We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Fiddler AI review

Software product

US software from Fiddler AI that monitors and governs AI systems, aimed at financial services, healthcare, insurance and government buyers. It is software you run, not advice.

Relevant if you want AI governance software with a free tier and a published per-trace price

Price Published
Indemnity cover Not published
How it uses AI Published
Facts last checked

Not published means we did not find it on the firm's own pages.

Fiddler AI scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 1/5
Qualifications of the people who do the work 3/5
What it publishes about fees 4/5
Knowledge of your sector 4/5
Independence from what it sells 2/5
Who carries the risk if the advice is wrong 1/5

What Fiddler AI offers, and what it publishes

Fiddler AI publishes its entry prices. There is a free tier and a developer tier at $0.002 per trace; the enterprise tier is priced only through sales. The platform monitors AI systems, and a separate product covers AI governance, risk and compliance. It has pages for four sectors: government and defence, financial services, healthcare and insurance.

Fiddler AI does not publish its SOC 2 Type II report, from its yearly security audit. The firm says existing and prospective customers can read it after signing a non-disclosure agreement; it names no auditor and gives no report date. It shows no ISO 27001 or ISO 42001 certificate, no liability cap figure and no uptime promise.

The firm says its evaluation features send trace data to outside AI model providers, which bill you directly. Ask where that data goes before you sign. Its terms supply the service 'as is'. The firm also says it complies with HIPAA, the US health privacy law; no outside body certifies that.

Strengths

  • Publishes a real per-unit price ($0.002 per trace) for its Developer tier plus a Free tier, unusually concrete for this software category, where most vendors show only 'Contact sales'.
  • Undergoes an annual, independently audited SOC 2 Type II covering security, confidentiality and availability, rather than relying solely on self-declared marketing language.
  • Names distinct, tailored solution pages and case studies across four regulated sectors, Government/defense, Financial Services, Healthcare and Insurance, including a named customer (Nielsen) and a quantified healthcare-payer outcome ('>10x TCO improvement').
  • Publishes a dedicated 'AI Governance, Risk Management, and Compliance' product line and states responsible-AI principles (transparency, bias/toxicity detection, accountability) on its About page.

Things to check

  • Fiddler's SOC 2 Type II report is not published; it is disclosed only as available 'upon request' to existing customers and prospects under a signed NDA, so an outside buyer cannot check the auditor's name, report date or scope before engaging commercially.
  • No ISO 27001 or ISO/IEC 42001 (AI management system) certification is disclosed anywhere on Fiddler's public security or trust pages, despite Fiddler selling an AI-governance-and-compliance product to regulated buyers who typically expect that accreditation.
  • Fiddler's own marketing states that its evaluation features send trace data to external third-party LLM providers, billed directly by that provider, a data-flow detail buyers must scrutinise separately from Fiddler's stated data-security controls.
  • The public Terms of Use disclaim all warranties on an 'AS IS' basis and exclude consequential damages, but publish no professional-indemnity insurance, no numeric liability cap and no SLA/uptime commitment anywhere on the site.

Common questions

Does Fiddler publish its prices?

Partly. There is a free tier and a developer tier at $0.002 per trace. The enterprise tier is priced only through sales.

Can I read Fiddler's SOC 2 report before I buy?

Yes, but only after signing a non-disclosure agreement. The firm says existing and prospective customers can ask to read it. It names no auditor and gives no report date.

Does Fiddler hold ISO 27001 or ISO 42001?

Neither is shown. Its security page names only SOC 2 Type II and HIPAA.

Where does my data go when Fiddler evaluates an AI system?

To an outside AI model provider. The firm says every trace needs an external call to your AI model provider, which charges you directly.

Evidence for each Fiddler AI score

Show our working

Notes behind each thing to check

  • Fiddler's SOC 2 Type II report is not published; it is disclosed only as available 'upon request' to existing customers and prospects under a signed NDA, so an outside buyer cannot check the auditor's name, report date or scope before engaging commercially. (fiddler.ai/security: 'The report is available, upon request, for review by existing customers and new prospects... we require a signed NDA to review the report.')
  • No ISO 27001 or ISO/IEC 42001 (AI management system) certification is disclosed anywhere on Fiddler's public security or trust pages, despite Fiddler selling an AI-governance-and-compliance product to regulated buyers who typically expect that accreditation. (fiddler.ai/security 'Compliance' section names only SOC 2 Type II and HIPAA; no ISO standard is mentioned, and the linked trust-center.fiddler.ai (a Vanta-hosted page) renders no compliance-framework content without JavaScript.)
  • Fiddler's own marketing states that its evaluation features send trace data to external third-party LLM providers, billed directly by that provider, a data-flow detail buyers must scrutinise separately from Fiddler's stated data-security controls. (fiddler.ai/pricing / homepage TCO-calculator copy: 'Every trace requires an external API call charged directly by your LLM provider.')
  • The public Terms of Use disclaim all warranties on an 'AS IS' basis and exclude consequential damages, but publish no professional-indemnity insurance, no numeric liability cap and no SLA/uptime commitment anywhere on the site. (fiddler.ai/terms-of-use, 'LIMITATION OF LIABILITY' and 'As Is' clauses; no SLA or 'service level' text found on the public site.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 1/5 fiddler.ai/security describes internal vulnerability management, penetration testing and an annually-tested Business Continuity & Disaster Recovery programme, but nothing is published about supporting clients through an ICO/AI Act-style regulatory engagement or disclosing incident outcomes with named practitioners.
Qualifications of the people who do the work 3/5 Fiddler discloses an annual SOC 2 Type II audit (security, confidentiality, availability) and states HIPAA compliance on fiddler.ai/security, but the SOC 2 report itself is gated behind an NDA request with no auditor named or validity dates published, and no ISO 27001 or ISO 42001 certification is disclosed anywhere on the site.
What it publishes about fees 4/5 fiddler.ai/pricing publishes a Free tier and a concrete per-unit Developer price ($0.002/trace), a rare level of disclosure in this category, though the flagship Enterprise tier remains 'Contact sales' with no published exclusions.
Knowledge of your sector 4/5 fiddler.ai names four distinct, tailored sector solution pages (Government/defense, Financial Services, Healthcare, Insurance) each with sector-specific copy, plus named/quantified case studies (Nielsen; a 'leading financial services institution'; a 'leading healthcare payer' with >10x TCO improvement).
Independence from what it sells 2/5 Only the SOC 2 Type II is a genuine independent audit, and even that report is unpublished (NDA-gated, auditor unnamed); the HIPAA 'compliance' claim is self-declared (no accreditation body certifies HIPAA compliance), and no independently accredited ISO 27001/42001 certification backs Fiddler's own security or AI-governance marketing claims.
Who carries the risk if the advice is wrong 1/5 fiddler.ai/terms-of-use provides the Services 'AS IS', disclaims all implied warranties and excludes consequential damages, but discloses no professional-indemnity insurance, no numeric liability cap, and no public SLA or uptime commitment.

Sources for Fiddler AI

  • Fiddler's registered legal entity is Fiddler Labs, Inc., a Delaware corporation, SEC EDGAR CIK 0001791224, with Form D filings in 2019, 2021, 2024 and 2026 and a business/mailing address of 291 Lambert Avenue, Palo Alto, CA 94306. (Fiddler Labs, Inc.; DE; CIK 0001791224; Palo Alto, CA) (sec.gov, checked 20 September 2026)
  • Fiddler's current published headquarters contact address is in Palo Alto, California, confirming a genuine US headquarters. (550 California Ave, Suite 200, Palo Alto, CA 94306-1441) (fiddler.ai, checked 20 September 2026)
  • Fiddler states its SOC 2 Type II report covers the security, confidentiality and availability trust-services categories and is audited annually, available on request under NDA to existing customers and prospects. (SOC 2 Type II (annual), security/confidentiality/availability) (fiddler.ai, checked 20 September 2026)
  • Fiddler states it is compliant with the US Health Insurance Portability and Accountability Act (HIPAA) for handling Protected Health Information. (HIPAA compliance claimed) (fiddler.ai, checked 20 September 2026)
  • Fiddler's pricing page publishes a Free tier and a Developer tier priced at $0.002 per trace; the Enterprise tier is priced only via 'Contact sales'. (Free; $0.002/trace (Developer); Enterprise = contact sales) (fiddler.ai, checked 20 September 2026)

SOC 2 Type II audit completed annually, covering security, confidentiality and availability trust-services categories, but the report itself is disclosed only on request to existing customers and prospects under a signed NDA, with no auditor named and no report date published (fiddler.ai/security, checked 2026-09-20).

Regulated sectorsExposed to the EU AI Act

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.