Promethean · Competitive Positioning
Document type Competitive positioning · Sales engineering · Product strategy
Length ~4 pages
Last revised 2026-05-18 (v1.3 — post-launch hardening)
Audience VP Sales · VP Product · prospective operators running vendor benchmarks
Companion docs PRODUCT_DATASHEET · SOLUTION_BRIEF · PROMETHEAN_THEORY_AND_FINDINGS §6 (canonical comparison against alternatives)
1. The layer below the AI-tooling category
The honest answer to "what category are you in" is: not in the AI-tooling category as currently defined. Promethean is the deterministic substrate the AI-tooling category will eventually have to live on top of.
A useful mental model: where Stripe sits relative to payment apps (the engine that turns commodity payment rails into safe transactions), Promethean sits relative to AI features in regulated products (the engine that turns commodity LLM output into regulator-verifiable evidence).
This means the vendors below are not direct competitors. They are adjacent layers — useful, sometimes complementary, never replacement.
1a. The determinism boundary
A useful framing that has emerged in customer conversations: Promethean's domain begins where source-code-predictability ends. Tools that operate on the deterministic side of that boundary (static analysers, coding harnesses, build-time verifiers) cannot reach the LLM's runtime output surface. Tools that operate on the non-deterministic side (model evaluators, observability platforms) cannot produce signed, replayable evidence per call. Promethean is the layer that sits on the boundary itself — turning a non-deterministic decision into a deterministic, verifiable record.
The vendor map below is organised around that boundary: who works upstream of it (deterministic code), who works downstream of it (model-behaviour evaluation), and what each category does NOT close.
2. Category map · who does what
| Vendor | Category | Side of determinism boundary | Audits the software around the LLM | Audits the model's behaviour | Bounds the output surface by construction | Carries the call into a regulator-verifiable record | Cross-language byte parity | Bitcoin-anchored time attestation |
|---|---|---|---|---|---|---|---|---|
| Promethean | Runtime-AI substrate | on the boundary | Partial | Partial | ✓ | ✓ | ✓ | ✓ |
| Vanta | Compliance SaaS | n/a (org controls) | ✓ | – | – | – | – | – |
| Drata | Compliance SaaS | n/a (org controls) | ✓ | – | – | – | – | – |
| OneTrust | Privacy + GRC | n/a (org controls) | ✓ | – | – | – | – | – |
| Credo AI | AI governance | downstream | – | ✓ | – | Partial | – | – |
| IBM Watson OpenScale | AI governance | downstream | – | ✓ | – | Partial | – | – |
| Fiddler AI | AI observability | downstream | – | ✓ | – | – | – | – |
| Lakera | AI safety / red team | downstream | – | Partial | – | – | – | – |
| Robust Intelligence | AI safety | downstream | – | ✓ | – | Partial | – | – |
| Calypso AI | AI risk for enterprise | downstream | – | ✓ | Partial | – | – | – |
| SonarSource (SonarQube) | Build-time static analysis | upstream | ✓ (deterministic code) | – | – | – | – | – |
| LangChain | LLM orchestration | downstream | – | – | – | – | – | – |
| LangSmith | LLM observability | downstream | – | – | – | – | – | – |
| Vellum | Prompt management | downstream | – | – | – | – | – | – |
| Humanloop | Prompt management + eval | downstream | – | – | – | – | – | – |
| LlamaIndex | RAG framework | downstream | – | – | – | – | – | – |
| Glean | Enterprise AI search | downstream | – | – | – | – | – | – |
| Pi (OpenTeams) / Cursor / Claude Code / Aider | AI coding harness | upstream (developer-time) | ✓ (the code they emit) | – | – | – | – | – |
The four right-hand columns are what makes the substrate categorically distinct.
3. Head-to-head detail
vs Vanta / Drata (compliance SaaS)
Where they fit: SOC 2, ISO 27001, HIPAA, GDPR controls around the LLM — access management, vulnerability scanning, vendor onboarding, employee training, evidence collection for control owners.
Where they don't: Per-call AI evidence. They have no architectural primitive for "this specific LLM decision was bounded by this declared schema and signed at recording time."
Joint deployment pattern: Customer keeps Vanta / Drata for the surrounding controls. Promethean adds the runtime-AI receipt chain. The two systems coexist; the substrate's L12 chain becomes a controlled artefact Vanta tracks.
Pricing comparison: Vanta enterprise is €60K–€500K/yr for the compliance platform; Promethean Enterprise is €2,499/mo (~€30K/yr) for the runtime-AI containment layer. Not substitutes — they audit different things at different price points.
vs Credo AI / IBM Watson OpenScale (AI governance)
Where they fit: Bias evaluation, drift detection, fairness metrics, model-card management, evaluation pipelines for AI risk assessment. They produce evidence that the model behaves well in aggregate.
Where they don't: Per-call signed evidence. Closed-enum output surface enforced at request time. Cryptographic chain a regulator can verify offline.
Joint deployment pattern: Credo evaluates the model and produces aggregate-quality evidence. Promethean records the per-call evidence and produces the regulator-verifiable chain. Complementary layers.
Pricing comparison: Credo AI enterprise is €100K–€500K/yr typically; Promethean's Enterprise tier is €2,499/mo (~€30K/yr) — they target different buyer roles (head of AI governance vs platform engineering) and produce different artefacts (aggregate model behaviour vs per-call signed receipts). An operator might buy both.
vs Lakera / Robust Intelligence / Calypso AI (AI safety)
Where they fit: Prompt-injection defence, adversarial-robustness testing, output filtering, red-team scenarios.
Where they don't: Audit trail. Regulator-readable record. The pre-flight risk assessment vs the per-call attestation: Lakera answers "is this prompt safe to send"; Promethean answers "what did the model decide and can a regulator verify."
Joint deployment pattern: Lakera sits in front of the model (pre-flight); Promethean sits around it (record + verification). Both can coexist; the substrate's L12 chain records when Lakera's gate fired (via reviewerVerdict).
Pricing comparison: Lakera Pro is €50K–€200K/yr; not a substitute for the substrate.
vs LangChain / LlamaIndex / Vellum / Humanloop (LLM orchestration / prompt management)
Where they fit: Routing calls to different models, prompt versioning, A/B testing, retrieval-augmented generation, in-context evaluation, observability logs for engineering teams.
Where they don't: Closed-enum output enforcement, cryptographic chain, regulator-verifiable record. Their observability logs are engineering artefacts, not audit artefacts.
Joint deployment pattern: Common. Your product uses LangChain to orchestrate; one of the calls in the LangChain chain wraps runConstrainedAI for a regulated decision. The substrate records the L12 entry; LangChain handles the routing.
Pricing comparison: LangChain LangSmith plus is $39/user/mo to enterprise pricing; Vellum is similar. The substrate's per-month cost (Team €79/spec, Enterprise €2,499/mo flat) targets a different budget — orchestration tooling is a developer-tools line item; runtime-AI containment is a platform-team / compliance line item.
vs SonarSource (SonarQube, SonarCloud) and other static analysers
Where they fit: Build-time analysis of the source code surrounding LLM calls. Flag missing input validation, untrusted prompt interpolation, missing timeout handling, classic CWEs in the wrapper code. Operate on the deterministic side of the determinism boundary — the artefact they audit is the code, not the execution.
Where they don't: They cannot inspect what the LLM returned at runtime. The wrapper code can be perfect and the LLM can still output something the schema didn't anticipate. Static analysers verify deterministic properties of the code; Promethean verifies non-deterministic properties of the execution trace.
Joint deployment pattern: A serious deployment uses both. Static analyser for the wrapper code, Promethean for the wrapped calls themselves. They sit on either side of the determinism boundary in the same codebase.
Pricing comparison: SonarQube Enterprise is $12K–$120K/yr depending on LOC; SonarCloud is $11/dev/mo upwards. Not a substrate substitute — different layer, different artefact.
vs AI coding harnesses (Pi / OpenTeams, Cursor, Claude Code, Aider, GitHub Copilot Workspace)
Where they fit: Structuring the developer-LLM workflow during coding tasks. Generate code, refactor code, write tests, pair-program. The artefact they emit is the code that gets shipped.
Where they don't: They produce code, not signed decision logs. The lifecycle ends when the code is committed; Promethean's lifecycle begins when that code starts making decisions in production. Different lifecycle stage, different audience (developer vs auditor), different artefact (source files vs signed receipts).
Joint deployment pattern: A team uses a coding harness to write the application that calls runConstrainedAI. Once shipped, every LLM call inside the application gets a signed L12 receipt. The two pipelines never touch each other directly — one is upstream of the determinism boundary, one is downstream.
Pricing comparison: Coding harnesses are $20–$200/dev/mo developer-tools line items; Promethean is a platform-team / compliance line item. Not substitutes.
vs Build-it-yourself
Where it works: Genuinely doable. The architecture is publicly documented in 50 ADRs. Every test is open. The Python port is reference-implementable. We have published every primitive a credible engineering team would need.
Where it doesn't: Three operational properties are hard to replicate:
Trust-anchor reputation. Your home-built Ed25519 key starts with zero regulator-cited deployments under it. Ours has three (paysafe, cliniclens, civicgate) since v0.1, anchored to Bitcoin monthly. A regulator presented with a home-built chain asks "what's your trust-anchor history?" and you're back at month zero.
The seven operational moats (see
/licensing): reference deployments, regulator relationships, continuous chain history, corpus, team, three compounding loops, brand trust. None are replicable by reading the source.Time-to-market. Operators we have talked to estimate 18–24 months of engineering investment to reach equivalent reliability. Enterprise self-service is €2,499/mo; cost-equivalent in-house build is ≥€2M and 1.5+ years before you account for the trust-anchor reputation problem.
The adversarial track record. Promethean publishes its 31 closed post-launch findings with commit references (
/release-notes+ paper §5). A home-built equivalent starts with an empty record; auditors increasingly ask for one.
Pricing comparison: Build-it-yourself sounds free until you account for engineering opportunity cost. 18 months × 4 engineers at €150K loaded cost = €900K minimum, and you still have the trust-anchor reputation problem to solve.
4. When to pick the substrate
Pick Promethean when all three apply:
- You have an AI feature with a real compliance objection blocking production (or expect one inside the next 12 months under the EU AI Act / DORA / GDPR Art. 22 cycle).
- The feature lives in a regulated product (PSD3, DORA, NIS 2, GDPR Art. 22, HIPAA, MDR, AI Act) — see
/api/facts/regulatory-coveragefor the canonical list of what Promethean ships handoff templates for. - You need per-call evidence a regulator can verify independently.
The self-service tiers let you start at €0 (Dev) and graduate to Enterprise (€2,499/mo) as the workload grows; the previous 90-day pilot SKU is retired. The design-partner programme on /customers is the closest current analogue for an operator that wants engineering co-design + free Enterprise tier in exchange for a case study (12 months, 3 verticals).
If those don't apply, the substrate is overkill or not-quite-fit. We are honest about this in the operator-fit interview.
5. When to pick something else
| Situation | Better fit |
|---|---|
| You need SOC 2 / ISO 27001 / HIPAA surrounding controls | Vanta / Drata |
| You need to evaluate model bias / drift / fairness in aggregate | Credo AI / Fiddler |
| You need prompt-injection defence at the inference boundary | Lakera / Robust Intelligence |
| You need an orchestration framework | LangChain / LlamaIndex |
| You need prompt version control + A/B testing | Vellum / Humanloop |
| You need RAG infrastructure | LlamaIndex / Pinecone |
| You need build-time static analysis of the wrapper code | SonarSource / Semgrep |
| You need a developer-time AI coding harness | Pi / Cursor / Claude Code / Aider |
| Your AI feature is in a NON-regulated product | None of the above is mandatory; substrate is overkill |
| You want a model evaluation lab without production constraint | LangSmith / Galileo / Patronus |
We will tell you this in the operator-fit interview if it applies. Sending a customer to a competitor in the right category is better for everyone than a misfit pilot that falsifies on week 12.
6. AI-vendor channel (for the other vendors in this list)
For mid-tier AI vendors and frontier-model providers interested in embedding the substrate (co-branded "Powered by Promethean", or as a cross-provider neutral audit standard), arrangements are bespoke and negotiated outside the self-service tier ladder. Contact strategic@promethean.software.
The substrate is non-exclusive by design. We do not sell exclusivity to any vendor — exclusivity would undermine the standard we are building.
7. The honest summary
Promethean is the layer that makes runtime LLM decisions in regulated products cryptographically verifiable by a regulator independent of Promethean. The vendor categories above each close part of the surrounding problem; none of them close this one.
If you're shopping in the AI-tooling category, you're shopping one layer up. If you're shopping in the compliance-SaaS category, you're shopping one layer over. Promethean is the layer below both.
Operator-fit interview: 30-minute call · operators@promethean.software · we tell you honestly whether the substrate fits.
Vendor descriptions reflect public information as of 2026-05-18. We update this document quarterly as vendor positioning shifts; the L9 self-evaluation chain records changes. Last revised 2026-05-18.