# Security and compliance · Shimli > Encryption, per-client isolation, role-based access control, guardrails, human approval and auditable traceability of every agent decision. Security and compliance ## AI security in financial operations: autonomy without losing control. Trusting a critical process to an agent takes control, traceability and certainty about what it answers. This is what governs every decision, how the infrastructure is built and what documentation we hand over for your review. ### What governs every decision the agent makes. 01 — Your data #### Under your control, at all times. We treat your customers' data to the standard a financial institution demands. - Encryption in transit and at rest - Per-client data isolation - Role-based access control (RBAC) - Retention and deletion per your policy 02 — Every decision #### Evaluated, governed and auditable. The agent doesn't improvise: every action is checked against your rules before it runs. - Runs under the policies and limits you define - Human approval for sensitive actions - Full traceability: who, what, when and why - Live monitoring and exception alerts 03 — Every answer #### Grounded in your sources, not invented. Answers are grounded in your sources; when unsure, the agent escalates instead of guessing. - Answers grounded in your data and documents - Verifies and cites the source of every fact - When uncertain, it escalates to a human - Validation before executing any action Infrastructure ### What holds the operation up when something fails. The governance above answers what the agent may do. This answers the other half: what happens to your data and your operation when a component goes down. - Encryption and isolation Data travels and is stored encrypted. Each client operates in a space isolated from the rest, with no crossover between institutions. - Replicated database Information is replicated continuously. A node failure neither interrupts operations nor loses records. - Redundant models Every task has more than one model able to solve it. If a provider degrades or goes down, the agent keeps operating on another. - Stable versions only Only stable, tested models run in production. No client's agent operates on an experimental version. Commitments ### What we never do. - We do not train models on your customers' data. - We do not sell or share personal data for advertising. - We do not operate as a black box: every agent decision is logged. - We do not lock you into a model provider or a cloud. For your review ### What we hand over before signing. With no need to advance the commercial conversation. Request them here or write to [hola@sheilim.com](mailto:hola@sheilim.com) . **Data Processing Agreement** The DPA that accompanies the contract, with the current subprocessor list. **Architecture and integration** How the agent connects to your core, what data moves and through which path. Request the security package ### Build your AI agent for collections credit customer support billing back office We take 30 minutes and define which metric you'll move. Or you create the account and start today. Book a demo [Create account](https://shimli.app/user/auth/create-account)