We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Monitaur review

Software product

US software that insurers, financial and healthcare firms license to run AI governance, mapping evidence to the US NIST AI RMF, ISO/IEC 42001 and the EU AI Act.

Relevant if you are an insurer or financial firm wanting software to track AI model controls and evidence

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Monitaur scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 4/5
Qualifications of the people who do the work 3/5
What it publishes about fees 1/5
Knowledge of your sector 5/5
Independence from what it sells 2/5
Who carries the risk if the advice is wrong 1/5

What Monitaur offers, and what it publishes

Monitaur is software you license, not an advisory firm. Its Define, Manage and Automate modules let you design, track and monitor AI governance controls, mapped to its 'Common Controls' library. It has modules for insurance, financial services and healthcare. It names customers including Progressive Insurance, Unum and CAPE Analytics, and quotes CAPE saying the library 'saved months' of work.

Ask Monitaur for a written quote. We did not find prices on its homepage. We found no terms of service, service level agreement, liability cap or indemnity on its public site. It does not say whether it uses AI on customer data.

Monitaur says it has kept SOC 2 Type II compliance since October 2021, but names no auditor and links to no Monitaur report, so we could not check it. Its privacy policy says customer data is processed in the United States and may go to unnamed subcontractors. Its site names only its two co-founders, and no security lead.

Strengths

  • Deep, named vertical specialism in insurance and financial services, dedicated modules covering underwriting, claims and "model filings, market conduct, NAIC, ORSA, ASOP, DOIs," backed by named enterprise customers (Progressive Insurance, Unum, NiCE, Verisk, CAPE Analytics) with quantified outcomes.
  • Sustained, specific security claim: SOC 2 Type II maintained continuously since October 2021 (not a one-line assertion), plus documented practices, per-customer isolated infrastructure, encryption at rest/in transit via HSM-managed keys, and annual third-party penetration testing.
  • Product evidence-automation is mapped to named external frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act) via a documented "Common Controls" library, with a specific claim of automating evidence for close to 40% of required governance controls.
  • Confirmed as a genuine, ongoing US legal entity, Delaware-incorporated, SEC-registered with a multi-year Form D filing history (2023 and 2024), not a shell or unverifiable name.

Things to check

  • Monitaur's own compliance claim about its product, "SOC2 Type 2 compliance since October 2021", names no auditor, no certificate reference and no linked report; the only supporting link on the homepage points to AICPA's generic public explainer page about SOC reports, not a Monitaur-specific attestation, so the claim cannot be independently verified from public sources.
  • Ask for a written quote before comparing costs. We did not find prices on its homepage.
  • No Terms of Service, SLA, uptime guarantee, liability cap or indemnification clause is discoverable anywhere on the public site, worse than peers like Vanta (public SLA) or Trustible/Credo AI (published boilerplate liability caps).
  • No Chief Information Security Officer or dedicated security lead is named anywhere on the site; only the CEO and CTO co-founders are named company-wide, with no degrees, prior employers or other credentials disclosed for either.

Common questions

Does Monitaur publish its pricing?

We did not find prices on its homepage. Ask for a written quote for the users, services and support you need.

Can I check Monitaur's SOC 2 Type II claim?

Not from its website. Monitaur says it has kept SOC 2 Type II compliance since October 2021, but names no auditor or certificate number. Its only supporting link goes to a general AICPA page about SOC reports.

Who leads security at Monitaur?

It does not say. Its company page names only its co-founders, chief executive Anthony Habayeb and chief technology officer Andrew Clark, with no security lead and no credentials for either.

Where is customer data processed?

In the United States. Monitaur's privacy policy says customer information is transferred to and processed there, and that it may subcontract processing to other, unnamed third parties.

Evidence for each Monitaur score

Show our working

Notes behind each thing to check

  • Monitaur's own compliance claim about its product, "SOC2 Type 2 compliance since October 2021", names no auditor, no certificate reference and no linked report; the only supporting link on the homepage points to AICPA's generic public explainer page about SOC reports, not a Monitaur-specific attestation, so the claim cannot be independently verified from public sources. (monitaur.ai/security page text ("Monitaur has maintained SOC2 Type 2 compliance since October 2021") and homepage link href="http://www.aicpa.org/soc4so", checked directly.)
  • Ask for a written quote before comparing costs. We did not find prices on its homepage. (No prices were found on the Monitaur homepage when read 2026-10-13. This is not proof that no pricing page exists elsewhere.)
  • No Terms of Service, SLA, uptime guarantee, liability cap or indemnification clause is discoverable anywhere on the public site, worse than peers like Vanta (public SLA) or Trustible/Credo AI (published boilerplate liability caps). (Direct fetch of https://www.monitaur.ai/terms, /terms-of-service and /legal all returned HTTP 404; a full-text search of monitaur.ai/sitemap.xml for "term", "legal", "sla" and "dpa" returned no matching page.)
  • No Chief Information Security Officer or dedicated security lead is named anywhere on the site; only the CEO and CTO co-founders are named company-wide, with no degrees, prior employers or other credentials disclosed for either. (monitaur.ai/company page names only "Anthony Habayeb, Co-founder & CEO" and "Andrew Clark, Co-founder & CTO", with no security-lead title and no credential detail for either.)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 4/5 The platform's "Automate Record" and evidence-automation features create documentation "automatically mapped to our Common Controls, satisfying requirements for frameworks like NIST AI RMF, ISO 42001, and the EU AI Act," with a stated claim of automating evidence for close to 40% of required governance controls, a concrete, specific claim, though not independently audited and with no disclosed case of actual regulator enforcement or ICO/DOI-equivalent engagement. Source: monitaur.ai/platform.
Qualifications of the people who do the work 3/5 Monitaur discloses a sustained, specific SOC 2 Type II claim (since October 2021) and a documented security programme (NIST CSF v1.1, OWASP ASVS, annual third-party penetration testing), but names no CISO or security lead, holds no ISO 27001 or ISO 42001 certification of its own, and names no auditor for its SOC 2 claim. Source: monitaur.ai/security, monitaur.ai/company.
What it publishes about fees 1/5 No pricing page exists anywhere on the site, /pricing and /product both return HTTP 404, and no pricing link appears in the site's navigation; every product route leads only to a demo/contact form. Source: direct fetch of monitaur.ai/pricing, /product; homepage nav/footer text.
Knowledge of your sector 5/5 Dedicated, named vertical modules for insurance (underwriting, claims, "model filings, market conduct, NAIC, ORSA, ASOP, DOIs"), financial services (lending, credit scoring, KYC/AML, fraud detection) and healthcare (SaMD, remote patient monitoring), backed by named enterprise customers with quantified outcomes (Progressive Insurance, Unum, NiCE, CAPE Analytics, "control library saved months"). Source: monitaur.ai/solutions, monitaur.ai/customers.
Independence from what it sells 2/5 Monitaur's compliance claim about its own product (SOC 2 Type II) is stated in prose with no auditor named, no certificate number and no linked report; the only supporting link found (on the homepage) points to AICPA's generic public page explaining what a SOC report is, not to a Monitaur-specific attestation, a self-declared claim rather than an independently verifiable one. Source: monitaur.ai/security; homepage href to aicpa.org/soc4so.
Who carries the risk if the advice is wrong 1/5 No Terms of Service, SLA, uptime guarantee, liability cap or indemnification clause could be found anywhere on the public site: /terms, /terms-of-service and /legal all return HTTP 404, and a full-text search of the site's sitemap.xml for "term", "legal", "sla" and "dpa" found no matching page. Source: direct fetch of monitaur.ai/terms(-of-service)/legal; monitaur.ai/sitemap.xml.

Sources for Monitaur

  • SEC EDGAR confirms the legal entity as Monitaur, Inc., CIK 0001851845, incorporated in Delaware, with its listed business address at 19 Plantation Drive, Duxbury, MA 02332 (phone 614-746-3540); two Form D notices of exempt securities offerings are on file, dated 2023-01-05 and 2024-05-13. (Monitaur, Inc., CIK 0001851845, Delaware corporation, business address Duxbury, MA, genuinely US-headquartered/incorporated) (sec.gov, checked 20 September 2026)
  • Monitaur's security page states it has maintained SOC 2 Type II compliance since October 2021, with security policies based on NIST Cybersecurity Framework v1.1 and OWASP ASVS, plus annual third-party penetration testing, but no auditor, certificate number or linked report is given. (SOC 2 Type II claimed since October 2021 (self-declared, auditor not named)) (monitaur.ai, checked 20 September 2026)
  • Monitaur's privacy policy states customer information "is transferred to and processed in the United States," and that Monitaur may subcontract data processing to further unnamed third parties, without disclosing whether AI/ML is used to process that data. (Data processed in the United States; no AI/ML-use disclosure found) (monitaur.ai, checked 20 September 2026)
  • Monitaur's customers page names Progressive Insurance, Unum, NiCE, Verisk (Discovery Navigator team), Nayya and CAPE Analytics as customers, with CAPE Analytics quoted as saying its control library "saved months" of work. (Named enterprise customers with quantified case-study outcomes) (monitaur.ai, checked 20 September 2026)
  • No pricing page exists on monitaur.ai (https://www.monitaur.ai/pricing and /product both return HTTP 404), no pricing link appears in the site's main or footer navigation, and no Terms of Service/legal/SLA page appears anywhere in the site's sitemap.xml. (No published pricing and no discoverable public Terms of Service/SLA) (monitaur.ai, checked 20 September 2026)

SOC 2 Type II (self-declared since October 2021; no auditor or certificate named)

Seeking ISO 42001 certificationExposed to the EU AI ActRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.