Red Oak Compliance vs Saifr: how they compare in 2026

Models now drive a core capability, and the platform beneath them still runs without them. Red Oak calls itself an agentic compliance platform, and two products rest on models. Mira, the supervision agent from MirrorWeb, reads each captured message in context against the firm's own handbook rather than matching keywords, scores each flag for severity and traces it to the clause that triggered it, and Red Oak credits it with 98 percent fewer false positive alerts. AI Review reads marketing against the firm's policies and lexicon before a reviewer opens it. The rest of the platform is workflow and record keeping, from routing and approval, the disclosure library and distribution through 4U to capture from more than thirty channels, WORM archiving and registration and complaint management. Those served the market for years before the models arrived, and they would still work as a review and archiving system with the models removed.

Saifr sells what it calls AI agents for compliance. SaifrReview detects compliance risks in marketing text, images and video, explains them and suggests more compliant wording. SaifrScreen runs cascading language models over adverse media and sanctions data, and Saifr eComms applies large language models to archived communications. Four Saifr models and a compliance agent are also offered on their own in the Microsoft Azure AI Foundry catalog for developers at financial firms and technology companies, and a Saifr agent works inside Superhuman Go, so the models themselves are what is sold. The collaborative review workspace around SaifrReview exists to act on what the models flag.

Accuracy is asserted without measurement, and the grounding points to the firm's own handbook. Mira traces each flag to the policy and handbook clause that triggered it and shows its reasoning, so a reviewer sees which rule applies. AI Review flags language against the firm's policies and lexicon. The published figures measure speed and noise rather than correctness. Red Oak cites 98 percent fewer false positives and 80 percent less review time with Mira, and 3.3 times faster content approvals and 70 percent fewer compliance touches with AI Review, the approval figure reported by clients. None carries a sample, a period or a method, and nothing measures the missed violation. The agreement states the limit plainly. AI outputs may be inaccurate, incomplete or unreliable, may resemble third party content, are not guaranteed free of errors, and must be reviewed and validated by the client before use.

Accuracy is claimed without a test behind it. SaifrReview's page says it can instantly detect up to 90% of what a human would, and the Adobe and insurance pages repeat the figure. No test set, sample, definition of a miss or false positive rate is published, and the missed tenth is not described. The review flags risks by category, such as promissory or exaggerated language, performance claims, rankings and testimonials, and the Azure page says the models give a rationale for each detection. The banking version cites the regulation behind each flag, and video flags carry their timestamp. According to Saifr's FAQ, outputs were validated by subject matter experts during development. SaifrScreen's claim of up to seven times more potential bad actors rests on a 2021 assessment with an unnamed large financial institution, and the page says results may vary.

The agreement says the AI is designed to assist human reviewers. It makes the client solely responsible for reviewing and validating every AI output, by human review included, before any use or reliance, and bars using AI outputs in regulated decision making without appropriate human review and oversight. It also bars connecting AI agents or autonomous processes to the AI features without Red Oak's written permission. The product follows the same line. AI Review gives submitters feedback before a reviewer opens the piece and suggests fixes that reviewers accept or reject. Mira routes each flag to the right reviewer with the clause behind it, supports escalation to a senior reviewer, and drafts policy refinements from reviewer decisions that change nothing until the firm's chosen approver signs off. Nothing published sets a threshold at which the AI stops, or says what happens to material the AI passed that a regulator later faults.

SaifrReview is described as an extra set of AI eyes that flags recurring risks so reviewers save rounds of review, inside a collaborative review tool, and Saifr states keeping a person in the loop as a principle. The Adobe page says all compliance responsibilities remain the user's. No control structure is published: whether content can be approved on a clean scan without a person, how a reviewer records acceptance or rejection of a flag, or what happens when the AI misses a violation that a regulator later finds.

Scale is claimed, and none of it is attributed. Red Oak says more than 1,550 regulated firms use it, including 37 of the top 40 global asset managers, with about $101 trillion in client assets, an 84 Net Promoter Score and sixteen years serving regulated firms. Logos for Blackstone, Dimensional Fund Advisors, Fidelity Investments, J.P. Morgan, State Street, BNY, Raymond James, Lazard and USAA appear beside that claim, with no account of what any of them uses. The outcome figures carry no named firm, period or method. They are 98 percent fewer false positives and 80 percent less review time with Mira, and 3.3 times faster approvals and 70 percent fewer compliance touches with AI Review. The July 2026 combination announcement gives other numbers for the same claims, 17 of the top 20 asset managers and more than $62 trillion in assets. No client story naming a person and a result is published.

Outcomes are described, and the customers behind them are not named. One case study describes a large retail financial services firm whose marketing team drafts more compliant first versions and cut a full day from video reviews using SaifrScan and SaifrReview. Another describes a fintech platform for alternative investments with more than $4 trillion in assets under management that handles high content volumes. Neither is named or dated. SaifrScreen's page says one client monitors 50 million customers with 2.5 analysts, without naming it. The home page quotes Lisa Johnson, Associate Vice President of Regulatory Compliance at Nasdaq, on a smooth implementation delivered on time. Saifr lists awards from 2024 to 2026, such as RegTech 100 and the AI Breakthrough Award.

Confidentiality is committed in a published agreement, and the training position rests on product pages. The master services agreement carries mutual confidentiality for information marked confidential or that a reasonable person would see as confidential. It limits access to people who need to know and are bound by equal duties, and lasts three years after termination and longer for trade secrets. A legal process clause commits Red Oak to prompt written notice of a subpoena or similar demand, unless the law forbids it, so the client can seek a protective order, and to disclose only what is specifically requested. The client owns its data, and Red Oak's license is to provide the services. Against that, Red Oak may create deidentified client data and use it for any and all purposes during and after the term, and may keep client data after termination under its own retention policies. The statement that customer content is never used to train AI models sits on product pages rather than in the agreement. Nothing addresses segregation between clients, privilege, work product or what a model provider may keep.

Products such as SaifrReview require separate supplemental agreements under Saifr's website terms of use, and those agreements are not published. The privacy policy covers the website and applications, uses personal information to provide and improve the services and develop other products, and names no processors. Nothing published states how marketing drafts, communications or screening data submitted by a client are kept confidential, whether they train shared models, or how privileged material in surveilled communications is handled.

A real position on advice and tooling sits in the agreement, short of naming the regimes it covers. The master services agreement says the AI functionality is designed to assist human reviewers and should not be used for legal, financial, tax or other professional advice, decisions or recommendations without review by qualified professionals. The client is solely responsible for reviewing and validating every AI output before use and for decisions made in reliance on it, and may not use AI outputs in regulated decision making without appropriate human review and oversight. Red Oak is not responsible for the client's compliance with state and federal laws, which stays with the client alone, and it makes no investment recommendations. What is not stated is which regulatory regimes the product is built for and where it stops, and no clause ties the review duty to a named rule.

Saifr's FAQ, its product pages and its Azure page say its products and models are not intended to replace the user's legal, compliance, business or other functions, or to satisfy any legal or regulatory obligations, and that certain communications may require review and approval by properly licensed individuals. The partner pages add that all compliance responsibilities remain the user's. Saifr also says it is not a consumer reporting agency, and its products may not be used for background checks or eligibility decisions. Its website terms of use add that no legal, compliance, tax or insurance advice is given on the site. Nothing covers how the product fits the supervisory duties of the compliance staff who approve communications, or marketing staff relying on a clean scan without compliance review.

Principles for the AI are published, and no mechanism for governing the models sits behind them. Red Oak's AI approach page sets out that a person makes every review decision, that every policy update the AI drafts waits for an administrator's approval, that improvements stay inside the firm, and that every classification, routing step, escalation and resolution is logged with the reviewer's name. It says plainly that its compliance grade AI label is not a certification or a regulatory approval. What is not published is how Red Oak governs the models themselves. No owner of the AI is named, nothing describes testing or evaluation before a model or prompt change reaches customers, and nothing addresses whether flags differ across content types, channels, languages or the people an adviser serves. The agreement adds that outputs may be inaccurate, incomplete or unreliable, and that other users may receive similar output.

Principles are published, and the mechanism behind them is thin. The about page sets out five responsible AI principles, among them that people stay accountable for every decision with a person in the loop at all stages, and that data collection and use should be transparent and as representative and unbiased as possible. Subject matter experts review the training data and validated the outputs to help mitigate bias. When a regulation changes, Saifr's compliance and data science teams fine tune and validate the models with those experts. No accountable owner, governance body or testing regime before release is published, and nothing reports what bias testing found.

All client data is stored in the United States, though a limited number of Red Oak and vendor personnel may reach it from abroad to provide the service. Either party must report a security breach involving client data or confidential information within seventy two hours of confirming it. Records sit in WORM storage, administrators set retention by communication type, and access runs through single sign on and role based permissions. After the agreement ends, Red Oak may keep client data under its internal retention and compliance policies or as the law requires. The client may export its data free for thirty days, and a charge applies after that, and no express duty to delete client data is stated. The legal center lists a subprocessor list by contracting company and a data processing addendum; outside those two documents, no subprocessor is named and no encryption standard is published. Security and data handling detail is pointed to a trust center hosted on MirrorWeb's domain.

The privacy policy, effective June 2026, describes physical, administrative, technical and organizational measures, names categories of service providers but no processors, states no retention periods and gives no location for data. Nothing published says how submitted marketing content, communications or screening results are deleted, or which providers process them. SaifrScreen indexes names apart from adverse media sources, which Saifr presents as a privacy measure, and takes customer populations by API or secure bulk upload. Beyond that, the SOC 2 Type 2 attestation for SaifrReview and SaifrScreen is the one independent check.

A real published position, and it leaves the AI's errors with the customer. The master services agreement has Red Oak defend third party claims that the services as it provides them infringe a copyright, trademark, trade secret or patent. Exclusions cover client data, use outside the agreement and combinations with other products, and Red Oak may modify the service or end the subscription and refund prepaid fees. That indemnity is the client's exclusive remedy for infringement. Red Oak warrants that the services contain the functionality described in its documentation, and the remedy is repair, reperformance or a pro rata refund. Liability is capped at the fees paid or payable in the twelve months before the first event, with indirect, consequential, punitive, special, lost data and lost profit damages excluded, and the cap applies to every claim, the indemnity included. For the AI, Red Oak disclaims all liability arising from the client's use of or reliance on AI outputs, and the client is solely responsible for reviewing and validating them. No insurance is referenced. Disputes go to arbitration in Delaware under Delaware law.

The only published agreement is the website terms of use, last modified February 2023, which cap Fidelity Labs' liability for the website at $100. They say products are governed by separate supplemental agreements, which are not published. The FAQ's statement that the products are not meant to satisfy legal or regulatory obligations disclaims reliance without allocating loss. No indemnity, warranty or cap for the product itself is published, so who bears the loss when the product misses a violation or flags wrongly is not addressed.

Named connections, described by what they move, short of setup detail. Review records file directly to FINRA's AREF system from the workflow, and comment letters are retrieved and stored with them. A FINRA API carries registrations, licenses and CRD records, and FINRA charges separately for that access. A disclosure API sends approved disclosure language out, and Seismic, Adobe Workfront and Adobe Experience Manager exchange approved content, disclosures, submissions and review markups with the platform. Capture covers more than thirty channels, each provisioned in about a minute. Email from Microsoft 365, Exchange and Google Workspace arrives by journal copy with full body and attachments, Bloomberg chats and mail by a daily file through the firm's SFTP, ICE Chat and Symphony every twelve hours, WhatsApp by phone enrollment, and social accounts by enrollment. Teams, Slack Enterprise Grid, Zoom, iMessage, LinkedIn, X, Facebook, Instagram, TikTok, YouTube and generative AI tools are captured too. What is missing is depth for an implementer. No setup guide or developer documentation is published, and nothing states what a firm configures for each connection.

SaifrReview runs inside the tools where marketing is written. Saifr's FAQ names Microsoft 365, Google Docs, Figma and PDF among its integrations, with API access across products. Inside Adobe GenStudio for Performance Marketing, compliance scans run on generated content with suggested rephrasing, and Saifr is a Silver Adobe Technology Partner. A Saifr Communications Compliance Agent flags risky wording as people type in Superhuman Go. In ServiceNow Financial Services Operations, the Saifr Entity Risk Intelligence agent sends AML and KYC risk alerts to case management teams. SaifrScreen takes customer and vendor populations by API or by secure bulk upload, and the eComms API works with a firm's archive to flag a message once it is archived. No documentation describes what each integration stores, which permissions it needs or how results return to the system of record.

The storage country is stated, and the rest of the deployment picture is not. The master services agreement says all client data will be stored in the United States, and that a limited number of Red Oak and vendor personnel may access it from outside the United States to provide the services. The service is delivered as a cloud subscription. Nothing names the cloud provider or region, describes the tenancy model, or offers single tenant, private or on premises options. Nothing separates where the AI processes content from where records are stored. No residency choice is offered for firms outside the United States, although the combined company now has an office in Manchester and its privacy policy covers transfers between its affiliates.

A web tool, add ins and an API deliver the product, and neither tenancy nor region is stated. Selected Saifr models are listed in the Azure AI Foundry catalog, and the Azure page does not say where those models run or whether a customer's data stays in its own Azure environment. The privacy policy does not state where data is stored or transferred. No hosting provider, data center location, tenancy model or region choice is published for Saifr's own service.

No independent security attestation is named on Red Oak's own pages. Red Oak points buyers to a trust center hosted on MirrorWeb's domain for access, security and data handling, and its product pages describe single sign on, role based access and WORM storage for every record. The agreement commits to breach notice within seventy two hours and to storing client data in the United States, and the privacy policy describes physical, electronic and procedural safeguards meeting federal and state standards. None of that is a third party's examination. No SOC 2 report, ISO 27001 certificate, audit period, auditor or penetration test is named on any Red Oak page or in its product terms. A chief information security officer, Phil Clegg, is named among the leadership.

Saifr's FAQ says SaifrReview and SaifrScreen are SOC 2 Type 2 certified, which involves an annual independent audit testing and validating security and privacy controls. No auditor, audit period or route to the report is published, Saifr eComms is not named in the scope, and no trust center is published.

The AI is described, and the models underneath are not identified. Red Oak's pages describe AI Review and Mira by what they do, and the agreement defines its AI functionality to include large language models, but no provider, model family or version is named. Nothing says where inference runs, and no commitment is made to tell customers when a model changes. ChatGPT and Claude appear only as tools whose employee use Red Oak captures for supervision, not as the engines behind its own features. The agreement forbids clients from trying to reconstruct the architecture, weights, parameters or training data of any model used in the services, which confirms the models are there without saying whose they are.

Training data is described product by product, and the models underneath are not named. SaifrReview was trained on compliance curated data from more than 20 years of work by marketing and compliance experts and content creators in financial services. SaifrScreen's text models were trained on publicly available web documents, with client specific relevancy models trained on client feedback, and its product page describes cascading large language and natural language processing models that feed one another. Saifr eComms applies specialized large language models trained on sources that include open source and synthetic data. Four Saifr models went into the Azure AI model catalog in November 2024, named Retail Marketing Compliance, Suggested Language, Risk Interpretation and Image Detection, and a compliance agent followed in May 2025. No base model, external model provider, hosting location or change notice is named.

The structure and units are published in the terms, and no figure is. Red Oak's product terms set the compliance platform fee by the assets under management of the client's own customers, and count usage in books and records units, one consumed per submission, with attachments able to add more. A client that exceeds its tier moves up automatically and is billed the full difference without proration, for up to two tiers, before usage is billed at current prices. The distribution platform is priced by total firm assets and content record tier and invoiced annually in advance. FINRA charges separately for its own API. The master services agreement treats the order form quantities as a minimum annual commitment billed in advance, measures usage monthly and invoices overages quarterly. Unit rates rise by 5 percent on each anniversary, and terms renew for a year at a time unless either side gives sixty days' notice. No rate, tier boundary or implementation fee is published, and there is no pricing page, so the route to a number is a demo request.

The unit of charge is stated for two products, and no figure is published. SaifrReview, including the banking and insurance versions, is licensed per user or for the enterprise, and buyers are directed to sales. SaifrScreen's pricing is volume based, again through sales. No price, tier, minimum or implementation fee is published, and nothing is said about pricing for Saifr eComms, the Superhuman agent or the Azure catalog models. There is no pricing page.

Segments and the rules behind them are named, and the boundary is not. Red Oak sells to small and mid sized firms and to enterprises across broker dealers, registered investment advisers, asset managers, wealth platforms and the distributors that share approved content with them. It says 37 of the top 40 global asset managers use it among more than 1,550 regulated firms. The rules named run from SEC Rule 17a-4 for broker dealers and Advisers Act Rule 204-2 for advisers to FINRA filing through AREF and registrations through the FINRA API. Use cases cover books and records, off channel communications, exam readiness, and investigations and regulatory requests. Partners include consultants, implementation partners and more than 300 wealth and investment firms connected through 4U. What is absent is the boundary. Nothing states which regimes or firm types the platform does not serve, and coverage of rules outside the United States is not described, despite the Manchester office.

Segments and the rules behind each version are named, and the edges are not. According to the FAQ, SaifrReview serves United States financial institutions and life insurance and annuity providers, with versions for retail financial services, banking, and life insurance and annuities. The retail version checks FINRA Rule 2210 for broker dealers, the SEC Marketing Rule for advisers and SEC Rule 482. The banking version covers marketing for checking and savings accounts, credit cards, auto loans, mortgages and home equity products against Reg E, Reg Z, Reg DD and UDAAP, for banks, credit unions and other consumer finance companies. The insurance version works from NAIC model laws MDL-880 and MDL-570 and the advertising parts of MDL-245. SaifrScreen serves United States and multinational firms with AML, KYC and trust and safety programs, including ride sharing, home sharing and delivery marketplaces, across sources in 190 countries and 160 languages. Saifr eComms serves United States financial institutions. Saifr's products may not be used for background checks or for credit, insurance, employment or tenancy decisions. What stays open is the rest of the boundary, such as which languages review supports and whether any rules outside the United States are covered.