Fortifai · For Risk & Compliance Office

01 · The legal & compliance blind spot

Under updated US DOJ compliance guidance (ECCP), testing 25-to-50 transaction samples per quarter is no longer defensible assurance. Point-of-sale screening and ERP gates only check whether an order, customer or vendor is permissible at entry—leaving over 80% of post-clearance transaction unexamined.

Example:Export Control & Trade Diversion Risk

Post-Clearance Routing Flips & Transshipment Rings

Screening tools (like SAP GTS) block denied parties at order entry, but miss mid-flight country changes, freight-forwarder masking without an Ultimate Consignee, and controlled goods routed through transshipment hubs after clearance.

Example:Global Bribery, FCPA & Books-and-Records Risk

Offshore Consulting Conduits & T&E Tender Spikes

Quarterly sample audits miss round-sum, PO-exempt invoices ("liaison" or "facilitation" fees) in high-CPI regions, manual GL reclassifications, and hospitality spikes clustering around government tender awards.

Example:Third-Party & Supply-Chain Interposition Risk

Static Onboarding & Zero-Substance Pass-Through Shells

Vendors pass static KYC checks at onboarding, but compliance lacks visibility when approved suppliers operate with zero factory headcount, act as pass-through middlemen at a 20%–30% markup, or suffer post-onboarding sanctions and ownership shifts.

Example:Whistleblower & Evidentiary Privilege Risk

Fragmented Forensics & Discoverable "Smoking Gun" Labels

Investigating whistleblower tips across disconnected HR, vendor master, and ERP tables takes weeks of external consulting hours, while legacy rule tools output conclusive "fraud/violation" labels that create discoverable legal liability.

02 · How fortifai works

1 · Permit Boundary Thesis

Post-Gate Behavioral Surveillance

Treats existing GTS and ERP controls as permit boundaries—monitoring 100% of post-clearance shipping changes, disbursements, and T&E records for behavioral evasion they do not test.

2 · Internal-External Graph

In-VPC Counterparty Triangulation

Fuses live ERP ledgers with signed, in-VPC D7 registry intelligence (verified factory headcount, tax scope, UBO networks, PEP/sanctions, and court records) with zero data egress.

3 · Privileged Governance

"Signals, Not Verdicts" & Sealed Dossiers

Frames all findings as objective signals scrubbed of verdict language. Escalated cases route to an isolated Privileged Legal Review enclave under Maker-Checker SoD and seal with FIPS 140-3 hashes.

03 · The executive cockpit: Legal, Compliance & Regulatory Risk Control Tower

fortifai SARA · Legal, Compliance & Regulatory Control Tower

GC · CCO · Audit Committee · External Counsel Brief

All compliance agents feed into fortifai SARA, giving the General Counsel and CCO a real-time command center across global regulatory exposure, third-party substance, and active privileged investigations. Our workflows are built for federal enforcement and voluntary self-disclosure (VSD) standards:

Transaction Surveillance

100% Txns

Zero sampling gap across ERP & T&E

Investigation Effort

50%+ Faster

Auto-assembled Xa forensic dossiers

Privilege & Integrity

FIPS 140-3 HMAC

Sealed dossiers · Maker-Checker SoD

Data Residency

Zero Egress

100% client VPC / GovCloud ready

04 · Domain-Specialised AI Agents for the CCO & General Counsel

1 · Export Control & Trade Diversion

Aegis Post-Clearance Export & Diversion Sentinel

Monitors controlled sales (ECCN, dual-use, ITAR) after GTS order entry through physical delivery—flagging mid-flight Ship-To country flips, Sold-To ≠ Ship-To divergence, transshipment hub spikes, freight-forwarder masking, and front networks via force graphs.

2 · Anti-Bribery, FCPA & Books-and-Records

Veritas Global ABAC, FCPA & T&E Surveillance

Correlates ERP vendor payments, manual GL journals, and Concur T&E hospitality around government tender timelines—isolating disproportionate consulting/liaison fees in high-CPI regions, PO-exempt round-sum bills, split payments, and SOE gift clusters.

3 · Counterparty Substance & Supply-Chain Integrity

D7 8-Dimension Counterparty & Statutory Due Diligence

Screens third parties across Financial Health, Factory Substance (verified employee headcount & tax scope), AML/Sanctions, Litigation, Adverse Media, UBO/PEP Networks, and Geopolitical Risk via signed in-VPC snapshots.

Conduit Pass-Through Vendor & Intermediary Interposition

Pairs Inside-Out ERP behavior (<60-min GR-to-Invoice dwell, single-buyer routing) with D7 substance (0 factory staff) to unmask shell middlemen and third-party markup conduits.

4 · Internal Investigations & Document Forensics

Argus AI-Powered Internal Investigations & Collusion

Turns whistleblower tips or anomaly clusters into court-ready dossiers in one click—cross-referencing HR records against vendor masters to expose employee-vendor bank/address collisions and SoD breaches across P2P.

Pulse & Codex Pre-Posting PDF Forensics & M&A Safe Harbor QoE

Screens incoming vendor invoices and bid PDFs for shared machine IDs and font tampering before ERP posting, and accelerates DOJ M&A Safe Harbor diligence.

05 · Built-in conversational AI: enterprise "QuantumQuery" & workbench "Ask Agent"

Ask in plain English. Get 100% deterministic, audit-traced answers.

Every legal workbench includes QuantumQuery (Cmd+K). Questions are translated into AST-validated, read-only SQL over governed anomaly tables—so figures are computed by the database, never guessed by an LLM.

SELECT-Only Guardrail SAP Document Lineage Zero LLM Math

Aegis "Show ECCN shipments where Ship-To country flipped after GTS clearance"

Veritas "List high-CPI consulting vendors paid without a PO near tender awards"

Argus "Which active vendors share bank or address attributes with HR records?"

06 · Why General Counsel & CCOs choose fortifai

100%

Population tested

Replaces 25-row quarterly sampling

50%+

Less investigation time

Auto-assembled Xa dossiers with lineage

Data egress or LLM training

Runs in client VPC / On-Prem / GovCloud

4-6 wks

Rapid time-to-value

D7 100-vendor diagnostic or full ERP link

1. "Signals, Not Verdicts" & Privileged Enclave Routing

Fortifai never outputs discoverable legal conclusions (such as "FCPA Violation" or "Illegal Diversion"). Detections are framed as objective behavioral indicators mapped to COSO 2013 and statutory citations, locking inside an isolated Privileged Legal Review workspace under Maker-Checker SoD.

2. Defensible Exception Memory with Structural-Drift Tripwires

Pre-registers trusted counterparties and logs every analyst dismissal with author and rationale, while maintaining active pgvector tripwires that automatically re-open the entity if its bank account, beneficial ownership, or tax scope drifts.

07 · High-level platform architecture (inside your network / private cloud VPC / GovCloud)

08 · Low-Friction Onboarding: From Kick-Off to Defensible Assurance in 4 Weeks

Week 1 · Connect

Read-Only & D7 Screen

Provision read-only ERP/T&E access in your VPC and run the Data Reliability Audit & D7 screen.

Week 2 · Triangulate

Lineage & Watchlists

Normalize ERP change logs and fuse internal postings with signed D7 statutory feeds.

Week 3 · Calibrate

Privilege & Allowlists

Configure trusted-vendor allowlists, CPI/ECCN thresholds, and Privileged Maker-Checker routing.

Week 4 · Execute

Go-Live & ECCP Brief

Launch live workbenches, clear priority dossiers, and generate your baseline DOJ ECCP posture brief.

Continuous Compliance Assurance