Security and trust
The JDAI way.
Trust is the product. A bank's land, a bank's numbers and, one day, its customers: JDAI is built so every figure can be checked, every outward step has a person's approval, and the bank's data stays the bank's.
01Built in from the first day
Seven rules. Never bent.
01Truth
Every figure shows where it came from.
Each number carries a mark for how sure we are, and its source: a document, a dataset, a person's assumption or an engine. Unknown is shown as unknown, never as zero.
✓ verified, ◉ measured, ◇ assumed, ◐ modelled, ▨ illustrative, ○ unknown
02Numbers
Code draws every number.
AI models never calculate or invent a figure. Cost, returns, loans and areas come from tested engines that give the same answer every time.
03Approval
AI drafts. People decide.
Anything that leaves the bank, moves money, changes a loan or deletes a record needs a named person's approval, and the server checks it, not only the screen.
04Data
The bank's data stays the bank's.
Everything sits behind sign-in and roles. The database itself keeps each organisation to its own rows, and reads run as the signed-in person: JDAI holds no master key.
05AI
One door for every AI call.
Each call goes through one gateway that records a receipt of what it cost and stops at a monthly limit. If it can't check the limit, it stops.
06Documents
Text in a document is data, never an order.
A deed, a memo or a web page can't instruct JDAI. Its words are read as content, and each AI task may use only the tools it was given.
07Vendors
Every outside service is on a register.
Each service is listed with the most sensitive kind of data it may ever receive. The code is checked against the register, and anything missing fails the check.
02Where we are, honestly
Patience, young platform.
A preview today; approval before live use. Nothing goes live with real customers until the bank and its regulator approve it.
Today
- A private preview on the bank's own data, behind sign-in.
- The bank's private records sit sealed, read only by approvers.
- A buyer's details come in only when they choose to talk to the bank, with their consent, kept apart from what they want.
- A demonstration sign-in that opens only the demo data, and personal logins for anything saved.
- Secrets live only in the hosting settings, never in the code.
Before live use
- The bank's IT and the Bank of the Lao PDR approve the hosting and every outside service, as banking law asks (Law on Commercial Banks, Article 55).
- Hosting in an approved region, with the code ready to move.
- Sign-in through the bank's own directory, with a second factor.
- Audit logs kept and shipped, and records kept as long as the law asks.
- Customer data only with the customer's consent, as Lao data law asks.
03In the marketplace
The shop window, kept honest.
The marketplace is the one part of JDAI anyone can open. These are the rules that keep it truthful and keep people's privacy.
Checked before it's public.
Every listing passes JDAI's checks before it goes live, code first and AI second. Nothing publishes on a check that didn't run.
The stockroom stays shut.
A public listing is built field by field from an allowlist, and a test reads every listing to prove the bank's own figures never appear.
Reported, fixed or taken down.
Anyone can report a listing. The President or an executive can take one down at once, and nothing is deleted.
Counts, never people.
The marketplace is counted for the President with no cookie, no address and no id. A browser that asks not to be tracked sends nothing.
A buyer's login opens nothing of the bank's.
Buyers who sign in to talk to the bank belong to no bank, and a database test proves they can read none of its tables.
How a listing gets from the bank's books to the window, check by check.
See the checks
04Pre-flight
Pre-flight, every flight.
Before any change can join the platform, a machine runs these checks. If one fails, the change waits on the launch pad.
- Screens reach data only through one service layer
- AI only through one gateway, with a receipt beside every call
- Every package, secret and outside host on the vendor register
- Database changes only add: no drops, no deletes, row protection never switched off
- Row protection tested on a fresh database
- Every engine matches its fixed answers
- Every test passes, with zero lint errors
05Found something?
Found a crack in the hull? Tell us first.
If you think you have found a weakness in JDAI, please tell us before anyone else, and give us time to fix it. We will thank you and tell you what we changed.
Contact us