Four stages that come to coexist
These are not phases of a project that ends. Management runs continuously and Maintenance keeps what was built from degrading — the rule changes, the mix changes, and the threshold calibrated for December is still running in March.
Quantified risk map, prioritisation by impact and business case. A 6-to-10-week project, starting from public data.
Taxonomy, risk-control matrix, data ingestion, exception rules, policies and evidence trail. 3 to 6 months.
Continuous monitoring by exception, actionable alerts, board reporting. Subscription.
Regulatory watch, rule curation, effectiveness testing, data-quality audit and action plans. Subscription.
Four service lines, one portal
130 deterministic agents and 130 generative companions over public and internal data: heat map by risk group, appetite versus actual, findings with evidence and a business case.
Special chapter of the data and technology group: 73 agents and 25 companions over the CADOC documents, SPED and SICOR: 12 dimensions, 45 requirements, Article 9 communications and a submission protected by human decision.
Portal with an integrated dashboard, views by audience (analyst, CRO, CEO, board, committees) and authority decisions with an immutable audit trail.
Tracking of the BCB, CVM, Anvisa, ANPD, Federal Revenue and labour rules, with an impact assessment on the risk-control matrix — and the monthly Regulatory Clipping.
Generative AI never produces a number
The first layer is deterministic: rules, thresholds and reconciliations that give the same result for the same input, with a hash. The second layer is generative and exists to read, label and explain — always identified as such and never computing anything. That is what makes every finding defensible before a supervisor and in court.
same input → same result → same hash
every alert carries the rule, the data and the threshold
authority decision always named and dated
generative reading marked as a lead, never as a number
Where the client's data lives
Ypslon operates; the client receives the portal and the reports. Data in an AWS account dedicated to the client inside Ypslon's organisation.
The agents run in the client's own AWS account; Ypslon curates the criteria and maintains the catalogue.
A sealed core in an enclave with cryptographic attestation: not even Ypslon sees the data; the client sees the result and the proof that the code executed was the code audited.