AI Use Policy
Vigilae rests on an invariant principle: the AI perceives, a deterministic engine structures and classifies, the professional decides. This page describes precisely the AI's role, the technical and contractual safeguards in place, and your rights.
Score out of 100 in 2 minutes · No credit card · No commitment
Vigilae, in 57 seconds.
From scattered files to a sealed register: the AI perceives, the engine classifies, you decide, the proof is sealed.
57 seconds · English voiceover · subtitles available · sound on demand
The AI perceives, it does not decide.
At Vigilae, artificial intelligence plays one role only — perception: reading an ID document or a file, extracting structured fields, rephrasing a draft narrative, or answering a question inside the copilot.
Sanctions screening (sanctions lists, asset freezes, PEPs), risk rating (low / standard / enhanced) and the content of a draft suspicious transaction report are all produced by a deterministic engine — explicit, reproducible, auditable rules, with no machine-learning algorithm.
Every decision that produces effects — onboarding a client, rating risk, reporting to the FIU — is made by a human professional. No decision producing legal effects is automated (art. 22 GDPR). No suspicious transaction report is ever filed automatically with the FIU.
Vigilae assists the professional with their AML/CFT obligations. The tool perceives, structures, screens and documents; the professional remains the sole decision-maker and the sole party reporting to the FIU.
Safeguards in place.
Untrusted content
Text extracted from a document is treated as untrusted data and encapsulated within our calls. This architecture limits the risk of instruction manipulation (prompt injection).
Controlled outputs
The AI's outputs are structurally validated before being used. Only information matching the expected schema is retained.
Principle of necessity
Only the content of the relevant file is sent to the AI during a call. No history from other clients is included in the request.
Separate engine
Screening and risk rating never pass through a language model. They rely on a rules engine whose logic is documented and replayable.
Where your data is processed.
When AI perception is enabled for a file, processing takes place via an AI provider hosted within the European Union. No data is transferred outside the EU for this processing.
Enabling AI perception is a function separate from the core processing (screening, rating, registry), which operates independently and calls on no external AI service.
No model training, sixty days at most.
The AI provider Vigilae relies on is Google Cloud (Vertex AI), in the europe-west1 region, running Anthropic's Claude model. The provider contractually undertakes to:
- Not use submitted content to train, fine-tune or improve its models;
- Not retain it beyond sixty days, and keep it within that period for the sole purpose of detecting abuse.
These commitments are governed by a data processing agreement compliant with Article 28 of the GDPR. We do not have the benefit of a zero-retention exception: we would rather write it down than let anyone believe that nothing is kept.
Enabled on this service since 5 September 2026.
On this service, AI perception has been enabled since 5 September 2026. It receives the content of the documents submitted for extraction and the text of the questions put to the copilot — nothing else.
In a new installation it is inert: Vigilae then operates without sending any document or any content to an external AI service, and screening, rating and all core functions run in deterministic mode, with no call to a language model. They still do so here: enabling it moved nothing in what does the computing.
Enabling AI perception is subject to:
- the contractual framework described above being in place;
- an explicit decision by the operator.
Sending images or scanned documents (PDFs, photos of ID papers) to an AI service requires a dedicated additional authorisation, separate from the general activation.
The tool cannot enable AI perception without the firm's knowledge. The operator retains control over which functions are activated.
Your rights.
Under the GDPR, you have the right to access, rectify, erase, restrict the processing of, port and object to the personal data processed by Vigilae.
To exercise these rights or for any question regarding the protection of your data, see our Privacy (GDPR) page or contact us at contact@vigilae.org.
Your questions, our clear answers.
Can the AI trigger a report to the FIU?
No. No suspicious transaction report is ever filed automatically. The AI can help draft a narrative, but the act of reporting — the decision and the submission — is always the professional's.
Are my documents used to train the AI?
No. The AI provider does not use content to train its models, and does not retain it beyond sixty days, keeping it within that period for the sole purpose of detecting abuse. This commitment is set out in a data processing agreement (art. 28 GDPR).
What happens if I don't enable AI perception?
Vigilae operates in full: screening, risk rating, time-stamped registry, evidence file — all of these functions rely on the deterministic engine and call on no external AI service. AI perception is an additional layer, inert by default.
AML/CFT compliance where you stay in control, at every step.
Discover Vigilae on a case close to yours: a free two-minute audit, then a guided demo. The professional decides, the tool prepares and documents.
No credit card · No commitment · Guided onboarding
Vigilae assists the professional with their AML/CFT obligations. The tool perceives, structures, screens and documents; the professional remains the sole decision-maker and the sole party reporting to the FIU.