Security and controls
Controls your auditors already recognize.
Every entry is recomputed by a second AI and held to your thresholds. Your data is isolated from other customers.
Maker-checker
Prepared by one model, checked by another.
Nobody on a good team approves their own work, and agents are no exception. A second AI from a different provider recomputes every entry; if they differ, nothing posts.
Preparer, reviewer and approver, kept apart.
The controls your auditors look for in a well-run team, built into every entry.
Your thresholds
Set approval limits by entity or by client. Anything above them, or anything the two models disagree on, waits for a reviewer.
Segregation of duties
An agent prepares, a second AI reviews and a person approves what’s above your limits. Each step is recorded with the entry.
A trail to the source
Every balance links to its entries, source documents, both reviews and the approver. Your auditors follow what happened, not a reconstruction.
Your data
Isolated, permissioned and logged.
Everything the agents read and write is protected, and you decide who sees it.
Sign-in and roles
Sign in with SAML single sign-on and multi-factor authentication. Roles and permissions are set by entity or by client.
Isolated by customer
Each customer’s data is isolated by tenant, so no other customer can reach it.
Audit log
Every sign-in, change and approval is logged with who and when, including changes to thresholds and policies.
Retention and deletion
Data is kept for as long as your agreement says. We delete it on request, or when the agreement ends.
Backups
Backups are taken regularly, so your data and workpapers can be restored if a system fails.
AI and your data
What the AI sees and what it learns.
The models see your data only to prepare and check your work.
No training by providers
The agents and the second review run on different AI providers’ models. Neither may train on your data.
Kept to your company
One company’s records never appear in another’s answers.
Learning under your agreement
Models learn from de-identified outcomes under your agreement. A shared pattern is used only once twenty or more companies agree.
For your security review
Ready for your security review.
A vendor review shouldn’t stall your decision. Your security, procurement and audit teams get their answers in writing.
Questionnaires and documentation
We complete your security questionnaire and share our security documentation under NDA.
Subprocessors
Our list of subprocessors, and what each one does, is available on request.
Responsible disclosure
Report a suspected vulnerability through our website, www.zenday.com. We’ll acknowledge it and keep you informed while we fix it.
Questions controllers and firms ask first.
Can an agent post an entry on its own?
Only under the thresholds you set, and only after a second AI from a different provider recomputes it and agrees. Agents start by proposing everything, and anything above your thresholds waits for a reviewer.
What happens when the two AIs disagree?
Nothing posts. The entry waits for a reviewer, the same as anything above your thresholds.
Is our data used to train AI models?
One company’s records never appear in another’s answers, and our AI providers may not train on your data. Models learn from de-identified outcomes under your agreement.
Can we limit who sees each entity or client?
Yes. Roles and permissions are set by entity or by client, so each person sees only the books they’re responsible for.
How do our auditors see the work?
Every balance links to its entries, the source documents, both reviews and who approved it. Your auditors can follow any number back to the support behind it, the way it happened.