Quality assurance
We judge quality the way your reviewers do.
- Maker-checker on every action that moves money or changes a record
- Risk-based sampling and an error taxonomy
What we commit to, and what you decide.
Your service agreement spells out completion, quality, authority, and escalation for your operation and your obligations.
Six commitments
What every service agreement includes.
A defined result
Output and acceptance criteria, agreed before work begins.
Service levels and reportingIn your systems
Your records of account stay in your systems. We work in them through the access you grant.
Data protection and security
Quality and evidence
How we check quality and keep the evidence.
Evidence and audit trail
Your auditors can follow a case from intake to accepted output without asking us to rebuild it.
- Sources linked to each figure and finding
- Procedure, rule, and model versions recorded
- Every action and decision logged with who or what made it
AI governance
The cost of an error in a task sets how much human review it gets.
- An inventory of AI use by task
- Evaluation before release, drift monitoring after
Your data never trains models used for other clients.
Controls
Preventive controls stop errors; detective controls find the rest.
- Mapped to your framework, so your risk team can test them
- Control evidence kept with each case
Reporting and oversight
Reports, reviews, and your right to audit.
Service levels and reporting
A simple file and a complex one should not share a turnaround, so we set service levels per case class.
- Quality and customer effort, measured together
- KPIs, key risk indicators, and monthly management information
Governance forums
Three forums, each with its own agenda, minutes, and follow-up.
- Weekly operating review
- Volumes, backlog, and aged exceptions
- Monthly service review
- Service levels, quality, incidents, and changes
- Quarterly steering
- Scope, economics, risk, and growth
Client oversight
Your risk, compliance, and internal audit teams have audit and access rights over the service.
- Support for third-party risk reviews
- Information for your outsourcing register
- Supervisory access where the rules require it
Security, resilience, and exit
Your data is protected, and your exit is planned from the start.
Data protection and security
Each person and process sees only what its task needs; your contract sets how AI may use your data.
- Agreed processing locations and retention
- Encryption in transit and at rest
- The subprocessor list, shared with you
Resilience
We test our continuity and recovery plans. After an interruption, we reconcile before we resume, to find anything lost or done twice.
- Incident notification within agreed times
- Approved fallbacks when a model is down
Transition and exit
Every contract sets out how the operation moves to your team or another provider. We write the exit plan at the start and test it with you.
- Records and case history in agreed formats
- Configuration, rules, and procedures
- Assistance through the handover
The services run on open-source Firefly OpenPlatform, so your teams can read the code they take over.
Regulation
Designed around the rules you work under.
These frameworks shape the controls and the exit terms on this page.
European Union and Spain
- EBA Guidelines on outsourcing arrangements, until the 2026 guidelines on third-party risk (EBA/GL/2026/09) apply
- DORA (ICT third-party risk and the register of information)
- GDPR
- The EU AI Act, where creditworthiness assessment of natural persons and life and health insurance pricing are high-risk uses
- IFRS 9
- Solvency II and IFRS 17
United States
- Interagency guidance on third-party relationships (OCC Bulletin 2023-17)
- Model risk management (SR 26-2)
- GLBA
- The NAIC model bulletin on insurers’ use of AI
- CECL
Latin America
- Confirmed per country and engagement
Applicability depends on the institution, the activity, and the jurisdiction. Naming a framework here is not a claim of compliance.
Due diligence
Review the evidence for your scope.
Ask for the control documentation, test evidence, and provider arrangements for the scope you contract.
Questions buyers ask
Do you guarantee a particular turnaround?
Yes, once we have validated the service on your cases. From then on, turnaround per case class is a service level with remedies.
Will our customers know when an AI agent writes to them?
Yes. When an AI agent writes to a customer or a broker, the message says so (EU AI Act, Article 50). You approve the wording.
Your first operation
Bring us one operation.
Tell us the process, the volume, and what “done” looks like. We will come back with a scope, a deployment plan, and a proposal.