Security at Consortium AI

Consortium AI handles the most sensitive workflow a bank has: deciding which transactions a human must see, and what may be shared beyond the institution. Everything below is a property of the running system — enforced in code, observable in the audit trail, and verifiable from the outside where noted.

The gate fails safe, never open

The confidence gate is a pure function with no configuration path that weakens it. Every critical field must individually meet the workspace threshold. A missing confidence score is treated as 0.0 and fails. The document-level overall confidence score is never consulted, so a high overall score cannot mask a failing field. An invalid or out-of-range stored threshold is ignored in favor of the strict default — a corrupted row can never relax the gate.

Identities leave only as hashes

Supplier identity, buyer identity, and invoice number cross the node boundary exclusively as SHA-256 hashes. This is enforced at the receiving API, not just promised by the sender: the consortium inbox rejects any payload containing raw identifying fields with an explicit raw_identity_rejected error. Member banks match risk signals — the same supplier surfacing at two institutions — without either bank learning who the counterparty is. Amount, currency, and issue date stay clear for risk scoring; signal matching runs strictly against your own transactions, and reveals only the counterpart node id and the clear risk fields.

Tenant isolation is enforced by the database

Every workspace is isolated with Postgres row-level security: the session a user holds physically cannot read another workspace's rows, regardless of any application bug above it. The service-role credential that bypasses row security exists only on the server and is never importable by client code. Reviewer accounts linked to an external login receive read-only visibility into exactly the queue they review — minimum disclosure, enforced as policy.

The audit trail cannot be edited

Every state change — gating decision, review decision, consortium submission, threshold change — appends an event to an audit trail that only the server may write and nothing may rewrite. Review decisions require a registered, active reviewer; decisions made by an authenticated reviewer login are recorded as such (identity: authenticated, with the acting email), so every entry answers who, what, and when to a regulator's standard.

AI is treated as untrusted input and untrusted output

Document text entering an AI model is delimited in unique sentinels and labeled as data, with the rules restated inside the prompt — text inside a document cannot rewrite the extraction rules. Input is hard-capped in length. On the way out, model output is defensively normalized (types checked, enums whitelisted, numbers clamped) and then re-gated exactly like manual input. The model can never grant itself auto-approval, and every persisted AI output is stamped with the model that produced it.

Platform hardening

Defense in depth, verifiable from outside: pages are gated by middleware with an explicit public allowlist, and every API route independently re-verifies the session — an unauthenticated call to a protected endpoint answers 401 even if a proxy misroutes it. All responses carry a content-security policy with frame-ancestors 'none' and object-src 'none', plus X-Content-Type-Options: nosniff, X-Frame-Options: DENY, a strict referrer policy, and a permissions policy disabling camera, microphone, and geolocation. Billing webhooks are signature-verified before a byte of payload is read, and the webhook is the only writer of paid state. Expensive endpoints are rate-limited per user per day, with usage metered in the same table the admin console audits.

No central data lake

The consortium is point-to-point: two bank nodes wire together by exchanging an inbox key, and each node keeps its own signal store. There is no third party aggregating member data, and nothing to breach that holds every bank's customers at once.

Responsible disclosure

Found something? Write to abuahmad105116@gmail.com and we will respond promptly. See also our privacy policy and terms.