Grammarly

The product is installed rather than logged into. A browser extension, desktop app and mobile keyboard put suggestions directly into whatever text field is in front of you, and the vendor says the extension works in 1 million+ apps and programs, naming Gmail, Google Docs, Salesforce, Zendesk, Jira and LinkedIn. That shape matters for evaluation: there is no integrations catalogue to check, because nothing is integrated. Grammarly reads and writes in the page, which is also why the desktop page advertises a control to turn it off in any app or program.

The writing work splits into two halves. The checker half fixes grammar, spelling and punctuation, shows tone and rewrites sentences. The agent half is newer: an AI Detector, a Humanizer, a Citation Finder, Reader Reactions and an AI Grader. Grammarly describes these as agents that are aware of your context and can take action for you, while the same paragraph says they work alongside you to provide feedback and find sources. A buyer should read the second half of that sentence: the output is suggestions and predictions that a person applies.

Three tiers. Free is a standing plan, not a trial, and covers mistake correction, tone detection and 100 AI prompts a month. Pro is €12 (about $13) per member per month billed annually, €30 (about $34) when billed monthly, with the annual saving advertised on the billing control as "Save up to 60%". Enterprise publishes no figure.

The second meter is the one to watch. Prompts are capped at 100 a month on Free, 2,000 per member per month on Pro and unlimited only on Enterprise, and the terms state that extra generative AI capacity bought mid-term is tied to that subscription and is not refunded when it expires. Several Pro limits are numeric rather than feature flags: one style guide, one brand tone, two user groups. Payment is by major credit card or PayPal, and an invoice can be requested for ten or more members on an annual plan.

The cancellation terms are plain and worth reading before committing a year. You may cancel at any time and keep access to the end of the billing cycle, after which the account converts to Free, but Section 8.10 of the terms says all payments are non-refundable and no credit is given for partially used periods.

The plan comparison table is unusually explicit about where administration lives. SAML single sign-on, SCIM, managed mode, invite and domain capture, custom roles, application and domain controls, confidential mode, data loss prevention, session timeout and the Audit Logs API are all marked unavailable on Free and on Pro, and checked only for Enterprise. Pro gets the Feature Management Hub, account roles and permissions, priority support and team analytics.

That is a clean line for an IT buyer: identity and logging are Enterprise, and Enterprise has no published price. The Enterprise tier is also now described as delivered through Superhuman Go, the proactive assistant from the same company, which changes what is actually being bought at that level.

There is a genuine REST API at api.grammarly.com with OAuth 2.0, and the developer documentation covers a Writing Score API, an AI Detection API, a Plagiarism Detection API, an Analytics API and a License Management API, each with its own scope such as scores-api:read. The Writing Score guide is specific where marketing pages usually are not: a 4 MB file limit, 100,000 characters, a 30 word minimum, 10 POST requests per second, scores retrievable for 30 days, and uploaded documents retained no longer than 24 hours.

Two caveats. Credentials are restricted to admins with Grammarly Enterprise and Grammarly for Education institution-wide licenses, so no individual or Pro customer can call it. And the vendor's own APIs page labels every available endpoint Beta, with Certified Readability Score and Tone Analysis listed as Coming Soon. No MCP server appears anywhere in that documentation.

The compliance page names SOC 2 Type 2, SOC 3, ISO 27001, ISO 27017, ISO 27018, ISO 27701 and ISO 42001, and publishes the ISO certificates; the SOC 2 report itself is available only on request through sales. GDPR compliance is claimed outright, and HIPAA compliance is claimed with the condition that no protected health information be processed without a signed Business Associate Agreement.

Data residency is settled and single: storage is on Amazon Web Services in US-based data centers, with no region choice offered. On model training, the privacy policy says user content may be used to train the vendor's AI models and that an account setting controls it, while the home page states that third-party providers are not allowed to train on user content. Those are consistent but not identical claims, and the difference is between first-party and third-party training. No uptime commitment or service level agreement is published anywhere on the plans, enterprise, security or terms pages.

It fits a team that writes constantly in other people's software and wants one consistent voice across all of it, especially where a shared style guide and brand tone are worth paying for. It fits an organisation that has to answer a vendor security questionnaire, because the certification list is long and the certificates are downloadable.

It does not fit a buyer who wants programmatic access without an Enterprise contract, because API credentials are gated to that tier and every endpoint is still in beta. It does not fit anyone needing data held outside the United States, or needing a contractual uptime number. And a heavy generative user on Pro should count prompts before committing: 2,000 a month per member is a real ceiling, and the extra capacity sold on top is non-refundable.