Industries

One authority layer. The rules you are held to.

Every industry on this page runs the same TapPass: agents get least privilege per tool, risky calls wait for a person, and every decision lands on a tamper-evident record. What changes is which rules matter, which data must never move, and who has to prove it later.

✓Free for one person · No credit card needed

Your rulebookPlain words, your thresholdsWritten once by the people who own the risk.payouts over €500no bulk export
TapPass · authority layerDecides on every callThe same enforcement and the same record in every industry.allowholdredactblock
What you must proveEvidence, not assurancesSigned, replayable, ready to export.DORASolvency IIGDPR Art. 9NIS2EU AI Act
01Why industry matters

A generic AI policy does not survive an audit. A specific one does.

TapPass turns the second kind of sentence into a rule that fires the moment an agent tries to act, for the industry you are in.

Not a control“Be careful with customer data.”
  • Nobody can tell when it was broken.
  • Nothing happens in the moment the agent acts.
  • Nothing to show an auditor afterwards.
A control“This agent may read a claim but never export policyholder records, and any payout over €500 waits for a named approver.”
  • Fires on the call, the same way every time.
  • A named person signs the payout.
  • Every allow, hold and block on the record.
02Pick your ground

Where TapPass is already shaped for the work. Seven industries, one product.

Financial servicesAgents that touch customer money need more than a prompt asking them to behave. Payment caps that hold, personal data that never leaves the perimeter, and a DORA-shaped record of who decided what.DORAGDPREU AI ActPSD2 InsuranceUnderwriting and claims automation is a high-risk decision system the moment a model is in it. Keep policyholder data contained, the reasoning reviewable, and Solvency II and the EU AI Act answerable.Solvency IIEU AI ActGDPRIDD HealthcarePatient data under GDPR Article 9 does not get a grace period while you experiment. Redact before the call leaves, hold clinical-adjacent actions for a person, and show the trail to your DPO.GDPR Art. 9EU AI ActMDRGDPR Art. 17 LegalPrivilege is a property of where the data went, not of your intentions. Enforce matter-level separation and Chinese walls at the tool boundary, and keep a per-matter record of every AI touch.PrivilegeChinese wallsGDPREU AI Act Government and public sectorCitizen data rarely gets to leave the building, and it should not have to. Run TapPass in your own tenancy, whitelist the models you accept, and align with NIS2 and the EU AI Act on your own infrastructure.NIS2EU AI ActGDPRData sovereignty Consulting and professional servicesEvery engagement is someone else’s confidential material. Scope an agent to one client’s tools and data, prove the wall held, and hand the client an audit trail instead of an assurance.Client NDAsChinese wallsGDPREU AI Act SaaS and technologyShipping an AI feature means shipping your tenancy model to a model provider. Keep tenant isolation intact, govern what agents reach on a customer’s behalf, and arrive at your SOC 2 audit with the evidence collected.SOC 2Tenant isolationGDPREU AI Act Not on the list? Startups.The layer does not care what you sell. Move fast without building a governance layer you will rip out at your first enterprise deal. Start free, add rules as customers ask for them.Free to startWhite-label By use case insteadIf the work matters more than the sector, start from what the agents do: IT operations, OT and industrial systems, or business teams like finance and support.ITOTBusiness teams
03What every one of them gets

Different regulators. The same three guarantees.

Nothing here is industry-specific. Only the thresholds are.

Least privilegeThree tools, not thirty-four

Per tool and per team, an agent holds the tools its job needs instead of every tool a server happens to expose.

A personA human on the calls that deserve one

Routed to Slack, email or a passkey tap on the approver’s own device. Nobody approves their own request.

The recordEvery allow, hold and block

Tamper-evident and replayable, streaming to the SIEM you already run as OpenTelemetry.

Comparing tools?How TapPass differs from detection APIs, libraries, monitoring and supply chain tools.
Questions

Industries, in plain answers.

Something else on your mind? Talk to our team.

Is there a different TapPass for each industry?

No. Every industry runs the same product: least privilege per tool, a person on the calls that deserve one, and a tamper-evident record. What changes is the rules and thresholds you set.

Does TapPass make us compliant with DORA, NIS2 or the EU AI Act?

No tool does that on its own. TapPass gives you the controls on every agent call and the evidence that makes your own answer to the regulator defensible.

Can TapPass run in our own environment?

Yes. TapPass is EU hosted, and on Enterprise it runs in your own tenancy or on your own servers.

Where do we start?

With one agent in watching mode. TapPass records what it would have allowed, held or blocked, and you switch rules on when you trust them. It is free for one person.

Your industry, your thresholds. The same record everywhere.

Connect one agent and see every call TapPass would have held, stopped or routed elsewhere. Nothing is blocked while you learn.

✓ Free for one person✓ No credit cardBacked by Start it @KBCVLAIO✓ EU hosted✓ Built in Belgium✓ Your own model keys✓ Encrypted at rest and in transit✓ DPA on request