Third-party & AI governance that holds up.
Third-party records are becoming decision logs. The firms that get this right will be the ones that can show who decided, on what evidence, and when.
30-day proof of concept. Read-only from day one.
The shift
From watching to deciding
The question is no longer whether you would know. It is who decides, on what evidence, and where that decision is written down.
6
records kept from one read-only intake
20,000+
apps already described in the catalogue
< 1 hour
to connect your systems
How it works
The register stays true because every change reaches a decision.
Montro proposes. A person decides. Here is how the register stays current, one step at a time.
Ready on the day they ask.
Your register, current before anyone asks for it
Every supplier and AI service your firm depends on, with its owner, the function it supports and what you contracted for. The register is what the regulator reads, so it is where Montro starts.
What you already owe
The records regulators read
Each regulation asks for its own record. Montro keeps them from the same register. You file it; we keep it true.
Register of information
DORA Article 28(3)
For financial entities. It tells a regulator what you contracted for, which function it supports, and what happens if it stops.
Register of information
DORA Article 28(3)
For financial entities. It tells a regulator what you contracted for, which function it supports, and what happens if it stops.
Supply-chain records
NIS2 Article 21, including 21(3)
Security across your supply chain, including the suppliers your suppliers rely on. National transposition is rolling out across member states.
Supply-chain records
NIS2 Article 21, including 21(3)
Security across your supply chain, including the suppliers your suppliers rely on. National transposition is rolling out across member states.
Record of processing
GDPR and UK GDPR Articles 28 and 30
Who processes personal data for you, for what purpose and where. When a supplier adds a sub-processor or moves processing to another country, the record has to follow.
Record of processing
GDPR and UK GDPR Articles 28 and 30
Who processes personal data for you, for what purpose and where. When a supplier adds a sub-processor or moves processing to another country, the record has to follow.
AI Inventory
EU AI Act
The AI systems your firm relies on, including AI a supplier has switched on inside a product you approved. High-risk obligations apply from December 2027.
AI Inventory
EU AI Act
The AI systems your firm relies on, including AI a supplier has switched on inside a product you approved. High-risk obligations apply from December 2027.
For the people who own the record
One register. Each owner sees their part.
Heads of Compliance, CISOs, DPOs and IT Directors each own part of the third-party record. Montro gives them one register to work from, each with the view their job needs.
CISOs
Posture across your suppliers and AI services, with the exceptions that need you. Not a findings feed.
Learn more
DPOs
You stop finding out about a sub-processor change from a client questionnaire. It reaches you first, confirmed by the supplier, and your Article 30 record stays true.
Learn more
IT Directors
Your team decides which candidates cross into the register. Licences nobody is using show up alongside, so a renewal is a decision, not a surprise.
Learn more
Heads of Compliance
One record to answer the board, the examiner and the client questionnaire, all from the same register.
Learn more
Where we are
Built in Europe, for Europe and the UK
Montro is headquartered in Dublin and hosted in the EU, in Frankfurt. EU and UK regulation is the design centre, not a layer added to a US product.
Data stays in Europe
Read-only collection, and your data stays in your environment. Pen-tested, with ISO 27001 certification in progress.
Built from inside the regulatory cycle
A founding team from financial services compliance and enterprise technology. Article-level mapping is part of the product's design, not added on top.
See it on your own suppliers
A read-only connection, about an hour to set up, and a named person who can say yes to a decision.
Priced to scope — never per seat, never per supplier. Upgrade only when the evidence earns it.
FAQ
Questions about how Montro works, where your data lives, and how the pilot runs.
Connects to what you already run
Read-only connections to your identity provider, directory, finance systems and cloud estates. You get the full scope list, including what Montro cannot see, before you connect.
People
Built in Dublin
We have spent years transforming how large enterprises adopt technology and ensuring financial institutions did it compliantly. Montro exists because those two jobs have never been in the same room — until now.
