Enforced data protection and audit evidence for
Banks, payment platforms, and trading firms operate under the heaviest regulatory burden in any sector, where a single customer data point reaching an external LLM is a GDPR Article 5 and PCI DSS event. Igris enforces data protection at the gateway, produces MiFID II, BSA/AML, and GDPR audit evidence automatically, and keeps cost under control across every AI workload.
Trade Desk AI Assistant
A trading desk that runs an AI assistant for market summaries and research briefings is solving a real productivity problem. Traders move faster when the AI synthesizes overnight news, earnings releases, and analyst notes into a morning briefing. The risk arrives the moment the assistant becomes genuinely useful: trader prompts drift toward their actual working context, and that context includes customer positions, portfolio sizes, and account identifiers. One prompt containing a client's portfolio data reaching an external LLM provider is not an edge case — it is a MiFID II personal data breach, a GDPR Article 5 data minimization violation, and an immediate compliance escalation. Most trading desks running AI assistants today have no enforceable layer between the trader's input and the LLM provider. Policy documents describe what should happen. Nothing enforces it.
Igris Guard sits between the trading desk assistant and the LLM provider, scanning every prompt before it leaves the network. PII redaction policies strip account numbers, client names, and portfolio identifiers automatically — before the call is made, not after the data has already moved. Content guard policies deny outright any prompt that contains a financial account identifier that slipped past redaction, with the full context of the denial logged. Igris Lens records every interaction with its timestamp, model, and policy outcome, giving the compliance team a queryable audit trail they can produce during a MiFID II examination, a GDPR Article 28 data processor review, or an internal audit — without asking the trading desk to reconstruct anything from memory.
Traders get the productivity of an AI assistant without creating a regulatory exposure. The compliance team gets a clean, timestamped record of every interaction, ready for regulatory examination without reconstruction. When a MiFID II examiner asks how customer portfolio data is protected when traders use AI tools, the answer is a governance log — not a policy document describing intent, but evidence of what was enforced on every call.
Fraud Detection LLM Pipeline
Fraud teams using LLMs to analyze transaction patterns are not operating a chatbot — they are running a pipeline. Pipelines routinely exceed one hundred thousand calls in a single day, and two structural problems appear at that scale that are invisible until they become expensive. First, a runaway pipeline — triggered by a new fraud pattern, a model timeout, or a misconfigured retry loop — can generate ten times its normal call volume before anyone notices. The billing event arrives before the operational alert does. Second, running high-volume batch workloads on premium inference models when economical models produce identical results for pattern-matching tasks is waste that compounds daily. Neither problem is visible at the model layer. Both require enforcement at the gateway. Fraud losses in financial services reached $12.5 billion in 2024, up 25 percent over 2023.
Igris Lens provides real-time cost visibility across the entire fraud pipeline — request volume, token consumption, and spend per model — updated continuously. Cost anomaly detection raises an alert the moment the pipeline breaks its expected parameters. Rate limiting on the pipeline's connection prevents any single workload from consuming beyond its defined allocation. Per-model cost tracking gives the operations team the data to route batch classification workloads to economical models and reserve premium inference for the transaction patterns that genuinely require it. Igris Guard adds prompt inspection to the pipeline, ensuring that customer PII is not accidentally included in fraud analysis prompts — a BSA/AML examination requirement structurally impossible to verify without gateway-layer logging.
A pipeline running at one hundred thousand calls a day stays within its cost envelope because the anomaly alert fires before the invoice does. Model spend is deliberately allocated, not accidentally accumulated. The audit trail records every call, every model, and every policy action — the documented evidence that the fraud detection process was governed end to end, exactly what a BSA/AML examination artifact requires.
Retail Banking Customer Chatbot
When a retail bank launches an AI chatbot for customer support, customers type account numbers, social security numbers, PINs, and full date-of-birth combinations into chat windows because they are trying to get help and that is the information they have in front of them. Some paste entire pages of statement data. If that data reaches an external LLM provider's API without redaction, the bank faces a PCI DSS scope event for any card data present, a GDPR Article 5 breach for EU customers, and a DPDP Act 2023 breach for Indian customers — simultaneously, with every conversation that contains a card number or national identity reference. Most banks have no technical control between what the customer types and what the LLM receives.
Igris Guard deploys PII detectors on the chatbot's connection that inspect both inbound messages from customers and outbound responses from the LLM before either crosses the governance boundary. Account numbers, social security numbers, PINs, payment card numbers, and date-of-birth patterns are redacted automatically — not flagged for manual review after the fact, redacted at the point of transmission. Token limits on the connection prevent customers from pasting large document blocks into the chat. Encrypted body logs with a configurable retention window give the compliance team a time-bounded audit record with permanent deletion enforced when the window closes. Igris Lens surfaces redaction event volume in the compliance dashboard so teams can see exactly how often customers are sending sensitive data and what categories are appearing.
Customer data stays inside the bank's governance perimeter regardless of what the customer types. The LLM receives a clean, anonymized prompt. The compliance team holds a documented, time-bounded audit record that satisfies PCI DSS logging requirements, GDPR Article 5 data minimization principles, and DPDP Act obligations for Indian customer data. When the PCI QSA asks how cardholder data is handled in the AI channel, the bank produces the governance log — evidence of what was enforced on every single call.
Regulatory Reporting Automation
Compliance teams under pressure to accelerate report production are turning to LLMs to draft initial versions of regulatory submissions. This creates one critical requirement: the ability to prove, on demand, that no customer data was included in any prompt sent to an external provider. Regulators under GDPR, the EU AI Act, and India's DPDP Act are increasingly asking not just what the report says but how it was produced. Without governance at the prompt layer, the compliance team has a productivity tool and a liability with no clear boundary between them — and no way to produce the evidence that separates the two until an examiner is already in the room.
Igris Guard applies PII redaction policies to every prompt the compliance workflow sends before it reaches the LLM, stripping customer-level data automatically. The Igris audit trail creates an immutable, timestamped record of every LLM call in the reporting workflow: which model was used, which connection it routed through, which policy was applied, and whether any data was detected and redacted. Igris Lens generates scheduled PDF summary reports that give the compliance team a clean monthly record of all LLM activity — a document they can file with internal audit, submit as evidence in a GDPR Article 28 data processor review, or present to a regulator. For EU-regulated institutions, the Lens audit export directly supports EU AI Act Article 13 transparency documentation requirements.
The compliance team gets the speed of LLM-assisted drafting with a governance record that satisfies regulators. The audit trail is created at the time of each call, by the governance layer, automatically. When an examiner asks for evidence that customer data was protected throughout the reporting process, the answer is a timestamped PDF report generated from immutable logs.
KYC and AML Onboarding Agent
KYC and AML onboarding is one of the most document-intensive processes in banking, and LLMs are increasingly deployed to extract, classify, and cross-reference information from identity documents, income proofs, and transaction histories at scale. Every document an LLM agent processes by routing to an external provider is a transmission of some of the most sensitive personal data a customer will ever hand over — passport numbers, national identity card numbers, tax identification numbers, and source-of-funds documentation. Under GDPR Article 9, DPDP Act 2023 provisions for sensitive personal data in India, and BSA/AML examination standards that require a documented audit trail for every onboarding decision, the question is not whether this data should be governed — it is whether you can prove it was.
Igris Sentinel governs every tool call the KYC onboarding agent makes, enforcing an allowlist of permitted actions so the agent cannot access document repositories or external services outside its defined operational scope. Igris Guard applies PII and sensitive document detection to every prompt before it reaches the LLM, redacting passport numbers, national ID references, and tax identifiers not required for the specific inference task. The full audit trail records every agent action, every document accessed, every tool call made, and every policy enforcement event, creating the BSA/AML examination artifact the compliance team needs without manual log assembly.
KYC document processing scales with AI without creating a personal data transmission event on every call. The audit trail satisfies BSA/AML examiners, GDPR Article 9 special-category data requirements, and DPDP Act obligations simultaneously — evidence that the agent accessed only what it needed, took only the actions it was permitted to take, and that every step was logged.
Credit Risk AI Advisor
Loan officers and underwriting teams are using LLMs to assist with credit risk analysis — synthesizing borrower profiles, flagging risk factors, and drafting decision rationales. The risk is what ends up in the prompt: income figures, credit scores, outstanding balances, employment history, and account identifiers. When that data reaches an external LLM provider without documented justification and minimization controls, the bank faces a GDPR Article 5 data minimization violation, a DPDP Act exposure for Indian borrowers, and an EU AI Act Article 9 high-risk AI system documentation gap — all arising from a productivity tool intended to help underwriters work faster.
Igris Guard applies data minimization policies to every credit analysis prompt, ensuring that only the data elements required for the specific inference task are transmitted to the LLM. PII detectors strip account numbers, national identity references, and precise income figures not necessary for a generalized risk assessment. The immutable audit trail documents what data was sent, what was redacted, which model was used, and which policy was applied for every credit decision interaction — directly supporting GDPR Article 22 explainability requirements and EU AI Act Article 9 high-risk AI system documentation. Igris Lens generates a monthly summary of all credit AI activity for the risk committee.
Underwriters get the efficiency of AI-assisted credit analysis. The bank gets documented evidence of data minimization on every call — the paper trail that satisfies GDPR, EU AI Act, DPDP Act, and internal model governance simultaneously, assembled automatically by the governance layer.
Govern AI across every line of business
See how banks protect customer data on every prompt and produce examination-ready audit evidence for MiFID II, PCI DSS, BSA/AML, and GDPR.