Financial services

Confidential packs that cannot leave the master record's country.

KYC files, credit packs and exception evidence for banks and licensed financial institutions that must keep confidential data inside the UAE and remain accountable for any AI in the path. Intake and assist inside the perimeter, not a public model with a region flag.

The regulatory trigger

CBUAE outsourcing rules require the master system of record, including confidential data, to be maintained and stored in the UAE. Sharing confidential data outside the UAE needs Central Bank approval and customer consent mechanics that most "ship the PDF to a cloud LLM" products never survive.

CBUAE guidance on AI and machine learning for licensed institutions stresses governance, accountability, human oversight, data management, and responsibility for third-party AI. The compliance question is not whether the GPU is in Dubai. It is who holds the keys, who runs the weights, and whether the supervisor can still reach the evidence.

bizfylabs — use case

Private KYC and credit-file intake inside bank perimeter

KYC Pack Intake & CBUAE Governance Flow

If the Central Bank asked tomorrow where this KYC pack was inferred, could you answer without naming a public model vendor?

The wedge

KYC and credit-file document intake first: classify, extract, map to the bank's schema, cite source regions, preserve originals. Exception routing and analyst assist on AgentLab come after Foundation and DocxIntel are live. A human remains on consequential decisions.

Enterprise boundaries / Guardrails

What we do not claim

Not core banking. Not automatic credit decisioning. Not a guarantee of CBUAE approval. Not AML transaction monitoring as a product SKU.

Why the cloud answer fails here

A public agent or OCR API that processes confidential customer data outside the approved perimeter collides with outsourcing and data-protection obligations before accuracy is even measured. Data residency on a vendor-operated model is residency without sovereignty.

What deployment looks like

Foundation in customer tenancy or air-gapped. DocxIntel for packs. Model Gateway on every prompt and tool call. Policy, DLP, human-in-the-loop and immutable audit in path. The customer is controller and processor. BizfyLabs LLC does not hold production data. Apache 2.0 and MIT weights on disk. The first deal can be DocxIntel only.

Controls in this workflow

These controls run on Private AI Foundation for every document ask. AgentLab, if used later, shares the same path.

Packs stay inside the customer perimeter. Inference does not require a network path out.
You hold the encryption keys in every tier that touches your data.
Every document ask goes through the Model Gateway. There is no side door to a public model.
Policy and DLP evaluate the request before weights run.
RBAC names who may invoke which model class on which data class.
DocxIntel writes per-field confidence and citation back to the source region. Originals are preserved.
Consequential AgentLab actions wait for a named approver. Nothing silent-posts to your core systems.
Immutable audit is written on the same install: who, what, which model, which policy, outcome.
Apache 2.0 and MIT weights only. Licence text and an SBOM ship on disk per release.

The paid proof of value

Thirty to forty-five days. Fixed fee. In the customer environment. One document type. Agreed real volume. Success criteria and conversion price agreed in writing before starting. If it misses the threshold, the customer keeps the report and owes nothing further.

This is not a free trial and not a sandbox that pretends to be residency. The cable can be pulled. The packs are yours.

Key specs

Deployment: Bank tenancy / Air-gapped
Egress: Zero confidential data egress
Audit: Immutable local log

Deploy in your perimeter

Talk to an engineer about air-gapped, on-prem or single-tenant deployment for this workflow.

Start with one pack type the supervisor already cares about.

A paid proof of value, 30 to 45 days, on one document type in your own environment. Success criteria agreed in writing before we begin.

Start a paid proof of value

The full stack on one machine, disconnected from the network.

In your office, on your documents, with the cable pulled out. No competitor's sales engineer can do this.

Start a conversation