Account data, balances, and PII can't leave the bank. The stack that handles them runs inside it — and answers the examiner.
Account numbers, balances, transaction histories, and customer PII are exactly the data a bank cannot send to a dozen hosted AI vendors — every outbound call is data egress, another contract, another breach surface, and the security review dies there. Self-hosting is the only approvable shape, but a stack stitched from open-source projects leaves the bank owning the seams and the ops burden. Visca is the whole stack — identity, credentials, runtime, and audit — run inside the bank's walls, with its own operators keeping it patched, rotated, and answerable. The agent arrives with the answers the security team and the examiner demand: who is this agent, what can it touch, where is the record.
Why the data can't leave
Fraud and reconciliation agents are wired to core banking, payment rails, and ledgers through long-lived service accounts with broad scope. A prompt injection or a compromised runtime becomes a movement-of-funds incident.
When an auditor asks 'which automated process issued this refund, under whose authority, and what did it see' — the answer is stitched together from framework traces, vendor logs, and a screenshot. That gap blocks production sign-off.
Keeping the data in means running the stack yourself — and a stitched build of separate projects, each with its own identity, audit trail, and upgrade cycle, turns the bank into the operator of an infrastructure product it never wanted to own.
One stack, not a stitched one
Every agent, and every run, carries a verifiable identity bound to the principal that authorized it. Revocation propagates across the estate in seconds. The first question of the review has one answer.
Every reach into a ledger, a payment processor, or a card network runs on a scoped, time-bound credential — verb, amount, counterparty, duration. The agent never holds a standing key to the core.
Agents run inside the bank's walls, under per-actor budgets and circuit breakers. A runaway process is a bounded process, and nothing — prompts, context, outputs — leaves the perimeter.
Every operation is a principal acting within a scope through one governed gateway, chained and tamper-evident. 'Who issued this refund, under whose authority' is one query, exportable to your SIEM and GRC tools.
The stack ships with its own operators: agents that deploy, upgrade, patch, rotate credentials, and answer incidents inside the perimeter, under the same identity and audit. Maintenance lands on the same ledger the examiner reads.
What you get
Relevant frameworks
Visca Cloud has not yet completed formal certification against these frameworks; the stack is architected to meet them and audits are in progress. See the compliance roadmap.
In practice
A support agent detects a duplicate charge and requests a credential scoped to one refund — capped at $50, for this one customer, valid for thirty minutes. Policy requires a human signature; the approver signs, and the signature lands on the ledger next to the refund it authorized. When compliance reviews the quarter, every refund the estate issued — and every patch the operators applied to the stack underneath — is one query away.
PHI can't be shipped to a model API. The scribe, the model, and the record all run in your tenancy — on a stack that maintains itself.
Telemetry, layouts, and shipment data stay on-site. Software agents and robots run on one in-perimeter stack, under one record.
Classified and sensitive data never leaves the boundary. The whole stack runs inside it — air-gapped, and able to maintain itself there.
Pricing, sourcing, and customer data stay inside each company's walls — while their agents still work across the boundary.
Process recipes and plant telemetry stay on the floor — on one in-perimeter stack, not a console per vendor.
The Autonomy Stack for regulated industries
Identity, credentials, runtime, and audit — shipped as part of your product, run inside your customer's walls, operated by agents under the same ledger as everything else. Nothing leaves the perimeter. Nothing is off the record.