Compliance officers
AI tools that send client data to unknown places, with no record of what they did, are a supervision problem. Keystile puts every AI action through your firm’s policies first.
What you can show an examiner
Section titled “What you can show an examiner”| Question | Where the answer is |
|---|---|
| What can AI tools do here, and who decided? | The rules and tool policy on the Policies screen, and the record of who proposed and approved each change |
| Does a person approve anything sensitive? | Approvals: held actions and who decided each |
| What did the AI actually do? | The signed record, exportable as a spreadsheet; Verify the record proves it was not altered |
| Where does client data go? | Your connected apps only. Client identifiers are masked or stopped before they reach an AI tool |
| Can staff use AI outside these controls with firm data? | AI tools reach firm apps only through Keystile’s one central key; nobody gives an AI tool an app password |
| Where is Keystile hosted? | On your firm’s own servers or in your own cloud account, if you choose |
Controls you set
Section titled “Controls you set”- Rules in plain English, judged by meaning, not keywords (Rules).
- Exact limits: payment caps, recipient allowlists, “a person approves every time” (Tool limits).
- Four eyes on every policy change: one person proposes, a different person approves.
- Tasks: an agent works on one client’s matter with only the actions that job needs (Tasks).
- Protection level: Keystile Fortress applies both the fixed checks and Keystile Intelligence (Levels).
Before you turn it on
Section titled “Before you turn it on”Use Replay on a few weeks of past agent logs, or run Shadow mode beside one workflow, to see exactly what would have been held or stopped — and the false alarms — before anything is enforced.
Your weekly review
Section titled “Your weekly review”On the console’s Activity tab, filter by held or stopped and the last 7 days to see every decision with its rule and, for held actions, who approved or rejected it. Export it as a spreadsheet for your files. Filter by an app such as LinkedIn or YouTube to see every public post and who approved it.