Security and release status
Engineering baseline only. No compliance certification, sovereign deployment validation or model fine-tuning is claimed.
Identity
Verified Entra access tokens and signed data privileges are required.
Data access
Uploaded documents and jobs are private to their tenant and document owner.
Processing
Bounded text/PDF/Office uploads use customer Azure services. Durable jobs and publication checks hide unacknowledged or quarantined chunks.
Azure retrieval
Keyword search, optional hybrid vectors and semantic reranking preserve tenant/owner filters. Customer indexes and deployments require configuration and validation.
Evidence checks
Analysis and chat withhold model output until source IDs and exact quotations pass code checks. Conclusions still require human review.
Microsoft Prompt Shields
Production model use requires complete customer Azure Content Safety assessments. Detected attacks and safety-service failures block inference. Cloud validation is pending.
BFSI specialist workflow
Chat routes to two or three of 14 specialist playbooks, then evidence review and synthesis. Five model calls maximum; review findings remain visible. These use the same customer Azure deployment.
Agent limits
Two specialists run concurrently, with a 90-second deadline and per-principal admission control. Invalid evidence or failed reviewers withhold output; no tools or regulated decision execution are enabled.
Browser workspace
Microsoft login uses an in-memory token cache. Private uploads, job status, customer BYOD imports and source/reviewer inspection are implemented; customer tenant configuration remains required.
Audit archive
Production results require confirmed locked retention in a customer archive. Institution-approved record schedules, legal holds and regulator export remain required.
Provider boundary
No bundled vendor API credentials or external research connections. Customer Azure adapters require separate authorization.
Remaining deployment work
Actual Entra login, private networking, resource ownership/processing geography, Defender automation, locked retention, recovery and independent validation need customer Azure evidence.
Regulatory review
US banking/securities first, then US insurance/healthcare, EU/UK and other jurisdictions. Applicability and evidence must be reviewed for each institution.