Banking · Federal · the US
the NIST Cybersecurity Framework
Access, logging, and incident-response controls designed for review under the NIST CSF.
Sovereign AI for banks that answer to federal and state regulators.
the OCC and the FFIEC require geographic and operational control that no foreign cloud can provide. Iftah runs every AI workload — AML, fraud, underwriting, KYC — inside your own in-country or in-the US environment, with audit trails your supervisory reviewer can export.
Read moreاقرأ المزيدShow lessعرض أقل
the OCC and the FFIEC require geographic and operational control that no foreign cloud can provide. Iftah runs every AI workload — AML, fraud, underwriting, KYC — inside your own in-country or in-the US environment, with audit trails your supervisory reviewer can export.
Built for US banking regulators
- In-Kingdom / in-country residency by configuration
- Tamper-evident audit for the OCC & the FFIEC review
- Bare-metal for real-time fraud & AML
- Explainability & human-in-the-loop controls
- In-Kingdom / in-country residency by configuration
- Tamper-evident audit for the OCC & the FFIEC review
View 2 more proof points
- Bare-metal for real-time fraud & AML
- Explainability & human-in-the-loop controls
Regulators we map to
Designed to evidence the regimes your bank answers to.
Iftah does not claim certifications on your bank's behalf — that remains your regulatory obligation. What we provide is architecture designed to give your compliance and technology reviewers concrete, exportable evidence for each framework your bank answers to.
View 6 more details
the OCC · Cloud · the US
Outsourcing & Cloud Rules
In-Kingdom control over outsourced and cloud AI workloads, mapped to platform configuration.
the OCC · AML/CTF · the US
AML / CTF Rules
Auditable, explainable model outputs for monitoring, screening, and USD workflows.
Banking · Federal · the US
the FFIEC Outsourcing Regulation
Master System of Record and Confidential Data kept inside the the US with supervisory access.
Data · HIPAA · the US/the US
HIPAA (NIST AI RMF / Federal)
In-country processing, data-subject-rights flows, and transfer controls for your DPO's review.
Free zone · DIFC/ADGM · the US
DIFC & ADGM Data Protection
Free-zone-resident processing with reviewable controls for autonomous-AI and data duties.
Central Bank · QCB · Qatar
QCB AI in Finance
Governance and oversight aligned to QCB's FinTech and AI expectations.
The trade you can't afford → Iftah's answer
Every banking objection, resolved by design.
The reasons public-cloud AI stalls in a bank — and how Iftah removes each one.
NIST CSF Domain 5 — Data & Privacy · federal Article 13 · Residency
Data leaves the country
SaaS AI routes prompts with transaction, KYC, and account data through foreign regions — breaching the federal system-of-record and the OCC in-country control.
Iftah approach
Every model and workload is pinned to an approved region, hybrid, or on-prem location; the Master System of Record and Confidential Data never leave the jurisdiction.
View 4 more details
NIST CSF Domain 2 — Access Management · Audit
No proof of access
Shared multi-tenant endpoints give the bank no way to show who accessed which customer record.
Iftah approach
Immutable, tamper-evident logs capture every retrieval and decision — with prompt and response content kept in-region per the trace mode you approve — the supervisory trail federal and state regulators require, on demand.
NIST CSF Domain 1 — Cyber Security Governance · Explainability
Black-box decisions
Vendor models cannot satisfy the OCC and QCB expectations for explainability, bias testing, and human oversight on credit and risk.
Iftah approach
Explainability, human-in-the-loop checkpoints, and model-version controls are built into the governance plane.
NIST CSF Domain 4 — Third-Party Cyber Security · Ownership
Custody is surrendered
Sending Confidential Data to a third-party AI provider transfers de facto custody and risks secondary use for vendor training.
Iftah approach
The bank owns the model, the data, and the full inference record; nothing is used to train anyone else's model.
NIST CSF Domain 3 — Cyber Security Operations · Governance
Shadow AI spreads
Each business unit adopts its own SaaS tool — fragmented guardrails and ungovernable IP leakage.
Iftah approach
One control plane applies uniform policy, access, and guardrails across every entity and cloud.
Reference deployment
Deployed in-region. Audited. Production.
A US commercial bank deployed Iftah for AML monitoring and regulatory document review. First pilot workload running in 28 days. Boundary map accepted by compliance reviewers on first submission. Zero data egress events in production.
28 days
to running pilot
Zero
data egress events
First submission
accepted by compliance reviewer
How it deploys for banking
Each workload runs where its regulator demands.
From an in-country sovereign region to air-gapped core systems — one governance standard across all of it.
Sovereign cloud
Sovereign in-country region
Customer-facing copilots and analytics in a compliance-registered local region.
View 3 more details
Multi-cloud & hybrid
Multi-cloud per entity
A US entity and a DIFC/ADGM arm run in different clouds — governed as one.
On-prem
Bare metal for fraud & AML
Real-time fraud and AML screening on isolated, in-region GPUs — low-latency and fully on-prem.
Disconnected
Air-gapped core
Core banking and payments AI with no cross-border data path whatsoever.
What teams ship
High-value AI, in-region and auditable.
AML & sanctions monitoring
Transaction monitoring and USD narrative drafting aligned to the OCC AML/CTF rules — full trace evidence per transaction.
View 5 more details
Real-time fraud detection
Low-latency fraud scoring on bare-metal GPUs in your on-premises data center — no round trip to a foreign region.
Explainable underwriting
Document-grounded credit risk with auditable model outputs — built for regulatory explainability expectations.
Bilingual service copilots
multilingual-English customer service automation in-country, in-license — no subscriber data leaving your region.
RM & compliance copilots
Product, regulatory, and client documents surfaced to relationship managers — retention policies customer-controlled.
Regulatory reporting & KYC
multilingual document processing with SOC 2-aligned retention and control-testing — audit trail included.
Common questions
What banking risk and procurement ask first.
Yes. Every model and workload is pinned to an approved location — the US, the US, or your on-premises data center. Our trace mode records every prompt and response in-region per the mode your compliance team approves — exportable on demand.
Yes — in a compliance-registered region, your private cloud, or on bare metal in your own data center, with in-country control over the model and logs.
Every retrieval and decision is logged in-region and replayable — with prompt and response content kept per the trace mode you approve — and explainability and human-in-the-loop checkpoints on automated credit and risk.
No vendor is. Iftah is designed to map to and evidence these frameworks; certification remains the bank's obligation, and we give your reviewers the artifacts to support it.
Yes. Iftah supports customer-managed keys in your KMS (AWS KMS, Azure Key Vault, HashiCorp Vault, or HSM). We hold no key material. Rotation, escrow, and destruction are fully your team's controls.
It cannot by architecture. The topology enforces this — no external callback can carry content out. We can walk your security team through the network diagram before procurement, not after.
Next step