Your agents handle customer money. Govern them like it.
Banks, fintechs and investment firms run agents on transaction data, customer personal data and financial records. TapPass gives your CISO full visibility, stops the risky calls in real time and leaves compliance evidence for every model call.
✓Free for one person · No credit card needed
Agents already work the front and back office. Each one touches money or personal data.
Three agents you probably run or plan to run, and what TapPass watches on each.
IBANs, card numbers and social security numbers are found and removed before any model sees them.
Large transfers, account changes and compliance-sensitive operations wait for a named person.
Every recommendation is on the record with the data it processed, and a change in behaviour after a model update is flagged.
The blind spots your CISO cannot see. Traditional security tools miss them entirely.
Agents in financial services open governance gaps between your app and the model.
Your teams say what worries them. TapPass makes it fire.
Each rule is written in plain words by the people who own the risk, and runs the same way on every call.
Runtime governance for financial agents. Every call scanned, classified and logged.
TapPass sits between your agents and the model, so nothing in your apps has to change.
The rules your regulator already set. Mapped to what TapPass records.
What each rule asks of you, and the part of the answer TapPass gives you.
| Regulation | What it asks | What TapPass gives you |
|---|---|---|
| DORADigital Operational Resilience Act | ICT risk management and documentation of the systems you rely on, agents included. | A tamper-evident record of every agent and tool call, with the data classes it touched, exportable to your SIEM. |
| GDPR Art. 30Records of processing | Records of processing activities for personal data. | What personal data each agent processed, when, and where it went, taken from observed traffic. |
| GDPR Art. 44 to 49International transfers | Lawful transfers of personal data outside the EU. | Routing rules that keep personal data with EU-hosted models, and block the call when none is available. |
| EU AI ActArt. 12 and 14 | Record keeping and human oversight for high-risk AI systems. | Signed, replayable decisions, and approvals by named people on the actions you choose. |
| PSD2Payment services | Strong customer authentication and secure payment initiation. | Agent-initiated payments over your limit wait for a person who signs with a passkey. TapPass sits beside your SCA flow, it does not replace it. |
No feature guarantees a compliance outcome. TapPass gives you the controls and the evidence that make your own answer defensible.
Proof you can check. Not logos you have to trust.
We do not put customer names on a page unless we can show you the work. Here is what you can verify yourself, on your own agents.
Connect one agent in watching mode. TapPass records what it would have allowed, held, redacted or blocked, and nothing is blocked while you learn.
The same rule and the same call give the same verdict, every time. Replay a decision for your auditor, or a draft rule over last week’s traffic.
Security controls, subprocessors, and a DPA on request. Hosted in the EU, built in Belgium.
What we can show you today is the product on your own agents, the documentation behind every control in the Trust Center, and a team that answers your security questionnaire itself.
Does TapPass help with DORA?
It gives you the evidence side. Every agent call, tool call and approval is on a tamper-evident, hash-chained record that you can export to your SIEM as part of your ICT risk documentation. No tool makes you compliant on its own; TapPass makes the agent part of your answer provable.
Can an agent move money without a person?
Only below the limits you set. Transfers over your threshold, account changes and other sensitive operations are held for a named approver, who signs with a passkey on their own device. Nobody approves their own request.
What happens to IBANs and card numbers?
They are detected and removed before the model sees them, or tokenised and restored in the answer. The record keeps redacted content and metadata only.
Can we keep everything inside our own environment?
Yes. On Enterprise, TapPass runs in your own tenancy or on your own servers, so no data leaves your VPC. You can still route to Azure OpenAI, Bedrock or Vertex AI under your own rules.
Stop sending financial data to models unscanned. Start with one agent, for free.
Connect one agent and see every call TapPass would have held, stopped or routed elsewhere. Nothing is blocked while you learn.
✓ EU hosted✓ Built in Belgium✓ Your own model keys✓ Encrypted at rest and in transit✓ DPA on request