Your rules, applied to each product
Tacit tells each team which circulars and directions it must follow, what every new one changes and by when.
Banks and fintech
Every circular, new or current, mapped to your teams.
Tacit is the AI workspace for critical infrastructure teams, and the financial system is one of them. It checks the rules you operate under before work goes out, inside your own cloud.
Your usage data stays yours.
The rules you operate under, checked first.
Personal data rules, checked first
Consent, retention and transfer rules are checked before customer data leaves a system or goes to a vendor.
Customer checks before accounts open
Identity and screening steps from your policies are checked before an account opens or a limit changes.
Outsourcing and third-party risk
Risk reviews and contract terms are checked before a new vendor or tool gets access to your data.
Examples, not the full list. Tacit tracks many more rules than we can show here.
Built for banks and fintechs.
Across critical infrastructure, customers chose Tacit over Microsoft Copilot, KPMG Risk Hub, PwC Compliance Insights and Big Four consultants.
Control for the CIO.
What risk and IT ask for first.
Prompts stay with Microsoft and AWS
Models run on Microsoft Azure and Amazon Bedrock. Anthropic, OpenAI and Moonshot have no access to your prompts or outputs and never train on them.
IT decides which models run
A router sends each request to a model on your allowlist. If a provider call fails, it retries on a fallback that is still approved.
Scoped per organization and per person
Each customer is isolated first. Then access to tools and content is scoped to each team and each person.
Every edit and agent action logged
Recorded for you alone, in a form ready to train your own models if you choose to. No one else trains on it. We don’t either, unless you opt in, in writing.
One catalog IT can see
People build shareable apps on the same integrations and permissions, running as the signed-in user, instead of hundreds of tools IT can’t see.
SOC 2 Type II and CASA/ASVS
Audited by Johanson Group in April 2026, with a founder and an implementation lead you can reach on the same business day.
Recurring work, checked against your policies.
One-off questions and recurring work.
Priya Nair · Merchant support
Summarize yesterday’s merchant complaints and draft replies for the top 10.
Done. 10 replies are ready for review.
I grouped 142 complaints into 6 themes. The replies follow your support policy. Two involve refunds, so they go to a supervisor first.
Support policy, §42 need approval
Review the draftsArjun Mehta · Fraud operations
Every Monday at 9, send me the fraud team’s open cases older than 7 days.
Scheduled. The first run is Monday at 09:00.
I’ll pull the cases from the case tracker, group them by owner and post the list in #fraud-ops. You can pause or change the schedule any time.
Case trackerEvery Monday
View the scheduleNeha Rao · Growth
Can we send this customer list to the new analytics vendor?
Not until the vendor contract covers the data.
The list includes personal data. Your outsourcing policy needs a signed data processing agreement and a risk review before any transfer.
Vendor outsourcing policyPersonal data
Start the reviewHow each model handles your data
Per model, in writing.
| Models | Runs on | Can the model maker see it? | Does the model maker train on it? | Stored by the host? |
|---|---|---|---|---|
| Anthropic Claude | Amazon Bedrock | No. It runs in AWS accounts Anthropic can’t access. | No | No. Bedrock doesn’t store prompts or outputs. |
| Moonshot Kimi and open-weight models | Amazon Bedrock | No. Same isolation as above. | No | No |
| OpenAI GPT | Microsoft Azure | No. Prompts are not available to OpenAI. | No | Only for Microsoft’s abuse monitoring, which eligible customers can switch off. |
Anthropic Claude
- Runs on
- Amazon Bedrock
- Can the model maker see it?
- No. It runs in AWS accounts Anthropic can’t access.
- Does the model maker train on it?
- No
- Stored by the host?
- No. Bedrock doesn’t store prompts or outputs.
Moonshot Kimi and open-weight models
- Runs on
- Amazon Bedrock
- Can the model maker see it?
- No. Same isolation as above.
- Does the model maker train on it?
- No
- Stored by the host?
- No
OpenAI GPT
- Runs on
- Microsoft Azure
- Can the model maker see it?
- No. Prompts are not available to OpenAI.
- Does the model maker train on it?
- No
- Stored by the host?
- Only for Microsoft’s abuse monitoring, which eligible customers can switch off.
Based on Microsoft’s and AWS’s published data-handling terms. IT can block any model or provider. Security at Tacit
Frequently asked questions
Can the AI labs see or train on our data?
No. Models run on Microsoft Azure and Amazon Bedrock, where the companies that make them never see your prompts or outputs, and they never train on them. Tacit trains only with your written opt-in. Amazon Bedrock doesn’t store prompts at all, and Microsoft keeps them only for abuse monitoring, which eligible customers can switch off.
Who owns our usage data?
You do. Every action is recorded for you alone, in a form ready to train your own models if you want to.
Which models can our people use?
The ones on your allowlist. IT decides which models run and for which teams, and can block any model or provider. A failed call only ever falls back to another approved model.
Can people hand Tacit recurring work?
Yes. Anyone can ask for a task on a schedule, such as a weekly report or a daily check, and pause or change it any time. Each run is logged like any other action.
Does it know our regulations?
Yes. Tacit reads the circulars and rules you operate under, new ones as they’re issued and your own policies, and checks them before work goes out. A named person approves every submission.
Where does it run?
Inside your own Azure or AWS, managed or self-hosted, or in our multi-tenant cloud with each customer isolated.
Bring one deadline. Watch Tacit handle it.
30 minutes with a founder, using your own rules and documents.