VaulithNine questions, free
Pricing

An afternoon, not a quarter.

The assessment runs on a deterministic rules engine, so there is nothing to integrate and nothing to wait for. You describe your estate, and the findings are ready before you have finished your coffee. Bought with a card, with no demo, no procurement, and nothing that renews on its own.

$499The assessment. One payment, twelve months, self-serve.from $15,000A readiness review. Human, in writing, three to five weeks.
Before you buy

Try the engine on one fact.

The assessment runs this engine on your whole estate. This is one rule of it, on one fact, so you can see what a finding looks like before you pay for the other twenty-four questions.

Try the engine on one fact

A model in your product influences a decision that reaches a consumer. Can a person review or override the output before it reaches them?

Choose an answer. The derivation appears here, step by step, from the fact you give. Nothing is shown before that, because the engine has nothing to derive from.

That is one fact of nine. The free snapshot asks the other eight, in about ninety seconds, with nothing leaving your browser.

Readiness assessment
Automated, immediate, self-serve
$499for twelve months

A guided intake of about thirty minutes, then the same engine the live profile runs. You get every finding, ranked by what a carrier reviewer does when they read it, with the reasoning and the remediation for each. One payment covers twelve months: the intake, every update, republishing and new share links. Nothing renews on its own; a new twelve months is a new purchase.

  • Your AI systems recorded the way an examiner asks about them, including the consumer-impact determination most vendors have never written down.
  • Findings ranked by reviewer reaction, not by how hard they are to fix, each one saying why a reviewer reacts that way.
  • The policy versus practice check, which reads your own governance commitments against your estate and quotes them back to you.
  • A readiness score with the whole arithmetic shown, so it survives being questioned by your own CISO.
  • A shareable carrier profile. Your reviewer opens it without an account, because they cannot get your SSO provisioned inside their window.
  • The assessment as a print-ready document you can forward internally.
Start an assessmentSign in with a work email, pay by card, and the intake opens. About thirty minutes.
Readiness review
Human, in writing, three to five weeks
from $15,000per engagement

For when the findings need somebody to actually close them. Everything above, plus the work, delivered in writing: building the register, writing the determinations, and drafting the answers to whatever the carrier asks next. Every engagement starts with a conflict check; where Vaulith has one, it says so and declines.

  • The subprocessor and sub-model register produced, not just identified as missing.
  • Provenance and impact determinations drafted to the standard a reviewer accepts.
  • Your carrier questionnaire answered end to end, with the source behind each answer.
  • Written answers to the carrier's follow-up questions and escalations, prepared for you to send.
  • Nobody from Vaulith contacts your carrier. Every document and every answer goes through you, under your name.
  • Built from the public instruments the canon cites and from your own documents. No carrier's confidential material is used, asked for or accepted.
  • A conflict check before any document changes hands, and a written decline where Vaulith has one. The engagement terms are section 10 of the terms of service.
Talk about an engagement →
Founding vendors

The first ten get read by people.

The assessment is automated and stays that way. For the first ten companies that buy it, the Vaulith team, professionals with more than a decade of carrier-side governance, risk and compliance experience, reads your findings and writes back: what a reviewer will stop on first, what to fix before you send anything, and what to leave alone. Within five working days of your request, in writing, at no extra charge.

Reply to your receipt with the word "read-through" and it starts. The offer is in the terms, so it is a promise and not a note on a page.

In return we ask one thing, and only if you are willing: a sentence about what the assessment did for you, with permission to publish it beside your company's name. Nothing is published without your written yes, and saying no changes nothing about the read-through.

What the assessment cannot do

Stated here rather than in a footnote.

This is sold to people whose profession is noticing what a document does not say. Burying the limits would be the most expensive decision available, so here they are at the same size as everything else.

It reads what you tell it, not your documents

You describe your models and your evidence position through a guided intake. The assessment does not open your policy, inspect your systems, or connect to anything. Nothing is uploaded and nothing is scanned.

It cannot check whether your answers are true

A carrier reviewer can, and will. If you tell it a model has been independently validated, it believes you and scores accordingly. The value is in knowing which answers get escalated, not in auditing the answers.

Nobody reviews your report

No human reads your profile, your findings, or your score unless you ask for the founding read-through. That is the reason this is $499 and not $15,000, and it is the reason it arrives in an afternoon rather than a month.

It covers insurance diligence, and only that

The question canon is drawn from the NAIC AI model bulletin, the NAIC AI Risk Evaluation Supplement (draft version 5.0, formerly the AI Systems Evaluation Tool) and the third-party provisions of 23 NYCRR 500. It is not a general security assessment, not a SOC 2 readiness tool, and not a substitute for either.

It is not a compliance opinion and not legal advice

The same sentence appears on the readiness screen and in the terms, in the same words, because a boundary phrased three ways is a boundary nobody can quote back. It estimates how much friction your current evidence position will generate in front of a carrier risk officer. Whether you meet an obligation is a question for your counsel and your regulator, and Vaulith does not answer it.

Questions a buyer asks

Answered from what the software does.

Who is this for?
Companies that sell software to insurance carriers and face the carrier's security and AI questionnaire before a deal can close. If your buyers are banks or hospitals, their reviewers ask different questions and this is not the tool for them.
What do I get for $499?
A guided intake of about thirty minutes, every finding the rules engine produces on your description of your estate with its reasoning and its remediation, a readiness score with the arithmetic shown, a print-ready document of the whole assessment, and a profile you can share with a carrier reviewer by a link that needs no account. You can update it and share it again as often as you like for twelve months from the purchase. Nothing renews on its own; after the twelve months, a new assessment is a new purchase at the price then shown, and a profile you have published stays readable at its assessment date.
How long does it take?
The free snapshot takes about ninety seconds. The paid intake takes about thirty minutes if you have your documents to hand, and the result is on the screen as you type: there is no processing time, because the engine runs in your browser.
Does anyone at Vaulith read my answers?
No human reads your profile, your findings or your score unless you ask for the founding read-through, and nothing you enter leaves your browser until you choose to publish a profile to share it. For the read-through, you send the printed assessment to support@vaulith.com yourself, and the Vaulith team reads that document and nothing else. Publishing sends it to Vaulith's database in the United States so a link can be issued; the trust page lists every subprocessor.
Can a carrier reviewer see my score or my findings?
Never. A reviewer who opens your link sees your AI systems, your security posture, your responses and the passages you cite. The score and the gap report are your private diagnostic, and the server does not send them.
What if my answers are wrong?
The assessment scores your description; it cannot check whether it is true. A carrier reviewer can, and will. The value is in learning what a reviewer will stop on before they do, so an optimistic answer helps nobody, least of all you.
What happens after I fix something?
Change the fact in the intake and the score and findings change with it. Publish again and the reviewer is told, on their next visit, exactly which records were updated since they last looked.
What is the founding programme?
For the first ten companies that buy the assessment, the Vaulith team reads your findings and writes back within five working days of your request, at no extra charge: what a reviewer will stop on first, what to fix before you send anything, and what to leave alone. Reply to your receipt with the word "read-through" to start it. In return we ask, only if you are willing, for a sentence we may publish beside your company's name; nothing is published without your written yes.
Is there a refund?
Seven days from purchase, in full, by replying to your receipt. The terms say the same in the same words.
What does the readiness review add?
People. From $15,000, a scoped engagement in which the Vaulith team, professionals with more than a decade of carrier-side governance, risk and compliance experience, builds the register, writes the determinations, answers the carrier questionnaire end to end with the source behind each answer, and drafts the replies to the follow-up questions and escalations, all in writing, for you to send. Nobody from Vaulith contacts the carrier, and the work is built from the public instruments and your own documents. Every engagement starts with a conflict check; where Vaulith has one, it says so and declines.
Support

Automated, and honest about it.

The assessment supports itself. Every question in the intake explains what it is asking and why a carrier cares, every finding carries its own remediation, and the score shows its arithmetic rather than asking to be trusted. There is no ticket queue because there is nothing to wait for.

If something is genuinely broken, write and a person answers within one working day. That is the extent of it, and pretending otherwise at this price would be a promise nobody could keep.

What this buys you in practice. A carrier review that would have opened with six weeks of back and forth opens instead with a profile the reviewer can close. That is the entire product. It does not create a reason to say yes; it removes the reasons to say no.

Know what they will stop on, before you send it.

The assessment is open now. Sign in with a work email and the intake begins. If you would rather talk first, the free conversation is thirty minutes: you describe your last carrier review, and the Vaulith team, professionals with more than a decade of carrier-side governance, risk and compliance experience, sends you a written read either way.

Start an assessmentGet in touchSee a live profile →