# Fiddler AI - **Type:** Software product - **Website:** https://www.fiddler.ai - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) US software from Fiddler AI that monitors and governs AI systems, aimed at financial services, healthcare, insurance and government buyers. It is software you run, not advice. ## Fiddler AI scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 1/5 fiddler.ai/security describes internal vulnerability management, penetration testing and an annually-tested Business Continuity & Disaster Recovery programme, but nothing is published about supporting clients through an ICO/AI Act-style regulatory engagement or disclosing incident outcomes with named practitioners. ### Qualifications of the people who do the work: 3/5 Fiddler discloses an annual SOC 2 Type II audit (security, confidentiality, availability) and states HIPAA compliance on fiddler.ai/security, but the SOC 2 report itself is gated behind an NDA request with no auditor named or validity dates published, and no ISO 27001 or ISO 42001 certification is disclosed anywhere on the site. ### What it publishes about fees: 4/5 fiddler.ai/pricing publishes a Free tier and a concrete per-unit Developer price ($0.002/trace), a rare level of disclosure in this category, though the flagship Enterprise tier remains 'Contact sales' with no published exclusions. ### Knowledge of your sector: 4/5 fiddler.ai names four distinct, tailored sector solution pages (Government/defense, Financial Services, Healthcare, Insurance) each with sector-specific copy, plus named/quantified case studies (Nielsen; a 'leading financial services institution'; a 'leading healthcare payer' with >10x TCO improvement). ### Independence from what it sells: 2/5 Only the SOC 2 Type II is a genuine independent audit, and even that report is unpublished (NDA-gated, auditor unnamed); the HIPAA 'compliance' claim is self-declared (no accreditation body certifies HIPAA compliance), and no independently accredited ISO 27001/42001 certification backs Fiddler's own security or AI-governance marketing claims. ### Who carries the risk if the advice is wrong: 1/5 fiddler.ai/terms-of-use provides the Services 'AS IS', disclaims all implied warranties and excludes consequential damages, but discloses no professional-indemnity insurance, no numeric liability cap, and no public SLA or uptime commitment. ## Sources for Fiddler AI Every line carries the page it was read on and the date it was checked. - Fiddler's registered legal entity is Fiddler Labs, Inc., a Delaware corporation, SEC EDGAR CIK 0001791224, with Form D filings in 2019, 2021, 2024 and 2026 and a business/mailing address of 291 Lambert Avenue, Palo Alto, CA 94306. - Source: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001791224&type=D&dateb=&owner=include&count=40&output=atom - Checked: 2026-09-20 - Fiddler's current published headquarters contact address is in Palo Alto, California, confirming a genuine US headquarters. - Source: https://www.fiddler.ai/privacy-policy - Checked: 2026-09-20 - Fiddler states its SOC 2 Type II report covers the security, confidentiality and availability trust-services categories and is audited annually, available on request under NDA to existing customers and prospects. - Source: https://www.fiddler.ai/security - Checked: 2026-09-20 - Fiddler states it is compliant with the US Health Insurance Portability and Accountability Act (HIPAA) for handling Protected Health Information. - Source: https://www.fiddler.ai/security - Checked: 2026-09-20 - Fiddler's pricing page publishes a Free tier and a Developer tier priced at $0.002 per trace; the Enterprise tier is priced only via 'Contact sales'. - Source: https://www.fiddler.ai/pricing - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Published ## Strengths - Publishes a real per-unit price ($0.002 per trace) for its Developer tier plus a Free tier, unusually concrete for this software category, where most vendors show only 'Contact sales'. - Undergoes an annual, independently audited SOC 2 Type II covering security, confidentiality and availability, rather than relying solely on self-declared marketing language. - Names distinct, tailored solution pages and case studies across four regulated sectors, Government/defense, Financial Services, Healthcare and Insurance, including a named customer (Nielsen) and a quantified healthcare-payer outcome ('>10x TCO improvement'). - Publishes a dedicated 'AI Governance, Risk Management, and Compliance' product line and states responsible-AI principles (transparency, bias/toxicity detection, accountability) on its About page. ## Things to check Each one carries the factual basis it rests on. - Fiddler's SOC 2 Type II report is not published; it is disclosed only as available 'upon request' to existing customers and prospects under a signed NDA, so an outside buyer cannot check the auditor's name, report date or scope before engaging commercially. - Basis: fiddler.ai/security: 'The report is available, upon request, for review by existing customers and new prospects... we require a signed NDA to review the report.' - No ISO 27001 or ISO/IEC 42001 (AI management system) certification is disclosed anywhere on Fiddler's public security or trust pages, despite Fiddler selling an AI-governance-and-compliance product to regulated buyers who typically expect that accreditation. - Basis: fiddler.ai/security 'Compliance' section names only SOC 2 Type II and HIPAA; no ISO standard is mentioned, and the linked trust-center.fiddler.ai (a Vanta-hosted page) renders no compliance-framework content without JavaScript. - Fiddler's own marketing states that its evaluation features send trace data to external third-party LLM providers, billed directly by that provider, a data-flow detail buyers must scrutinise separately from Fiddler's stated data-security controls. - Basis: fiddler.ai/pricing / homepage TCO-calculator copy: 'Every trace requires an external API call charged directly by your LLM provider.' - The public Terms of Use disclaim all warranties on an 'AS IS' basis and exclude consequential damages, but publish no professional-indemnity insurance, no numeric liability cap and no SLA/uptime commitment anywhere on the site. - Basis: fiddler.ai/terms-of-use, 'LIMITATION OF LIABILITY' and 'As Is' clauses; no SLA or 'service level' text found on the public site. ## Where this firm appears - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Which data protection, AI governance and cyber security providers publish a price?](https://theassurancedesk.com/lists/providers-that-publish-a-price) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.