Third-party & AI governance that holds up.
Third-party records are becoming decision logs. The firms that get this right will be the ones that can show who decided, on what evidence, and when.
30-day proof of concept. Read-only from day one.
The shift
From watching to deciding
The question is no longer whether you would know. It is who decides, on what evidence, and where that decision is written down.
6
records kept from one read-only intake
20,000+
apps already described in the catalogue
< 1 hour
to connect your systems
How it works
The register stays true because every change reaches a decision.
Montro proposes. A person decides. Here is how the register stays current, one step at a time.
Ready on the day they ask.
Your register, current before anyone asks for it
Every supplier and AI service your firm depends on, with its owner, the function it supports and what you contracted for. The register is what the regulator reads, so it is where Montro starts.
Six things move a record.
When something changes, it reaches you as a candidate
A new supplier appears. A sub-processor is added. Processing moves to another country. A certificate lapses. AI is switched on inside a tool you already approved. A supplier goes dormant. Each is raised with its source, and the supplier confirms.
Nothing is left open.
Your people decide. The register records it.
Each candidate goes to the person who owns that supplier. They decide what happens, and Montro keeps the decision against the entry, so the register doubles as the decision log your examiner asks for.
The one list that gets shorter.
Dormant suppliers are re-tiered, not removed
When a supplier goes quiet, Montro proposes moving it down a tier. It stays on the register while the contract exists, because DORA and the FCA cover the arrangement, not the usage, but it stops taking up review time. Suppliers nobody uses any more are re-tiered, not removed, so their history stays on the record.
20,000+ apps already described.
A faster yes on every new tool
When someone asks to use a new tool, its entry starts filled in from Montro's catalogue rather than blank. Your team reviews it and decides, instead of starting the research from scratch. The same register then answers client due-diligence questions faster.
What you already owe
The records regulators read
Each regulation asks for its own record. Montro keeps them from the same register. You file it; we keep it true.
Register of information
DORA Article 28(3)
For financial entities. It tells a regulator what you contracted for, which function it supports, and what happens if it stops.
Supply-chain records
NIS2 Article 21, including 21(3)
Security across your supply chain, including the suppliers your suppliers rely on. National transposition is rolling out across member states.
Record of processing
GDPR and UK GDPR Articles 28 and 30
Who processes personal data for you, for what purpose and where. When a supplier adds a sub-processor or moves processing to another country, the record has to follow.
AI Inventory
EU AI Act
The AI systems your firm relies on, including AI a supplier has switched on inside a product you approved. High-risk obligations apply from 2 December 2027.
Material third-party register
For UK firms under FCA PS26/2 and PRA PS7/26: each material arrangement, its owner and the decision behind it.
Control evidence
ISO 27001 supplier controls, with the evidence for each kept on the entry.
For the people who own the record
One register. Each owner sees their part.
Heads of Compliance, CISOs, DPOs and IT Directors each own part of the third-party record. Montro gives them one register to work from, each with the view their job needs.
Heads of Compliance
One record to answer the board, the examiner and the client questionnaire, all from the same register.
Learn more
CISOs
Posture across your suppliers and AI services, with the exceptions that need you. Not a findings feed.
Learn more
DPOs
You stop finding out about a sub-processor change from a client questionnaire. It reaches you first, confirmed by the supplier, and your Article 30 record stays true.
Learn more
IT Directors
Your team decides which candidates cross into the register. Licences nobody is using show up alongside, so a renewal is a decision, not a surprise.
Learn more
Where we are
Built in Europe, for Europe and the UK
Montro is headquartered in Dublin and hosted in the EU, in Frankfurt. EU and UK regulation is the design centre, not a layer added to a US product.
Data stays in Europe
Collection is read-only, scoped and revocable. Pen-tested, with ISO 27001 certification in progress.
Built from inside the regulatory cycle
A founding team from financial services compliance and enterprise technology. Article-level mapping is part of the product's design, not added on top.
Third-party records are becoming decision logs. The firms that get this right will be the ones that can show who decided, on what evidence, and when.
See it on your own suppliers
A read-only connection, about an hour to set up, and a named person who can say yes to a decision.
Priced to scope — never per seat, never per supplier. Upgrade only when the evidence earns it.
FAQ
Questions about how Montro works, where your data lives, and how the pilot runs.
Connects to what you already run
Read-only connections to your identity provider, directory, finance systems and cloud estates. You get the full scope list, including what Montro cannot see, before you connect.
People
Built in Dublin
We have spent years transforming how large enterprises adopt technology and helping financial institutions do it compliantly. Montro exists because those two jobs have never been in the same room — until now.
Ankur Arora
Co-founder
15 years across enterprise SaaS, digital products and customer growth, at Amdocs, Godrej, Sodexo and Chartbeat. Built and shipped products at scale across telecom, consumer, hospitality and media.
Namita Razdan
Co-founder
15 years of financial services compliance, across HSBC, EY, Accenture and NTT Data. The article-level regulatory accuracy in Montro comes from her desk.