Governance-first AI for financial services

Your compliance team needs to prove AI usage is governed. Today.

Regulators — FINRA, the OCC, FCA — are actively developing AI governance frameworks. Model risk management (SR 11-7) expectations are now being applied to AI coding tools. Your developers are already using them. The question is whether you can prove they're controlled.

FORG deploys at the adapter layer — between developer tools and LLM APIs. Every model call is attributed by user, team, model, and cost before it is reported. Per-model spend spikes and high-risk sessions trigger alerts, while opt-in gateway budgets can hard-block spend overruns. All of it is logged immutably.

When a regulator asks for your AI governance evidence, you run one command. The export includes model usage by user, policy evaluations, cost attribution, and cryptographic proof that the log hasn't been altered.

# forg budgets — fintech-prodbudget: fintech-compliance-v2policies:  - id: model-spend-spike    condition: model_daily_cost > 2x_baseline    action: alert    notify: [security@corp.com]  - id: pii-risk-flag    condition: session_risk_score > 0.7    action: warn    notify: [compliance@corp.com]  - id: daily-budget    condition: daily_cost > $500    action: block

Budgets and alert thresholds are centrally managed and auditable. Per-model spend spikes notify the right team, while opt-in gateway mode can hard-block budget overruns.

• Engineers use unexpected models in prod — no visibility or budget guardrails
• PII surfaces in AI prompts with no detection or alerting
• Regulator asks for AI usage evidence; weeks of manual extraction follow
• Daily AI spend untracked — budget overruns surface in monthly billing
• Policy enforcement requires eng ticket, code review, and deployment

• Per-model usage and spend tracked in real time, with opt-in gateway budget hard-blocks when spend limits are exceeded
• PII risk scoring flags high-risk sessions in real time before data leaves
• Regulator audit evidence generated in one day, cryptographically signed
• Daily cost budgets enforced per-team, per-environment, per-model
• Budget alerts and limits update centrally and propagate to all environments in seconds

Regulator-ready Audit Logs

Every AI event logged with user identity, model, cost, and policy outcome. HMAC hash-chained for tamper evidence. Structured export compatible with regulator tooling — delivered same day.

Per-Model Cost Attribution

Track model usage and spend by team, environment, and workflow. Alert on per-model spend spikes, and use opt-in gateway budgets to hard-block spend overruns.

PII Risk Scoring

Real-time session risk scoring surfaces high-probability PII exposure events before data leaves your perimeter. Configurable thresholds trigger alerts, warnings, or notifications.

Audit Evidence Export

Export your tamper-evident, hash-chained admin audit log as structured JSON on demand — useful as supporting evidence for SOC 2 and GDPR reviews. (SOC 2 Type I is in progress; no Type II report yet.)

Metadata-Only by Design

FORG is metadata-only — prompt and response content never transits FORG infrastructure, minimizing your sensitive-data exposure surface. (No HIPAA BAA offered today.)

Zero Data Residency Risk

FORG operates on event metadata at the adapter layer. No prompt content, no response content, no model inputs stored anywhere in FORG infrastructure. GDPR and CCPA self-attested; metadata-only by architecture.