Compliance
Built for the rules you answer to.
CypriaAI gives your compliance team technical controls and records that support your obligations — and a clear answer to the first question every supervisor asks.
Built for the rules you answer to
The controls your regulator asks about,
and the evidence to show them.
GDPR EU 2016/679
What it asks of you
Data minimisation, protection by design, pseudonymisation and security of processing (Art. 5, 25, 32).
How CypriaAI supports it
Identifiers are pseudonymised in your network before processing; only aliases reach CypriaAI and the model.
What you can show
Gate configuration, detector list, sealed-only storage
DORA EU 2022/2554
What it asks of you
Manage ICT third-party risk, log activity, and keep the ability to change provider.
How CypriaAI supports it
Personal identifiers never readable by us or the model provider; every action logged; model provider switchable per task.
What you can show
Audit log with before/after state, provider settings per agent
EU AI Act EU 2024/1689
What it asks of you
Human oversight, transparency and record-keeping proportionate to the use.
How CypriaAI supports it
Agents hand cases to a person when they cannot ground an answer; each run is recorded step by step.
What you can show
Run records, hand-over events, versioned job descriptions
MiFID II Record-keeping
What it asks of you
Keep records of services and client interactions; be able to reconstruct what happened.
How CypriaAI supports it
Conversations, decisions and configuration changes kept against the user, agent version and time.
What you can show
History per agent and per user
Confidentiality Mandates · secrecy
What it asks of you
Client data seen only by those entitled to it.
How CypriaAI supports it
Agents act with the asking person's own access; each organisation's data is separated on every look-up.
What you can show
Permission model, organisation isolation, access log
Your supervisor's question, answered in one line
“Can the AI vendor read our clients' identifiers?” — No. They are sealed with a key held only by you.
CypriaAI provides technical controls and records that support these obligations. Assessing compliance remains with your firm and its advisers; this is not legal advice.
Defence in depth
Eight checks on every request. None of them optional.
01
Scope
Requests outside the agent's job are refused before any work or spend.
02
Injection check
Attempts to override instructions are scored and blocked or escalated.
03
Sealing
Client identifiers sealed in your network with your key.
04
Isolation
Every look-up confined to your organisation's own records.
05
Permissions
The agent borrows the asker's access — never more.
06
Read-only
Data sources are queried read-only, limited to the tables you name.
07
Budget
Hard ceiling on steps and spend per request; it stops at the line.
08
Audit
Every action and change recorded — who, what, when, before and after.
Evidence
What you can show an auditor.
Everything below is available to your team in the console and in your Gate's configuration.
- The Gate's configuration and the list of identifiers it seals
- Proof that only aliases and sealed tokens are stored on our side
- Each agent's job description, versions and who activated them
- Conversation history per agent and per user
- The audit log of every action and settings change, with before and after
- Hand-over events where an agent passed a case to a person
Start with the work you choose