How FeeVerify handles your data and decisions

Yes. FeeVerify processes and routes nothing, and sells no acquiring, processing or routing, so its findings carry no commercial agenda. It sits as an independent control layer between what your providers and the schemes bill you and what you agreed, owned by your Finance team rather than by a provider. That independence is why its evidence can be put to an acquirer, processor or scheme, and why internal audit can rely on it.

Each tenant's data sits in a ringfenced environment. There is no co-mingling and no shared fine-tuning layer between tenants by design. Bulk transaction, reconciliation and cost data are held in a per-tenant data store, separate from the system that manages accounts and permissions. Where you require a specific data-residency region, we agree it with you as part of onboarding. Where data is transferred outside the region you operate in, we put appropriate safeguards in place, such as standard contractual clauses, and agree the arrangement with you in advance.

Your commercial data is never used to train, fine-tune or improve any machine-learning model, ours or a third party's. Where the platform uses model providers to read documents or reconcile data, it does so under agreements that prohibit training on, or retention of, your content beyond what is needed to return a result.

Your organisation's users see your tenant, and your org admins manage who those users are. Tenant isolation is enforced in the database, so one tenant's users cannot reach another tenant's data. The browser has read-only access, and every change passes through a server-side gate. Inside FeeVerify, we apply least-privilege access controls and log access for review. Files containing full card numbers (PANs) are rejected at upload, so they never enter the environment.

A named reviewer. Material outputs, and any output graded Low for confidence, land in needs review and wait for a named sign-off before they reach a decision-maker. AI does the high-volume analysis, and experienced payments specialists steer each investigation and sign off every material finding, so you need no new headcount to run it. The sign-off, with the reviewer's name and the time, is recorded in the worklog alongside the finding.

Every action, by an agent or a person, is recorded in the worklog with the operator, the source, the output and its status. That covers uploads, data dictionary approvals, each agent step, each rule and its confidence grade, and every sign-off. We also log platform activity for audit and security: actions taken, by whom, when, and the outcome.

Every analysis carries a spend and time ceiling, so an investigation cannot run up an open-ended cost and finance can predict what an answer will cost before it is asked. Commercial terms are set out in your contract: a risk-aligned pilot, then a success fee on the value you accept, with no ongoing commitment. Pilot fees and success-fee percentages are subject to contract.

We retain your commercial data only for as long as your tenancy is active or as you instruct. When you delete a tenant, or at the end of your engagement, the associated data is deleted from our systems within the period set out in your agreement. Audit-log metadata may be retained for a limited period where we are required to keep it. You keep the rulebook, variance maps and reports: you own the findings drawn from your data.

Every agent moves through draft, shadow, live and promoted. A draft runs in shadow, alongside live work and without affecting it, until a person reviews it at the human gate and promotes it. Your org admins approve promotions within your tenant, and FeeVerify's platform operators gate anything shared across tenants. The Orchestrator can draft a new skill when it finds a gap, but it never promotes one itself.