A compliance automation platform that connects your existing systems, eliminates manual re-entry across them, and gives your team one place to see the full picture on any counterparty.
We're proposing it in three layers, so you can commit incrementally and see value early:
Today the status quo costs the team 5+ hours a day and risks the same client data diverging across six systems — a compliance exposure in a regulated environment, not just an inefficiency (full picture in Appendix A).
A deliberate design choice: for Layers 1 and 2, the live system runs on deterministic, rule-based code — not AI making decisions on your data.
The six systems (Sumsub, Elliptic, Asana, Fireblocks, Google Drive, Google Sheets) connected so status changes, KYC updates, and KYT alerts propagate automatically.
Search any counterparty, see current status across all systems, and view a chronological timeline of every action, alert, review, and decision — including decisions documented in Slack, built in here because the dashboard is incomplete without it.
Fix mismatches (e.g. Asana vs. Sumsub) directly from the dashboard, and optional AI-assisted enhancements (auto-extracting decisions from free-text Slack, natural-language search, alert summarization), approved separately when you're ready.
You operate in a regulated environment, so we treat data handling as a core design decision, not an afterthought. Our position for the committed build (Layers 1 + 2) — to be confirmed and finalized in the design phase:
For Layers 1 and 2, the running system uses only deterministic, rule-based code — no AI makes decisions in production. Your counterparty data is not processed by an AI model in the live system.
Status and workflow data leaves your existing systems only to transit our platform in memory, and is written back to your own systems. We do not replicate your client database.
The platform is hosted in an EU region; in the committed build, no data leaves the EU.
The platform persists only an audit log, the Elliptic whitelist, encrypted API credentials, and — for the dashboard timeline — a lightweight event log. The log and whitelist can be written into storage you control, and the timeline can alternatively be assembled live from your systems. Finalized in the design phase.
Our EU hosting provider is the single new sub-processor, disclosed in a GDPR Art. 28 Data Processing Agreement signed before build begins.
If you later choose AI-assisted enhancements, they run only on a redacted, tokenized slice — identifiers replaced with tokens before any text reaches a model — under zero-retention, EU-resident, no-training terms. Opt-in and approved separately.
We'd value early input on these before any commitment — your answers may shape the architecture:
3 focused sessions, ~1 hour each, lean on your team's time. Output: a signed-off technical specification and a privacy/security spec covering data flows, retention, residency, and Art. 28 scope. This is where we finalize the right security approach with your Legal and IT teams. Build starts only after sign-off.
Current-state mapping — walk each workflow as it works today.
Future state + privacy/security — data flows, retention, residency, DPA scope.
Spec sign-off — confirm scope, confirm layer choice, begin build.
Data handling during design: we work from documentation and, where needed, redacted samples — never live production records. Any sample shared is deleted within 30 days, with written confirmation.
Timeline: approximately 5–6 months from signing to full go-live (1 month design + build); Layer 1 can go live independently, sooner.
A clear basis before you commit: the figures above are indicative. After the design phase we provide a detailed build proposal — scope, milestones, and commercials — so you have a clear, agreed basis before committing to the build.
Billing: you pay across the build months; the monthly subscription begins only when the system goes live — no subscription fee during the build.
This proposal is valid until 15 July 2026.
The cost isn't only the 5+ hours a day lost to manual re-entry. The same client data, keyed by hand across six systems, can diverge — and a wrong risk rating or a missed periodic review in a GFSC-regulated environment is a compliance exposure, not just an inefficiency. There is no single source of truth and no automatic audit trail, so audit-readiness depends on manual reconstruction; and the process that worked for 2 people hasn't scaled to 7.
What this looks like day to day