GOVERNANCE & CONTROLS
The controls your regulator will ask about, built in
Every decision and configuration change is on the record, with who made it and when. Senior calls stay with senior people, and the AI recommends without ever deciding.
FOUR-EYES
A second person, where it matters most
Some calls shouldn’t rest on one person. These need two, and the server enforces it.
Monitoring reviews
When a monitoring alert opens a review, one person records the verdict and a different person closes it. A confirmed match re-scores the customer, and by default a higher risk band goes to your MLRO.
Lift and above. Switched on in your settings, with four-eyes on by default.
AI-drafted risk models
A risk model the AI drafts can’t go live until someone other than the person who submitted it approves it. No setting turns this off, and no AI tool can approve one.
How policy set-up works →Risk band overrides
An analyst proposes a different risk band with a rationale, and an MLRO who isn’t the proposer approves or rejects it, with a note.
SENIOR SIGN-OFF
Senior calls stay with senior people
Escalate to your MLRO
An analyst can escalate a case to your MLRO or senior management. They’re emailed, and their recommendation is recorded on the case.
Waiving EDD requirements
Waiving an enhanced due diligence requirement, or lifting a waiver, needs your MLRO or someone more senior.
Lift and above.
Rules and risk models
Switching a decision policy on, or changing your risk model by hand, needs one of your admins.
Cruise and above.
THE RECORD
A record your regulator can follow
Who decided what, when and why, kept with the case and ready to export.
Every decision
Approvals and declines are recorded with who made them, when and their notes. A decision made by one of your rules says so.
Escalations and owners
Each escalation, your MLRO’s recommendation and every change of case owner stay on the case.
Status changes, with the reason
Move a case by hand and you give a reason, which is kept, encrypted, with the case.
Configuration changes
Who changed your compliance configuration, when, and the values before and after. Your admins review them in Compliance Configuration.
Case PDF and audit export
Download any case as a PDF, on every plan. On Cruise and above, download your configuration changes, and the last year of the platform audit log, as CSV.
AI-drafted settings, kept five years
Where each setting came from, who confirmed it and who approved the model, kept for five years, even after you leave.
AI UNDER YOUR CONTROL
The AI recommends. It never decides.
It recommends; it never decides
AI review reads the case and recommends approve, refer or decline, with a memo for your analyst. A person approves or declines, or one of your decision rules does, and the record says which.
AI review: Cruise and above.
Switch it off
Your admins can switch off each AI feature that runs on its own, from reading documents to AI review, or all of them at once. Each change is logged with who made it and the value before.
Others, such as a monitoring brief, run only when someone asks for one.
Off until you opt in
Connecting AI tools such as Claude and ChatGPT, and having the AI draft your risk model, stay off until you choose to use them.
Both are in early access.
DATA RIGHTS
Personal data, person by person
Data subject requests
At your MLRO’s request, we export everything held on one person, or erase them across every case while keeping the records the law requires. Each request is logged.
Retention
Your case records stay in your workspace for as long as you’re a customer. If you leave, you keep download-only access for 12 months, and then your case data is deleted.
Zero retention, on request
Once a case’s final decision has reached your systems by webhook, its personal data is deleted. The decision and the screening record stay.
SECURITY
Encrypted, isolated and open to review
Encrypted, field by field
Dates of birth, identity numbers, document extracts, notes and check results are encrypted with AES-256-GCM before they reach the database.
Each tenant kept apart
Every request is scoped to your workspace. Asking for another workspace’s data returns not found.
Trust Center
Our security controls, policies and documents are in our Trust Center. We are preparing for a SOC 2 Type II audit.
Visit the Trust Center →FAQ
Questions about governance
- Can the AI approve or decline a customer?
- No. AI review recommends approve, refer or decline, with a memo for your analyst, and nothing decides from it. A case is approved or declined by a person, or by one of your decision rules, and the record says which.
- What needs a second person’s sign-off?
- Closing a monitoring review case (Lift and above), while four-eyes is on, as it is by default, and approving a risk model the AI drafted, which is in early access. Risk band overrides that need a second person are coming with the new case view.
- Can we export the audit trail?
- Any case downloads as a PDF, on every plan. On Cruise and above, your admins can also download your configuration changes and the platform audit log as CSV.
- How do you handle a data subject access request?
- Your MLRO asks us, and we export everything held on that person, or erase them across every case while keeping the records the law requires. Each request is logged.
- Is First Mile Labs SOC 2 certified?
- Not yet. We are preparing for a SOC 2 Type II audit. Our Trust Center shows the controls in place today.
See the record a case leaves behind
We’ll walk a case from application to decision and show you what your regulator would see.