Built to hold the most sensitive file in the office.
An AML platform holds identity documents, bank statements and risk decisions. This page sets out how ConveySure protects that data — as a structured description of the actual controls, not a wall of badges.
Eight layers between an attacker and a client file.
Every query is scoped to the firm. One firm's matters, users and documents are invisible to every other firm.
Password sign-in with two-factor authentication support; clients use one-time passcodes instead of standing credentials.
Fee earners, MLROs and admins see different capabilities. MLRO decision controls are unavailable to other roles.
Server-side sessions with secure cookies; sessions can be invalidated and are checked on every request.
Uploaded evidence is stored durably, with document hashes recorded so later tampering is detectable.
Material actions — uploads, reviews, decisions, report generation — are written to a matter-level audit trail.
AI analysis runs through controlled provider calls; failures are recorded and routed to manual review.
Health checks and diagnostics expose operational state without exposing secrets.
Data has a path, not just a place.
- Collection
portal & questionnaire - Storage
durable, hashed, firm-scoped - Processing
extraction & analysis - Access
role-based, logged - Retention
firm policy driven - Deletion
on instruction, recorded
At every stage the question is the same: who can touch this data, and where is that recorded?
What AI sees — and what it is never allowed to decide.
What is sent to providers
Document content is sent to AI providers for extraction and analysis when a document enters automatic review. Provider calls are made for that purpose, recorded against the matter, and their outcomes — including failures — are visible in provider diagnostics.
What stays human
Every AI output lands as a draft or a finding awaiting review. If a provider call fails, the document becomes review-required rather than silently passing. No AI output becomes a final AML decision — approval always belongs to a named person.
The unglamorous controls that matter day to day.
Health checks
A health endpoint reports storage and scheduler state — without leaking keys or secrets.
Error monitoring
Processing failures surface as review-required work items, not silent gaps in the file.
Access logging
Administrative and matter-level actions are attributable to a user and a time.
Provider diagnostics
Admins can see which automated analyses ran, succeeded or failed, and when.
Evidence integrity
Hash manifests make post-receipt alteration of documents detectable at audit.
Deployment hygiene
Containerised deployment with configuration kept out of the codebase.
The questions your IT reviewer will ask.
Is our firm's data separated from other firms?
Yes. Tenant isolation is enforced at the query level — every data access is scoped to your firm, and cross-firm access paths do not exist in the application.
How do clients authenticate without passwords?
Clients receive a secure link and a one-time passcode to their verified email for each session. There are no standing client credentials to be phished or reused.
Can we control who makes MLRO decisions?
Yes. Decision controls are bound to the MLRO role. Other roles can refer matters and view outcomes appropriate to them, but cannot record MLRO decisions.
What happens to our data in an AI provider outage?
Documents queued for analysis move to a review-required state and are handled manually. An outage degrades convenience, not compliance — nothing passes review because automation was unavailable.
Can evidence be altered after upload?
Uploaded documents are hashed on receipt and the hashes appear in the audit bundle manifest, so any later alteration is detectable.
Have a security questionnaire to complete?
Send it over — we answer security and data-handling questions directly rather than pointing at a marketing page.