Security & Governance
Information about the approach BankRegX takes to security, data handling, AI governance and service resilience.
BankRegX is an independent AI control intelligence project designed to support auditors, compliance professionals and control teams. Responsible use, evidence discipline and transparent professional judgement are central to the way the service is developed.
Evidence-led
BankRegX aims to distinguish established information from assumptions and professional judgement.
Governed methodology
Expert methodology is managed through a controlled review and approval process.
Traceable assessments
Assessment records can retain information about methodology and sources used.
Security approach
BankRegX is designed with separation between public functionality and private administrative capabilities.
Administrative access
Private methodology and review functions are separated from the normal public user experience and protected through authenticated administrative access.
Server-side credentials
Sensitive service credentials and application secrets are handled through server-side environment configuration rather than being intentionally exposed in the public user interface.
Restricted operations
Sensitive database and administrative operations are performed through server-side application services rather than direct public access.
Change governance
Changes to BankRegX expert methodology follow a governed workflow rather than allowing user feedback to directly alter approved methodology.
Data handling
BankRegX processes information needed to provide assessments, maintain service functionality and improve the quality of its control intelligence.
User queries
Questions submitted to BankRegX may be retained together with the resulting assessment and relevant service metadata.
Assessment information
Assessment records may include methodology references, source information and technical metadata used to support traceability.
Purpose
Retained information may support service operation, quality review, methodology evaluation and understanding how the service is used.
Sensitive information
Users should avoid submitting unnecessary personal, confidential or highly sensitive information unless an appropriate arrangement has been established.
BankRegX is intended to support professional analysis. Users remain responsible for determining whether information is appropriate to submit to the service.
AI governance
BankRegX is designed to support professional judgement rather than replace accountable decision-making.
Facts and judgement
The BankRegX methodology seeks to distinguish known information, information not provided, assumptions and professional judgement.
Risk-based assessment
Control assessments consider whether a control mechanism is capable of mitigating the relevant risk rather than relying only on checklist completion.
Approved methodology
Professional guidance can be reviewed, versioned and approved before becoming part of the methodology used by BankRegX.
Human review
Feedback and proposed methodology changes are subject to review rather than automatically becoming approved intelligence.
Traceability
BankRegX can retain the methodology references associated with an assessment so that the basis of the analysis can be understood later.
Source discipline
Regulatory analysis should distinguish what an authoritative source actually says from the judgement applied to that information.
Regulatory publication
BankRegX links regulatory developments back to their original published source where available.
Structured assessment
The service analyses potential relevance, affected risks and possible control implications.
Professional interpretation
BankRegX judgement and recommendations are distinguished from the regulatory source itself.
Technology & resilience
BankRegX uses established cloud technology services to deliver the application and its AI-assisted functionality.
Cloud application
BankRegX is delivered as a web-based service using cloud application infrastructure.
Data services
Cloud database services support application data, assessment records and methodology information.
AI services
Third-party AI technology is used as part of the BankRegX analysis process, with BankRegX methodology applied around the assessment workflow.
External sources
Regulatory intelligence may use regulator feeds, regulator websites and search services to identify and analyse external information.
Current assurance position
BankRegX aims to describe its assurance position accurately and does not claim certifications that it does not hold.
Further information
Questions about BankRegX security, privacy, data handling or governance can be sent to the BankRegX team.