Governed AI you can put in front of your CFO

Every AI feature — categorization, receipt reading, the assistant, anomaly and forecast summaries — routes through a single governed gateway. There is no code path that talks to a model directly, so the controls here can’t be skipped by one feature.

Before anything is sent to a model, data is classified into Public, Controlled, Restricted, or Highly-restricted. The tier is fixed by the feature in code and can’t be loosened by the caller — and it decides where the data may go.

Highly-restricted data — today, GST tax-ID (GSTIN) extraction — is code-blocked from every external provider and processed only on a local model. If an external provider is configured, that data is transparently rerouted to local; it never leaves your environment.

An external AI provider can’t be used until it’s in the registry with a verified data-processing agreement and an approved maximum data tier. New providers start blocked. A blocked provider causes a safe fallback to the local model.

For automated categorization, the AI writes a pending suggestion, not a change to your accounts. The transaction updates only when a person clicks Approve — the single code path that commits a suggestion. Reject writes nothing to your financial records.

Text bound for a model is scanned for 18 categories of prompt-injection and manipulation — ignore-instructions, persona overrides, system-prompt extraction, jailbreaks, data exfiltration, cross-tenant probing. On a match, the call is blocked before any model runs, and logged.

Security checks fail closed: an error in the injection scan, the tenant check, or the assistant’s topic classifier blocks the request rather than waving it through. (The provider policy fails safe-to-local so sensitive data stays protected while work still completes.)

Each governed call writes to an append-only, per-organisation audit log: the feature, data tier, provider and model, a redacted summary, confidence, whether injection was detected, the outcome, and latency.

The AI only ever works with your organisation’s data, taken from your authenticated session — never a URL or request body. Approve/reject actions are org-scoped on the server; a cross-tenant attempt returns “not found”. Verified by automated tests.

The audit log stores a classification summary — feature and data tier — not your prompts, amounts or documents. The audit trail never becomes a place your financial data can leak from.

The provider registry tracks, per provider, whether it retains prompts and whether it trains on data, alongside DPA status and region — and these gate whether a provider may be used. Enforcement of the gate is in our code; the commitments come from each provider’s DPA.