Monk is the secure AR automation platform
This page sets out what Monk accesses, what we are certified against, and what you can ask for. Monk applies the same security and privacy standards to employee onboarding, operations, engineering, and vendor management.
SOC 2
SOC 2 Type II compliant, with the report available at trust.monk.com.
Encryption
Your data is encrypted and scoped to your organization in our own AWS environment.
Access control
SSO, MFA and role-based access, with every connection scoped to the work.
No model training
Your data never trains Monk’s systems or any model provider’s models.
Your data, your call
When you leave, we delete or de-identify your data under our deletion policy.
Full audit trail
Every agent action is logged, so you can see who did what and when.
Other general security practices include role-based access, data minimisation, strict physical space and device security protocols, SSO and MFA
Enterprise Grade Security and Controls
Your AR data does not go straight to a model
Monk sits between your systems and frontier models. The harness decides what each model sees and what comes back. That is where the controls live.
Regulated context
Monk controls exactly what the model sees and when. The model gets the fields a task needs, not your ledger
Model routing
Each task goes to the model that handles it best, so you are not locked to one provider.
No training on either side
Your data is not used to train Monk's systems and is not used to train a provider's models.
Monitored infrastructure
Monk runs on monitored infrastructure with logging on every agent action.
Frequently asked questions
What data does Monk access?
Monk reads invoices, customers, and payment status from your ERP or billing system. It reads settlements from your bank and sends and receives collections email on your domain. Every connection is scoped to the task.
Is my data used to train AI models?
No. Your data is not used to train Monk's systems or any model provider's models.
Where is my data stored?
Your data is stored and processed in Monk's own AWS environment. It is encrypted and scoped to your organization, so no other customer can ever see it.
Is Monk SOC 2 certified?
Yes, Monk is SOC 2 Type II compliant. You can request the report at trust.monk.com.
Can Monk write back to my ERP?
Yes. Monk posts applied payments, credit memos, and deduction write-offs back to your ERP. Both systems stay in sync without manual entry.
Can I delete my data?
Yes. When your relationship with Monk ends, we delete or de-identify your data under our Data Deletion Policy unless the law requires us to keep it longer.
How do I get Monk's security documentation?
Request the SOC 2 report and penetration test results at trust.monk.com. We will also complete your security questionnaire.