Finspector

Every function the company sells is inference: reading text, video and audio for regulatory risk, reading back through a social profile's post history, and adapting checks from a compliance manager's corrections. Take the models out and what is left is an upload form, a comments panel and an activity log, none of which anyone would buy. The company argues the point itself from the opposite direction.

It positions against general purpose assistants on the ground that those cannot process video or audio and were not built for financial promotion rules, which is an argument about model capability rather than workflow. This is an agent native product.

Low autonomy by construction, with the human decision preserved at every step and mechanisms rather than assurances behind it. The model surfaces risks and suggestions when a promotion arrives, a person approves or rejects through the dashboard, assignment and notification route work to a named reviewer, and every interaction is logged so the compliance trail is reconstructable.

The feedback mechanism is itself an oversight control, since it gives the reviewer a formal route to record that the model was wrong rather than only to override it silently. No threshold, confidence measure, recall figure or sampling audit is published. Reducing unnecessary flags is advertised as a benefit, which means a threshold is being moved without being described.

Accuracy is undocumented: no figure or benchmark is published, and no validation method or error rate. There is one partial disclosure. The company states publicly that feedback loops from its early pilots reduced false positive rates, which openly acknowledges that false positives existed and claims a direction of travel. It remains a direction without a baseline or a current figure, and with no measure of the failure that matters more, the promotion that breached and was never flagged. Reducing unnecessary flags, advertised as a feature, moves precision and recall in opposite directions, and only one of the two is ever mentioned.

The company is roughly eighteen months old and names no customer. No customer count or case study is published, and no independent evaluation. Its published outcome claims are conditional in its own wording, describing hours that could be saved rather than hours that were. The strongest material is a described early engagement in which two policy documents were converted into eighty two separate automated checks spanning several jurisdictions.

The customer is unnamed, and the figure describes configuration effort rather than result. Participation in a Scottish financial regulation innovation program is a cohort placement. One thing stands to its credit: the company publishes a candid account of its own development, including a count of feature requests taken from early users.

The product's central mechanism makes the boundary question unavoidable, and no boundary statement is published. Compliance managers correct the model where it was wrong, and the company states that the checks improve continuously from that feedback. Whose corrections improve whose checks is exactly what is left unsaid. If a firm's corrections tune only that firm's checks, that is an isolation architecture worth stating.

If they inform a shared model, competing firms are training a common detector on their own compliance judgments, which several of them would consider proprietary. The vendor has an easy answer either way and has not published it.

The scope reaches further than a marketing review tool would suggest. Continuous monitoring of social profiles, including reading back through post history, means processing the public output of identified individuals. The influencers and partners being screened are third parties with no relationship with the vendor, and in many cases no knowledge that a firm has pointed a compliance system at their account. Sales call review adds recorded conversations to the same platform. No privacy statement, lawful basis, retention rule or handling commitment is published for any of it, so nothing says how long monitored material is kept.

Security assurance is not public: there is no information security certification or audit report, and no penetration testing statement or trust center. Secure AI appears as a section heading in the product material, but what sits under it is the ability to enter custom rules. That is a configuration feature rather than a security property, and a reader scanning for assurance would take the wrong impression from the label. Absence from public material is not proof that nothing exists. For a company of this age, certification is more likely a roadmap item than an omission, and a stated roadmap would itself be a disclosure.

Finspector takes the correct technology supplier posture, and its rule engagement is specific rather than generic. The product is built around Financial Conduct Authority financial promotion rules and Consumer Duty, named directly and with the obligation stated correctly: a firm is required to demonstrate that every customer communication is clear, fair and not misleading.

It names the concrete failure modes it screens for, including mis selling, greenwashing and inadvertently giving regulated financial advice. No formal admission process is published. Participation in a financial regulation innovation program run by an industry cluster is a cohort placement, not a supervisory engagement.

The judgments being automated are openly subjective, and no governance framework or fairness position is published, nor any testing program or independent assessment. The company says as much itself when describing the problem it solves. Whether a risk warning is sufficiently prominent, and whether a communication is clear, fair and not misleading, are interpretive determinations that experienced compliance officers disagree about.

Automating a contested judgment makes it consistent without making it correct. A second exposure follows from the video and audio capability. Vision and speech models sit upstream of every judgment on that content, their accuracy varies with accent, production quality and language, and nothing is published per format.

The consequences land wholly on the firm, and no accuracy warranty, service commitment or remedy is published. A promotion the system passed and the regulator later intervenes on is the firm's breach. Under Consumer Duty, the obligation to evidence that a communication was clear, fair and not misleading cannot be delegated to a supplier. A second party sits further out: the influencer or partner whose account is monitored and whose post may be flagged.

That person has no contract with either side and no route to contest a determination made about their content. Nothing published describes a remedy, a correction path or a notification duty in either case.

No provider, base model, fine tuning approach or hosting arrangement is disclosed, and the omission is pointed given how the company positions itself. Its published argument is that general purpose assistants are inadequate for this work and that its own model is purpose built for financial promotion compliance. That is a claim about provenance and architecture, made without disclosing either.

A buyer persuaded by the argument still cannot tell whether the underlying system is a distinct model, a fine tune, or a general purpose model behind a domain specific prompt layer, which is precisely the distinction the marketing rests on.

Material reaches the platform by upload or by entering a social handle. No integration is named to a marketing resource management system, a digital asset store or a customer relationship platform, nor to a project tool or a governance system. There is no public API documentation or connector catalog. Continuous monitoring of the major social platforms is real inbound integration and the strongest element here. What is missing is the outbound half.

A compliance check that lives in its own window, rather than inside the tool where content is created, relies on someone remembering to run it, and better funded competitors spend their integration budget closing that gap.

The product runs as cloud software, and no hosting region or tenancy model is published, nor any residency option or subprocessor list. For this vendor the gap is commercial, not abstract. A British company selling to British regulated firms will meet the question in the first vendor assessment it is asked to complete, and United Kingdom data protection obligations make the location of processing and the identity of subprocessors a standard item. Nothing published answers it, and a young company has the least established practice for answering it in a sales conversation instead.

The route to a number is a demo request, with no public rate card, tier ladder or billing basis. That is more surprising than it would be for an enterprise vendor, because the stated buyer is the small and medium sized regulated firm. That buyer is the one most likely to abandon an evaluation rather than sit through a sales process to find out whether a product is affordable. For this segment a published entry price is a cheaper acquisition channel than a demo form, and its absence is a commercial choice rather than an enterprise convention.

Coverage is narrow rather than undisclosed. The named buyer types read broadly on paper: banking, insurance and wealth management, plus fintech, payment providers and digital banks. But the company is roughly eighteen months old and positions itself for small and medium sized firms, and no customer count, named institution or deployment at scale is published.

The one wide jurisdictional claim covers checks spanning the United Kingdom, Europe and Australia, and the United States, Asia and the Middle East. It came from configuring a single early client's own policy documents, so it describes that client's footprint rather than the vendor's coverage. The rule engagement itself is squarely British, built around Financial Conduct Authority promotion rules and Consumer Duty.