Source: [Service levels and institutional control](https://fireflysoftware.io/service-levels-and-control/) Description: How a Firefly service agreement sets completion, quality, authority, exception handling, data responsibilities, and transition provisions. Language: en [Home](https://fireflysoftware.io/)/Service levels and control # What we commit to, and what you decide. Your service agreement spells out completion, quality, authority, and escalation for your operation and your obligations. [Book an operations review](https://fireflysoftware.io/contact/) [Explore our services](https://fireflysoftware.io/services/) Six commitments ## What every service agreement includes. - ### A defined result Output and acceptance criteria, agreed before work begins. [Service levels and reporting](https://fireflysoftware.io/service-levels-and-control/#reporting) - ### An accountable operator We run the work, exceptions and rework included. [Capacity and continuity](https://fireflysoftware.io/how-we-operate/#capacity) - ### Your authority Your policies decide what proceeds and who approves. [The authority model](https://fireflysoftware.io/service-levels-and-control/#authority) - ### Quality you can audit Maker-checker, risk-based sampling, and an error taxonomy. [Quality assurance](https://fireflysoftware.io/service-levels-and-control/#quality) - ### Traceable evidence Each output links to its sources and versions. [Evidence and audit trail](https://fireflysoftware.io/service-levels-and-control/#evidence) - ### In your systems Your records of account stay in your systems. We work in them through the access you grant. [Data protection and security](https://fireflysoftware.io/service-levels-and-control/#security-and-data) Authority ## Your policies define the authority model. We document the actions we may take, their limits, and the decisions you reserve. Each decision takes one of five modes. Your team decides Your approver decides, on a package we prepare AI recommends Our AI drafts it; your team checks and decides Approved rules Deterministic code applies your rules within your limits AI within approved limits Only where your institution approves it, inside limits it can withdraw AI agents, within approved limits Multi-step casework inside your limits; anything outside goes to your team Quality and evidence ## How we check quality and keep the evidence. ### Quality assurance We judge quality the way your reviewers do. - Maker-checker on every action that moves money or changes a record - Risk-based sampling and an error taxonomy ### Evidence and audit trail Your auditors can follow a case from intake to accepted output without asking us to rebuild it. - Sources linked to each figure and finding - Procedure, rule, and model versions recorded - Every action and decision logged with who or what made it ### AI governance The cost of an error in a task sets how much human review it gets. - An inventory of AI use by task - Evaluation before release, drift monitoring after Your data never trains models used for other clients. ### Controls Preventive controls stop errors; detective controls find the rest. - Mapped to your framework, so your risk team can test them - Control evidence kept with each case Reporting and oversight ## Reports, reviews, and your right to audit. ### Service levels and reporting A simple file and a complex one should not share a turnaround, so we set service levels per case class. - Quality and customer effort, measured together - KPIs, key risk indicators, and monthly management information ### Governance forums Three forums, each with its own agenda, minutes, and follow-up. Weekly operating review Volumes, backlog, and aged exceptions Monthly service review Service levels, quality, incidents, and changes Quarterly steering Scope, economics, risk, and growth ### Client oversight Your risk, compliance, and internal audit teams have audit and access rights over the service. - Support for third-party risk reviews - Information for your outsourcing register - Supervisory access where the rules require it Security, resilience, and exit ## Your data is protected, and your exit is planned from the start. ### Data protection and security Each person and process sees only what its task needs; your contract sets how AI may use your data. - Agreed processing locations and retention - Encryption in transit and at rest - The subprocessor list, shared with you ### Resilience We test our continuity and recovery plans. After an interruption, we reconcile before we resume, to find anything lost or done twice. - Incident notification within agreed times - Approved fallbacks when a model is down ### Transition and exit Every contract sets out how the operation moves to your team or another provider. We write the exit plan at the start and test it with you. - Records and case history in agreed formats - Configuration, rules, and procedures - Assistance through the handover The services run on open-source Firefly OpenPlatform, so your teams can read the code they take over. Regulation ## Designed around the rules you work under. These frameworks shape the controls and the exit terms on this page. ### European Union and Spain - EBA Guidelines on outsourcing arrangements, until the 2026 guidelines on third-party risk (EBA/GL/2026/09) apply - DORA (ICT third-party risk and the register of information) - GDPR - The EU AI Act, where creditworthiness assessment of natural persons and life and health insurance pricing are high-risk uses - IFRS 9 - Solvency II and IFRS 17 ### United States - Interagency guidance on third-party relationships (OCC Bulletin 2023-17) - Model risk management (SR 26-2) - GLBA - The NAIC model bulletin on insurers’ use of AI - CECL ### Latin America - Confirmed per country and engagement Applicability depends on the institution, the activity, and the jurisdiction. Naming a framework here is not a claim of compliance. Due diligence ## Review the evidence for your scope. Ask for the control documentation, test evidence, and provider arrangements for the scope you contract. Questions buyers ask Do you guarantee a particular turnaround? Yes, once we have validated the service on your cases. From then on, turnaround per case class is a service level with remedies. Will our customers know when an AI agent writes to them? Yes. When an AI agent writes to a customer or a broker, the message says so (EU AI Act, Article 50). You approve the wording. Your first operation ## Bring us one operation. Tell us the process, the volume, and what “done” looks like. We will come back with a scope, a deployment plan, and a proposal. [Book an operations review](https://fireflysoftware.io/contact/) [Request a demo](https://fireflysoftware.io/contact/?request=demo)