Compliance Support.
QUORUM provides controls and evidence that support a financial institution's own regulatory obligations. It does not make an institution compliant, and it holds no certifications. The institution remains accountable for its decisions and its deployment.
01 // Data Handling
Minimisation & Isolation
QUORUM runs inside the institution's own environment. Decision records hold a digest of the inputs rather than the inputs themselves, and cards and accounts are identified by an institution-scoped HMAC, never the raw number. Card data that must be kept is encrypted with AES-256-GCM.
Each request is scoped to one institution, and PostgreSQL row-level security policies separate institutions' data in shared tables.
02 // Audit Evidence
Provable Decision Records
Every decision is recorded before it is returned and sealed into a hash-chained ledger signed with Ed25519 and ML-DSA-65. Merkle proofs let an examiner confirm a specific decision is in the ledger without receiving the whole history, and a zero-knowledge proof can show a score was within policy bounds without disclosing it.
The ledger is tamper-evident, not immutable: it is stored in PostgreSQL, and any change to an anchored entry is detectable without trusting QUORUM.
03 // How QUORUM Relates to Common Frameworks
OSFI B-10
On-premise deployment supports the institution's own third-party risk management. The institution remains accountable.
Model risk (OSFI E-23, SR 11-7)
Rules start in shadow mode and are promoted by an operator; AI output is evidence for review, not an unchecked verdict. Validation is the institution's process; QUORUM provides records to support it.
PIPEDA / GDPR
Data minimisation in decision records. Data-processing terms are agreed with each customer. Retention periods are set by the institution; there is no automated erasure pipeline.
Explanations (EU AI Act Art. 86, FCRA/ECOA)
Signed counterfactual certificates and rationales are supporting evidence for explanation obligations. They are not, by themselves, a compliance determination.
FINTRAC & FinCEN reporting
High-risk blocks open draft STR/SAR cases. Reports are built in FINTRAC STR JSON or FinCEN SARX XML and validated against the regulators' published schemas; a second person must approve. Nothing is filed automatically. Not yet exercised in the regulators' test environments.
PCI DSS
Card numbers are not stored in decision records (institution-scoped HMACs only). Scope depends on how the institution deploys QUORUM.
04 // Access Controls
Role-based operator access with WebAuthn step-up for privileged actions. Sensitive actions such as rule promotion and user reinstatement can require a FROST threshold approval naming the exact action, used once.
05 // Retention
Retention periods are configured by each institution under its own obligations. QUORUM does not claim a built-in multi-year archive.
06 // Assurance Status
No SOC 2 report or other certification exists today. An independent penetration test, cryptographic review and SOC 2 are planned.
Institutional Diligence
Institutions evaluating QUORUM can request the platform architecture (QRM-ARCH-001 Rev 2.0), the technical and cryptographic assurance dossier, and the software bill of materials under NDA.
Request Diligence Materials