Overview

Security & Compliance at Monte Carlo

Monte Carlo is the leading Data + AI Observability Platform. Data Trust ensures that reliable, high-quality data powers every decision, and Agent Trust ensures that the AI agents built on that data behave reliably in production.

Security, privacy, and compliance are core to how we build, deploy, and operate our products because our customers trust us with visibility into their most critical data systems and the AI agents that run on them.

What We Do & Why Security Matters

Data reliability sits at the heart of every business. Monte Carlo continuously monitors your data ecosystem, from pipelines to dashboards, to detect and resolve data issues before they impact the business.

As companies put AI agents into production, the same discipline applies to the agents. Agent Trust captures every agent run as a trace, evaluates output quality, and traces failures back to the data and logic behind them. Because agent traces carry prompts, completions, and tool calls, trace content stays in your own cloud account or data platform.

Because our platform connects to key components of your data and AI infrastructure, security and governance are built into everything we do.

Monte Carlo helps companies:

Detect data incidents before they reach decision-makers
Track lineage across your data stack
Monitor schema changes, freshness, and volume anomalies
Monitor AI agents in production: evaluate output quality, catch regressions and behavioral drift, and alert on latency, cost, and errors
Trace agent failures to their root cause, across both the data and AI layers
Improve trust in data and AI across teams

Deployment

Monte Carlo offers flexible deployment options that give customers full control over their data:

Hybrid Deployment models: Offers customers the ability to host row level data within their own environments
Customer-hosted agent traces: Agent Trust stores agent trace content in your own AWS, Azure, or GCP account, or in your Snowflake or Databricks account. For custom agents, evaluations run against your cloud's own LLM service
Customer-controlled access: Granular RBAC, SSO/SAML, and SCIM integration for identity management, with a separate permission for reading AI agent content.

Learn more about architecture & deployment.

Agent Trust Security

Agent Trust is designed for the sensitivity of agent conversations:

Your environment, your data: trace content (prompts, completions, tool inputs and outputs) is stored in your cloud account or data platform, and Monte Carlo queries it on demand through an agent you deploy or your existing warehouse connection.
Evaluations in your account: LLM-as-judge evaluations for custom agents run against Amazon Bedrock, Microsoft Foundry, or Vertex AI in your own account.
Least privilege: Monte Carlo connects to your trace store as a user with no write access to trace data.
Content-level access control: you decide which users can read agent conversations and which see only agent health and metrics.
Human-approved changes: Reinforcement Loop proposes fixes as draft pull requests or tickets and never changes a running agent.

Our Security & Compliance Frameworks

Monte Carlo’s security program aligns with industry best practices and leading frameworks such as ISO 27001, SOC 2, and NIST.

Security

We protect your data and systems through:

Hardened AWS infrastructure with continuous monitoring
Encryption at rest and in transit
Secure software development lifecycle (SSDLC)
Automated vulnerability management and regular penetration testing
Strong authentication and least-privilege access policies
Continuous employee security training and background checks

Privacy

Privacy is foundational to how Monte Carlo operates.

Transparency on what data we collect and why.
Compliance with GDPR, CCPA, and the EU-U.S. Data Privacy Framework.
Data residency options for regional compliance.
Customer tools for access and deletion requests.

Compliance

Monte Carlo maintains an independently audited compliance program that meets leading enterprise standards, including SOC 2 Type II and ISO 27001, with alignment to GDPR, CCPA, and the EU–U.S. Data Privacy Framework. Our controls are verified annually by accredited third-party auditors, ensuring the effectiveness of our security, availability, and confidentiality practices.

Our Trust Center is available at https://trust.montecarlo.ai/, where our audit attestations, reports, and certifications can be found.