPTER 2
Getting your data in
Connect read-only or use the Export Kit, and the permission checklist.
CHAPTER 3
Access Review
Risk map, SoD conflicts, collusion, critical and unused access, the report.
CHAPTER 4
Command Center
What the scores mean, and why a new workspace shows UNKNOWN.
CHAPTER 5
Controls, KRIs and CCM
The 56 checks and the risk indicators, and what each one tests.
CHAPTER 6
Ask Mitigo
What to ask, where its answers come from, and its limits.
CHAPTER 7
Reports and evidence
Exporting results for management and auditors.
CHAPTER 8
Settings and billing
Connection, team members, and Purchase.
Questions
Straight answers
Do you write anything to NetSuite?
No. Read-only. We never change a thing. We never write to NetSuite, never change a record, and never build or edit security roles. Remediation stays with your team; we tell you what to change and why.
What does my NetSuite admin need to do?
For Connect: create a read-only role, an integration record and an access token (about 30 minutes, step-by-step guide provided). For the Export Kit: run a short export and upload the files (about 15 minutes). If you use the kit’s script, you deploy it yourself, it only runs read queries, and you remove it when you are done.
Where do I get the Export Kit and the Connection Guide?
Inside the app. They are not public downloads: they unlock after you sign up and accept the NDA and the Software Agreement.
How long is the trial, and what happens after?
5 business days, free, no card needed. If you want to continue, click Purchase on the Billing page and pay by card or bank. If you do not, your workspace is locked and nothing is billed.
How is ControlOS priced?
By company size, not per user. Year 1 is 0.025% of annual revenue (from $6,250 a year). Renewals are 75% of year 1, or 60% of year 1 per year on a 3-year contract. At $100M revenue that is $25,000 in year 1, then $18,750 a year, or $15,000 a year on 3 years. Volume discounts: 15% from $125M revenue, 25% from $200M. With more than one production account, we quote on a call. Founding pricing for our first clients is $999 a year and may close at any time.
What does “locked for life” mean on the founding offer?
The $999 a year rate holds for as long as you stay continuously subscribed. If the subscription lapses, standard pricing applies when you return. It covers one NetSuite production account (sandboxes included), within fair use, and in return we ask for a short feedback call and permission to name you as a customer or publish an anonymised case study.
What is not included yet?
We will not claim what we do not have. Not available today: Preventive enforcement or user provisioning (we do not block or grant access in NetSuite); Access certification (user access review) campaigns; Multi-framework “test once, satisfy many” mapping; A SOC 2 report for MitigoSuite itself.
Why do you ask for an NDA and a Software Agreement?
Your access data is confidential, and so is our method. Both sides are protected before any data moves. You accept both online in about a minute.
Does this replace our auditors?
No. ControlOS helps you find access and SoD issues earlier and have cleaner audit conversations. Your team validates the results. It is not audit or legal advice.
Do you cover SAP as well?
Yes. MitigoSuite covers SAP ECC and S/4HANA too. SAP is not part of this self-serve trial or pricing; book a call and we will talk it through.
Something else? Ask Mitigo, bottom right, or email engel@mitigosuite.com.
See it on your own NetSuite data
5 business days, free, no card. Read-only. We never change a thing.