Technical · CIO, CISO, DPO
What your CIO, your CISO and your DPO want to know.
Integration, AI, guardrails, data, audit, hosting, access and compliance. Each item shows its actual status today: available, in progress or target.
Available: built and demonstrable on Banque Huit, our demo bank. In progress: partly built or being fixed. Target: planned, not yet built or enabled. Fact: a statement about the current state, not a status and not counted.
Status in November 2026 · 30 available · 22 in progress · 16 target (table rows, excluding the flow diagram)
Three steps, without touching your core banking system.
BRAIU analyses your customers' transactions and derives indicators and explained predictions. Each team finds them in the solution built for it.
Diagram: BRAIU analyses the bank's transactions once; two shared capabilities, seeing what's coming and asking questions; three solutions: OS for marketing, Advisor for the branch network, API for the bank's customers and tools.
Your data, analysed once for the whole bankYour customers' transactions, updated with every new data delivery: indicators, habits, predictions.
- PredictSee what is likely to happen
- Ask questionsAsk a question, get an answer with your figures
- BRAIU OSfor marketing
- know what to offer, and to whom
- act at the right time
- track your commercial goals
- BRAIU Advisorfor the branch network
- know who to call today
- understand the customer in two sentences
- prepare every meeting
- BRAIU APIfor your customers and your tools
- savings goals in your app
- suggestions explained to the customer
- our calculations in your tools
You send your data.
Three files in a simple format, extracted by your data team: customers, accounts and transactions. We provide the data contract. A first full load, then updates.
BRAIU analyses.
BRAIU categorises the transactions, then calculates indicators and predictions for each customer and for the whole customer base. Everything is updated with every new data delivery.
The whole bank benefits.
Marketing in OS, the branch network in Advisor, your customers and your tools through the API.
1. Data flow and trust zones
The path of a piece of data, from your bank to the screens, and the status of each zone.
- Your bankavailable
Three files (customers, accounts, transactions) extracted by your data team.
- Ingestiontarget
A drop area dedicated to each bank, encrypted at rest.
- Storagein progress
Data separated per bank in the application. One database per bank: target.
- Modelsavailable
Models specific to each bank, trained and served separately.
- Pseudonymisationin progress
Direct identifiers replaced by tokens before the language model.
- Language modeltarget
Provider and hosting approved with your CISO and your DPO before any processing.
- Interfacesavailable
OS, Advisor, the API and your customers' app, behind a login.
2. Model inventory
One row per predictive model. All supervised models are trained on synthetic data today: their real accuracy will be measured on your data, during the pilot.
| Prediction | Target | Horizon | Model family | Explanation shown | Confidence level | Status |
|---|---|---|---|---|---|---|
| Churn | The customer closes the account | 90 days | Gradient boosting (classification) | The top 3 factors, in Advisor | Score from 0 to 100 in three risk levels | in progress |
| Budget difficulties | Missed payment or structural overdraft | 6 months | Gradient boosting (classification) | The top 3 factors, in Advisor | Score from 0 to 100 in three risk levels | in progress |
| Profile change | Moving from one behavioural group to another | 12 months | Markov chain between groups | None | Reliable, medium or insufficient; "reliable" requires two methods to agree | in progress |
| Life events | Moving house, marriage, buying a vehicle… observed or anticipated | Advisor: no horizon; OS overview: demo only | Rules (keywords, early signals, frequency among similar customers) | A written reason | Observed or anticipated | in progress |
| Bank balances | Total outstanding balances | 24 months | Statistical projection from similar customers | None | 80% range (coverage measured on the demo bank: 70.5%, under-covered, recalibration planned) | available |
| Savings at 10 years | The customer's cumulative savings | 10 years | Regression (gradient boosting), then a projection in three scenarios | Not shown | 80% range and a reliable, medium or insufficient level | in progress |
| Scenarios | Likely futures, simulation of a savings effort, cost of an expense | 12 months, 10 years, 1 to 5 years | Statistical | None | Ranges | available |
Rules and rankings (not predictive models)
| Prediction | Model family | Status |
|---|---|---|
| Segmentation | Grouping by financial habits (rules and statistics) | available |
| Transaction categorisation | Rules (labels, amounts, recurrence) | available |
| Brief prioritisation and next best offer | Rule-based ranking on signals and scores | available |
| Unusual transactions | Statistical rules (deviation from the customer's habits) | available |
| Suggested goal | Calculation from the usual end-of-month balance | available |
3. Integration
| Item | Status |
|---|---|
| CSV data contract: customers.csv, accounts.csv, transactions.csv. One full synchronisation, then differential (delta) synchronisations. Tested on synthetic data. | available |
| Documented REST API (OpenAPI). The specification is updated before anything is sent to your IT department. | in progress |
| API keys per bank. | available |
| Signed webhooks (HMAC-SHA256, secret specific to each subscription). | available |
| Opening Advisor from a CRM with a direct link (/c/{customer id}/{tab}): the adviser must be logged in. The id is your bank's customer number, not an opaque identifier. To be validated with your CRM during the pilot. | available |
| File transport: drop into a storage area dedicated to each bank, encrypted at rest. | target |
| Frequency: a first full load, then incremental updates, scheduled daily, weekly or monthly, or triggered on demand. Proven on synthetic data. | available |
| History recommended by the data contract: at least 3 months of transactions, ideally 12 to 36. | fact |
| Data contract (columns, types, UTF-8 encoding, update key): on request. | fact |
| API versioned in the URL (/v1). | available |
| Webhooks: each event carries a stable identifier for de-duplication. | available |
| Webhooks: automatic retries on failure. | target |
| Configurable quotas per bank: assistant messages and an AI cost cap. | available |
| General rate limit on the API. | target |
| Test environment dedicated to each bank. Today, the demo runs on Banque Huit (fictitious data). | target |
4. AI and ML
| Item | Status |
|---|---|
| Architecture principle: deterministic code decides, the LLM narrates. Amounts and indicators come from rules, predictions from ML models; the LLM writes. | available |
| Check of quoted amounts: deterministic guard on the customer assistant, verifier with deterministic fallback on the OS assistant. The Advisor copilot does not have one yet. | in progress |
| SHAP explanations per prediction for the score models (risk of leaving, budget difficulties); shown in Advisor. | available |
| Confidence levels reliable / medium / insufficient; "reliable" requires two methods to agree. | available |
| Lock that prevents promoting a model trained on synthetic data, unless an explicit, logged exemption is granted. | available |
| Controlled model promotion, validated against the model in place. | available |
| Potential revenue per opportunity. | in progress |
5. Model validation and monitoring
| Item | Status |
|---|---|
| Validation metrics (AUC, F1) computed at each training on a separate test set. On synthetic labels, they do not yet measure real accuracy. | in progress |
| Drift monitoring in service (distribution stability, confidence drop), with an alert. Never run on real data. | in progress |
| Model validation on the bank's data: within the pilot scope. The per-bank training pipeline is available; the real events to predict (leavers, missed payments) are set with you during scoping. | target |
| Current training data: entirely synthetic. | fact |
6. Fairness
| Item | Status |
|---|---|
| No sensitive data (gender, age, nationality, health) among the variables of the leaving, budget-difficulty and savings models; no exclusion list enforced by the code yet. | in progress |
| Fairness tests on protected attributes: within the pilot scope (tool available). | target |
7. Guardrails
| Item | Status |
|---|---|
| Detection of known injection patterns, tested on 9 attacks and 6 legitimate messages (FR, EN). | available |
| A filter removes IBANs, email addresses, phone, card and social security numbers from answers. On by default. | available |
| Direct identifiers (name, IBAN, email, phone, card number, SIREN/SIRET) are replaced by tokens before being sent to the language model; minimisation of other data (city, income, transaction labels) is in progress. | in progress |
| No credit promise or prescription of a regulated product: an automatic check of the answers detects such wording. | available |
| OS: minimum threshold of 50 customers. No figure is shown for a smaller group; the bank can raise this threshold. | available |
| OS: lead export open to authorised OS profiles. Every export is logged; if it cannot be logged, it is blocked; refusals are logged. | available |
| An LLM judge assesses the answers. It blocks the answer (quarantine) on three sensitive readings: the spending reading, the customer's financial profile and the OS assistant. On other answers, it observes without blocking. | in progress |
| OS: a request for names leads to the logged export. Advisor: the assistant only answers about the customer of the open record. | available |
| Flagging statements inconsistent with the accounts (for example a deposit above a cap): model behaviour observed in demos, without a dedicated check. | in progress |
| When data is missing, the assistant says so: a behaviour rule of the assistants, observed in demos, not guaranteed by a check. | in progress |
8. Data, isolation and audit
| Item | Status |
|---|---|
| One database per bank. | target |
| Sensitive access and exports are recorded in a signed audit log (HMAC-SHA256). | in progress |
| Retention period for the bank's data set with the bank during scoping (contract and DPIA). | target |
9. Infrastructure security
| Item | Status |
|---|---|
| During the pilot: data separated per bank in the application, models specific to each bank, a shared search index filtered per bank. | in progress |
| The token mapping table is held by BRAIU; it is planned in each bank's database. | in progress |
| Exchanges encrypted with TLS. | available |
| Encryption at rest of the databases (one key per bank) and files. | target |
| Daily database backups (14 to 30 days); restore tested before any real data is loaded. | target |
| Availability target and monitoring defined for production. | target |
| Penetration test before going into production. | target |
| Automated injection tests: 9 attacks and 6 legitimate messages (FR and EN), updated on 9 November 2026; a dedicated evaluation set remains to be built. | in progress |
10. Hosting
| Item | Status |
|---|---|
| Target hosting in the European Union. No production environment is deployed to date. | target |
| Hosting, the model provider and the list of sub-processors are validated with your CISO and your DPO before any processing of your data. | target |
11. Access security
| Item | Status |
|---|---|
| Single sign-on (OIDC) configurable per bank on the platform; not yet wired into the Advisor login screen. | in progress |
| Two-factor authentication that can be enabled per bank. | available |
| Roles per profile: adviser, marketing, management, bank admin, auditor. OS export is open to authorised OS profiles. | available |
12. Compliance and reversibility
| Item | Status |
|---|---|
| Export of a bank's data in an open format (JSONL, with a manifest). | available |
| GDPR: processing agreement (article 28) and data protection impact assessment (DPIA) in preparation, finalised with your DPO during scoping. | in progress |
| AI Act: qualification analysis in progress, presented to your compliance team; technical file in preparation. | in progress |
| DORA: business continuity plan in preparation; register of providers and exit plan set up with you before production. | target |
| Exit procedure, validated with you before production. | target |
Do you have a security questionnaire? We will answer it.
30 minutes to see what BRAIU can do for your bank.
Describe your context and the use case to test. We show you the three solutions on Banque Huit, our demo bank.
What happens next
- We reply by email within two business days.
- You choose a slot.
- 30-minute demo.
During these 30 minutes: OS, Advisor and the customer app on Banque Huit, our demo bank with fictitious data, then your questions on integration and security.