AI governance

Our agent is governed the way we ask you to govern payments.

Every figure evidenced. Every decision logged. A person approves every payment. SwapEazi is aligned with the NIST AI Risk Management Framework and its Generative AI Profile, NIST AI 600-1, and builds to EU AI Act Articles 12 and 14: logged decisions and human oversight.

What the AI does

One job: read the payment. Never compute it.

The model reads what you wrote into four fields: the currency you pay from, the currency that lands, the amount and the date. Every number after that comes from the pricing engine, from dated evidence, with a Rate Receipt. A figure the model returns that is not written in your words is dropped.

Your words are data: Hidden HTML and markdown, invisible characters and anything that tries to speak as the system are removed before the model reads a line. The model fills a closed schema and nothing else.
Personal data stays here: Names, IBANs, account and card numbers, wallet addresses, e-mail addresses, phone numbers and IP addresses are masked before any text goes to an outside model.
Strict input: A request that is not exactly the shape we take is refused at once, with the field named, before any model is asked.
Unsupported means refused: A corridor we do not cover is refused by name. We never guess an intermediary route.

What a person always decides

A person approves every payment.

The agent prepares; a named person approves; your own bank, provider or wallet moves the money. The agent cannot approve for anyone, and these gates take a payment out of its hands entirely.

Low confidence: Confidence comes from the evidence: its type (a live quote, an observed price, a published price, an estimate), how fresh the reference is, and how many routes agree. Below 70 out of 100, a person approves. 90 and above is high.
Large payments: Above your organisation's own limit, a person approves. Above your upper limit, the agent stops.
High-risk and sanctioned corridors: A high-risk corridor goes to a person. A sanctioned one is refused before it is read.
Price outliers: A price more than 1.5% from the benchmark for that payment, or one that lands more than the reference rate itself, goes to a person.

What is logged

Every run, append-only, chained and replayable.

Each run of the agent is one entry in a hash-chained log: an edit anywhere shows where the chain broke. Any past decision can be re-run from its logged inputs and must give the same output.

In every entry: A request id, a keyed hash of who asked, the time in UTC, the request with personal data masked, the model and prompt version with its settings, every tool call with its inputs and outputs, the confidence and gate results, and the output shown. 11 required fields, held by a test.
Never logged: Hidden reasoning. The model is not asked for any, and none is kept.
Payment runs: Every change to a payment run, from prepared to approved, released and reconciled, is one entry in your organisation's own chained log.

Measured

The eval suite, run on this deployment.

66 distinct prompt injection attacks, malformed currencies, IBANs and BIC or SWIFT codes, masking and the reader's schema. The same suite runs before every release, with a model that obeys each attack, 50 readings and 50 priced payouts against the engine, and a full audit-log replay. Live figures at /api/v1/governance.

Prompt injection attacks blocked: 66 of 66 (100%).
Ordinary payment lines left untouched: 10 of 10 (100%).
Personal data masked before the model: 14 of 14 (100%).
Malformed currencies, IBANs, BICs and requests refused: 51 of 51 (100%).
No figure the model could compute: 5 of 5 (100%).

Frameworks

Aligned with NIST AI RMF and NIST AI 600-1.

Govern: Who decides what is written down and enforced in code. Every tool the agent holds reads, prepares or records; none executes.
Map: One model with one job, reading untrusted text from invoices, e-mails and payers. Its risks are named and each has a control.
Measure: The eval suite before every release and live on this deployment; evidence-based confidence and outlier tests on every figure.
Manage: Gates send a payment to a person; unsupported and sanctioned corridors are refused; every run is logged, chained and replayable.
NIST AI 600-1 risks: Confabulation (no figure from a model, unknown stays unknown); information integrity (every figure with its evidence); information security (injection removed, closed schema, no execute rights); data privacy (masking); human-AI configuration (a person approves every payment).
EU AI Act: Art. 12: automatic, tamper-evident logs of every decision. Art. 14: a named person oversees and approves, and can refuse any payment.

What is never done

The lines the agent does not cross.

Money: SwapEazi never holds or moves money, and never signs or sends a transaction.
Approval: The agent never approves a payment for a person.
Figures: A model never computes a rate, a cost or a landed amount.
Guesses: No route is invented for a corridor we do not cover.

Before the money moves

Governed by design. Evidenced by default.

Route a payment and see the evidence behind each figure, or read what the October security review covered.

Ask about your next payment Security review, Oct 2026