Your data stays yours
Customer records are never used to train or fine-tune shared models. Institution-specific behaviour comes from configuration, policy packs and your own reviewers' feedback, held inside your tenant.
Trust & security
A compliance function cannot buy an unauditable system
Everything below exists because the people who buy Heelius are themselves examined on it. The controls, the residency options and the contractual position on training data are written to survive that examination.
Deployed against
NeobanksPayment facilitatorsMobile money operatorsRemittance & MSBsVirtual asset providersSponsor banks
- SOC 2
- Type II
- ISO
- 27001
- GDPR
- DPA + SCCs
- Residency
- EU · US · KE · SG
- Retention
- Zero model training on customer data
Residency you choose
Processing and storage pinned to the EU, US, Kenya or Singapore, with single-tenant deployment available on the Scale plan. Cross-region transfer is off by default and requires an explicit configuration change.
Encryption and key handling
TLS 1.3 in transit, AES-256 at rest, envelope encryption with per-tenant keys. Bring-your-own-key through your own KMS on dedicated tenancy.
Access control
SSO through SAML or OIDC, SCIM provisioning, role-based access down to the case level, and mandatory MFA for any role that can release a disposition.
Auditability
Every retrieval, decision and human action is written to an append-only trail with the model version and policy pack attached. Exportable in full for an examination.
Assurance
SOC 2 Type II and ISO 27001, penetration tested twice yearly by an independent firm, with the report and remediation status available under NDA.
Questions we get asked first
The answers, without the hedging
- Does Heelius make the filing decision?
- No. It reaches a recommended disposition and drafts the narrative. The filing determination stays with your MLRO, and the console records who made it, when, and on what evidence.
- What happens when the agent is unsure?
- It routes to a human. Unresolved screening, sanctions alias proximity above the referral threshold and continuing activity on a previously reported relationship are hard gates that bypass the confidence score entirely.
- Can we run it in shadow before we trust it?
- That is the recommended path. The agent investigates live alerts alongside your team without releasing dispositions, and you compare its output against your analysts' for as long as you need before enabling auto-close on any segment.
- How do you handle a regulator asking how a decision was made?
- Each case exports as a complete record: the evidence retrieved with source and timestamp, the weighted findings, the disposition logic, the narrative with citations, the model version and policy pack, and every human action taken on it.
- What is the retention position?
- Case files are retained for the period you configure, matching your own record-keeping obligation, and are deleted on that schedule. Retrieved evidence is deleted with the case it belongs to.