# Monitaur - **Type:** Software product - **Website:** https://www.monitaur.ai/ - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) US software that insurers, financial and healthcare firms license to run AI governance, mapping evidence to the US NIST AI RMF, ISO/IEC 42001 and the EU AI Act. ## Monitaur scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 4/5 The platform's "Automate Record" and evidence-automation features create documentation "automatically mapped to our Common Controls, satisfying requirements for frameworks like NIST AI RMF, ISO 42001, and the EU AI Act," with a stated claim of automating evidence for close to 40% of required governance controls, a concrete, specific claim, though not independently audited and with no disclosed case of actual regulator enforcement or ICO/DOI-equivalent engagement. Source: monitaur.ai/platform. ### Qualifications of the people who do the work: 3/5 Monitaur discloses a sustained, specific SOC 2 Type II claim (since October 2021) and a documented security programme (NIST CSF v1.1, OWASP ASVS, annual third-party penetration testing), but names no CISO or security lead, holds no ISO 27001 or ISO 42001 certification of its own, and names no auditor for its SOC 2 claim. Source: monitaur.ai/security, monitaur.ai/company. ### What it publishes about fees: 1/5 No pricing page exists anywhere on the site, /pricing and /product both return HTTP 404, and no pricing link appears in the site's navigation; every product route leads only to a demo/contact form. Source: direct fetch of monitaur.ai/pricing, /product; homepage nav/footer text. ### Knowledge of your sector: 5/5 Dedicated, named vertical modules for insurance (underwriting, claims, "model filings, market conduct, NAIC, ORSA, ASOP, DOIs"), financial services (lending, credit scoring, KYC/AML, fraud detection) and healthcare (SaMD, remote patient monitoring), backed by named enterprise customers with quantified outcomes (Progressive Insurance, Unum, NiCE, CAPE Analytics, "control library saved months"). Source: monitaur.ai/solutions, monitaur.ai/customers. ### Independence from what it sells: 2/5 Monitaur's compliance claim about its own product (SOC 2 Type II) is stated in prose with no auditor named, no certificate number and no linked report; the only supporting link found (on the homepage) points to AICPA's generic public page explaining what a SOC report is, not to a Monitaur-specific attestation, a self-declared claim rather than an independently verifiable one. Source: monitaur.ai/security; homepage href to aicpa.org/soc4so. ### Who carries the risk if the advice is wrong: 1/5 No Terms of Service, SLA, uptime guarantee, liability cap or indemnification clause could be found anywhere on the public site: /terms, /terms-of-service and /legal all return HTTP 404, and a full-text search of the site's sitemap.xml for "term", "legal", "sla" and "dpa" found no matching page. Source: direct fetch of monitaur.ai/terms(-of-service)/legal; monitaur.ai/sitemap.xml. ## Sources for Monitaur Every line carries the page it was read on and the date it was checked. - SEC EDGAR confirms the legal entity as Monitaur, Inc., CIK 0001851845, incorporated in Delaware, with its listed business address at 19 Plantation Drive, Duxbury, MA 02332 (phone 614-746-3540); two Form D notices of exempt securities offerings are on file, dated 2023-01-05 and 2024-05-13. - Source: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001851845&type=D&dateb=&owner=include&count=40 - Checked: 2026-09-20 - Monitaur's security page states it has maintained SOC 2 Type II compliance since October 2021, with security policies based on NIST Cybersecurity Framework v1.1 and OWASP ASVS, plus annual third-party penetration testing, but no auditor, certificate number or linked report is given. - Source: https://www.monitaur.ai/security - Checked: 2026-09-20 - Monitaur's privacy policy states customer information "is transferred to and processed in the United States," and that Monitaur may subcontract data processing to further unnamed third parties, without disclosing whether AI/ML is used to process that data. - Source: https://www.monitaur.ai/privacy-policy - Checked: 2026-09-20 - Monitaur's customers page names Progressive Insurance, Unum, NiCE, Verisk (Discovery Navigator team), Nayya and CAPE Analytics as customers, with CAPE Analytics quoted as saying its control library "saved months" of work. - Source: https://www.monitaur.ai/customers - Checked: 2026-09-20 - No pricing page exists on monitaur.ai (https://www.monitaur.ai/pricing and /product both return HTTP 404), no pricing link appears in the site's main or footer navigation, and no Terms of Service/legal/SLA page appears anywhere in the site's sitemap.xml. - Source: https://www.monitaur.ai/sitemap.xml - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Not published ## Strengths - Deep, named vertical specialism in insurance and financial services, dedicated modules covering underwriting, claims and "model filings, market conduct, NAIC, ORSA, ASOP, DOIs," backed by named enterprise customers (Progressive Insurance, Unum, NiCE, Verisk, CAPE Analytics) with quantified outcomes. - Sustained, specific security claim: SOC 2 Type II maintained continuously since October 2021 (not a one-line assertion), plus documented practices, per-customer isolated infrastructure, encryption at rest/in transit via HSM-managed keys, and annual third-party penetration testing. - Product evidence-automation is mapped to named external frameworks (NIST AI RMF, ISO/IEC 42001, EU AI Act) via a documented "Common Controls" library, with a specific claim of automating evidence for close to 40% of required governance controls. - Confirmed as a genuine, ongoing US legal entity, Delaware-incorporated, SEC-registered with a multi-year Form D filing history (2023 and 2024), not a shell or unverifiable name. ## Things to check Each one carries the factual basis it rests on. - Monitaur's own compliance claim about its product, "SOC2 Type 2 compliance since October 2021", names no auditor, no certificate reference and no linked report; the only supporting link on the homepage points to AICPA's generic public explainer page about SOC reports, not a Monitaur-specific attestation, so the claim cannot be independently verified from public sources. - Basis: monitaur.ai/security page text ("Monitaur has maintained SOC2 Type 2 compliance since October 2021") and homepage link href="http://www.aicpa.org/soc4so", checked directly. - Ask for a written quote before comparing costs. We did not find prices on its homepage. - Basis: No prices were found on the Monitaur homepage when read 2026-10-13. This is not proof that no pricing page exists elsewhere. - No Terms of Service, SLA, uptime guarantee, liability cap or indemnification clause is discoverable anywhere on the public site, worse than peers like Vanta (public SLA) or Trustible/Credo AI (published boilerplate liability caps). - Basis: Direct fetch of https://www.monitaur.ai/terms, /terms-of-service and /legal all returned HTTP 404; a full-text search of monitaur.ai/sitemap.xml for "term", "legal", "sla" and "dpa" returned no matching page. - No Chief Information Security Officer or dedicated security lead is named anywhere on the site; only the CEO and CTO co-founders are named company-wide, with no degrees, prior employers or other credentials disclosed for either. - Basis: monitaur.ai/company page names only "Anthony Habayeb, Co-founder & CEO" and "Andrew Clark, Co-founder & CTO", with no security-lead title and no credential detail for either. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Does the EU AI Act apply to a UK firm?](https://theassurancedesk.com/best/eu-ai-act-exposed) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.