Bashi runs inside a bank's or fund's control environment, not beside it. No training on client data, controls enforced in code rather than by policy, and a record of every step.
Request security documentationBashi sits inside your control environment. Access follows the roles your desk already has, and your documents are used for your analysis and nothing else.
Your documents and outputs are never used to train models, ours or anyone else's. Our AI provider holds your data under zero-retention terms.
Each figure shown links to the page in your documents it was read from. Where sources disagree, an analyst decides, with both in view.
Every extraction, answer, draft, edit and override is logged with who did it and when, and can be exported for risk and compliance.
Data moves through five stages inside Bashi. At each one there is a control, and the ones that matter most are written into the software rather than into a policy.
Every file passes seven ordered checks before anything reads it, with a controlled path for password-protected documents.
Enforced in codePages are read and classified. Source text is stored separately from the working record and referenced by key.
Zero-retention providerEvery figure carries a pointer to its document and page. Where a page cannot be read, the field is marked for an analyst rather than filled in.
Enforced in codeWhere two sources disagree beyond tolerance, the disagreement goes to an analyst to decide, with both sources attached.
Enforced in codeEvery action, human or model, is written to the audit trail with who and when, and can be exported.
Exportable trailEach control, what it covers, and how it is held: written into the code, live as configuration, or in progress. Full descriptions and evidence are available under NDA.
Every draft, spread and flag goes to an analyst before it leaves the workspace.
LiveSeven ordered checks on every file; controlled handling of protected documents.
Enforced in codeNo figure promoted without a resolvable link to its source page.
Enforced in codeEvery field is either extracted with its source or marked for the analyst to complete.
Enforced in codeZero-data-retention agreements with every model provider that touches client data.
LiveIn transit and at rest.
LiveSingle sign-on with your identity provider, multi-factor, analyst / reviewer / read-only roles.
LiveNamed Bashi engineers, least privilege, client-requested support only, logged.
LiveApplication, access and admin events recorded centrally; exportable.
LiveScheduled, encrypted, restoration tested.
LiveBashi is working towards SOC 2 Type II and ISO 27001 through a continuous compliance programme, with policies, controls and evidence tracked against both frameworks.
Our policy set, control descriptions and a completed security questionnaire are available to prospective clients under NDA.
Request documentationIn progress
In progress
Designed for
Designed for
Designed for
Short answers here. Full answers, with evidence, in the questionnaire we send under NDA.
No. Your documents and outputs are never used to train models, by Bashi or by our model providers, which hold your data under zero-data-retention terms.
Your own users, according to the roles you set. Bashi engineers only when you ask for support, under named accounts, and that access appears in your audit trail.
The field is marked for your analyst to complete, with the page attached, and that action is logged like any other. Nothing is filled in on the system's behalf.
Every figure links to the page it was read from, with the confidence the system had in it. Where sources disagree, Bashi flags the disagreement rather than choosing. Corrections your analysts make feed the accuracy measurement.
Client data is deleted, or returned at your request, within 60 days of the end of the engagement, except for routine backups deleted in the ordinary course.
Yes. Send it to us and our engineers answer it directly. We will also walk your risk team through the controls on a call.
Our engineers answer security questionnaires directly, and we will walk your risk team through the controls on a call.