# Credo AI - **Type:** Software product - **Website:** https://www.credo.ai - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) US AI governance software that large organisations license and run themselves, to register, assess and monitor AI systems against rules such as the EU AI Act. ## Credo AI scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 4/5 Product pages describe 'automated evidence generation and audit trails' as part of its Compliance & Policy Engine mapped to named frameworks, though no sample export or regulator-facing report was shown. ### Qualifications of the people who do the work: 4/5 Publishes a dedicated SOC 2 Type II page and Trust Center listing multiple compliance claims, and names founder/CEO Navrina Singh, though no dedicated CISO or security lead is named. ### What it publishes about fees: 1/5 No pricing page or figures exist anywhere on the public site; only a demo request form is offered. ### Knowledge of your sector: 4/5 Publishes a detailed named case study on financial-services AI governance at Mastercard and lists sector-relevant frameworks such as Colorado SB21-169 insurance law, evidencing real sector-specific deployment. ### Independence from what it sells: 3/5 The SOC 2 Type II report is a genuine independent examination, but several other Trust Center claims (ISO 27001, FedRAMP, PCI, HIPAA 'compliant') are asserted without linked certificates or audit references. ### Who carries the risk if the advice is wrong: 3/5 Public Terms & Conditions state a specific liability cap of US $50 with named carve-outs, a published if very low figure, though it likely applies to the marketing site rather than the enterprise SaaS contract. ## Sources for Credo AI Every line carries the page it was read on and the date it was checked. - Company registration - Source: https://www.credo.ai/company - Checked: 2026-07-17 - Product scope - Source: https://www.credo.ai/product - Checked: 2026-07-17 - Pricing disclosure - Source: https://www.credo.ai/ - Checked: 2026-07-17 - Security certification - Source: https://www.credo.ai/legal/soc-2-type-ii-compliance - Checked: 2026-07-17 - Named case study - Source: https://www.credo.ai/casestudies/mastercard - Checked: 2026-07-17 - Liability terms - Source: https://www.credo.ai/legal/terms-conditions - Checked: 2026-07-17 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Published - Credentials: Published - Independent accreditation: Published - Client results: Published - How it uses AI: Not published ## Strengths - Publishes a dedicated SOC 2 Type II page describing an independent examination of the platform, rather than only a self-declared security statement - Named, detailed customer case study with a large regulated-sector client (Mastercard) describing specific product modules used (AI Registry, Vendor Registry) and stated outcomes - Explicit data-handling commitment published in its Terms of Use that customer data is not used to train or improve Credo AI's own machine learning models - Pre-built policy packs mapped to multiple named regulatory frameworks (EU AI Act, NIST AI RMF, ISO 42001, Colorado SB21-169, NYC Local Law 144) suggest broad regulatory coverage ## Things to check Each one carries the factual basis it rests on. - No public pricing page or indicative figures exist; access to any pricing information requires requesting a sales demo. - Basis: https://www.credo.ai/ offers only a 'Request demo' call-to-action; no dedicated pricing page was found on the site - Alongside its verifiable SOC 2 Type II report, the Trust Center lists broad 'compliant' claims (including 'FedRAMP Compliant') without evidence of a formal certificate or authorization number, a more informal and harder-to-verify standard than a named audit. - Basis: Third-party summaries of trust.credo.ai describe Credo AI as 'PCI Compliant, HIPAA Compliant, SOC 2 Compliant, GDPR Compliant, ISO 27001 Compliant, FedRAMP Compliant' without linking each claim to a specific certificate, https://trust.credo.ai/ - No UK Companies House registration, UK office, or UK government G-Cloud/Digital Marketplace listing was found for Credo AI, which may matter for UK public-sector buyers seeking a UK-contracting entity. - Basis: A search of find-and-update.company-information.service.gov.uk for 'Credo AI' returned no matching entity as of this research ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [How do you change your data protection provider?](https://theassurancedesk.com/best/switching-provider) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.