H

Hadrius

The models are the proposition and the vendor argues the point itself: if AI is generating the communications, the marketing and the trades, only AI can review them at the same scale. Every module's described value is a machine determination. Marketing review reads content against the firm's rules and disclosure requirements and routes it for approval. Communications supervision normalises threads across more than sixty channels and cuts false positives, which the vendor puts at 99 per cent against legacy tools.

Account surveillance runs pattern tests over employee and firm trading against restricted lists and blackout windows and escalates what matters. The testing programme, attestations and branch examinations sit around those determinations as workflow. Strip the models out and what remains is an archive and a task tracker, which is what the platform is sold against. The agreement calls the same thing by its plainer name, describing AI-generated compliance outputs, automated approvals and recommendations. Verified 20 September 2026.

Six outcome figures are published and none of them measures whether the determinations are right. The estate carries 99 per cent fewer false positives, a 96 per cent reduction in time spent on communications supervision, a tenfold reduction in marketing review cycle time, 19-plus hours gained back weekly per user, $3,900 average annual cost reduction per representative, and $5 trillion in assets across more than 500 firms.

Not one carries a period, a sample, a baseline or a method. Nothing addresses the failure that matters most in supervision, which is the violation the system does not flag. The agreement is candid where the marketing is not, stating that the services use artificial intelligence which is inherently not error-free, that outputs are informational only, that no warranty is given as to their accuracy, completeness or reliability, and that the customer must independently verify every AI-generated output before relying on it. Verified 20 September 2026.

The review point is stated and the thresholds belong to the customer. The vendor's own framing is a system of record that executes compliance operations under human governance, and the agreement puts that in enforceable terms: AI-generated outputs, automated approvals and recommendations are informational only, the customer must independently verify them before relying on them, and the vendor disclaims liability for regulatory penalties arising from reliance on automated outputs without independent review by qualified compliance personnel.

Escalation and routing are described, with the AI triaging risk so reviewers clear supervisory queues in priority order. Two things hold it here. The controls are the customer's to set: the agreement makes the firm responsible for configuring surveillance rules, alert thresholds, restricted securities lists and retention periods, and says the vendor does not warrant that any configuration satisfies the firm's regulatory obligations.

And automated approvals are referred to without any published description of what may be approved without a person. Verified 20 September 2026.

Named firms, named officers and real figures, never joined to each other. Five customers are quoted on the home page through the person accountable for the programme: Tealee Hinger, Chief Compliance Officer at M1 Finance; Robert Spake, Chief Compliance Officer at Republic Capital; Michael Schmidtke, Chief Compliance Officer at Csenge Advisory Group; Laurie Williams, Deputy Chief Compliance Officer at SmartAsset; and Raymond Gettins, Director at United Advisor Group.

Three case studies are published, for Stirlingshire Investments, Lifemark Securities and Arrived, the last headlined as a tenfold reduction in weekly marketing review time. Scale is claimed at more than 500 institutions and $5 trillion in assets under management, with fifteen further customer logos. What is missing is the join and the method: no figure is attached to a named firm on the surfaces read, and no measurement period or baseline is given for any of them. Verified 20 September 2026.

Substantive written commitments, readable before signing, with the training carve-out as the thing to weigh. The Master Services Agreement carries mutual confidentiality on a need-to-know basis with no less than reasonable precautions; deletion of the other party's proprietary information promptly after termination, subject to record-keeping law; and a compelled-disclosure clause requiring reasonable prior notice so the disclosing party can contest the order.

The customer retains ownership of its inputs and is assigned the outputs. A data processing agreement is incorporated by reference and available on request, and the privacy policy is explicit that communications content, trading activity and employee information are processed solely on the customer's instructions with the customer as controller. Against that: the agreement permits the vendor to use inputs and outputs to improve its products, including to train AI models, once aggregated and anonymised. No subprocessor list was located and privilege is not addressed. Verified 20 September 2026.

The advice line is drawn in the agreement, in terms, and it names the professional who has to do the checking. The Master Services Agreement states that AI-generated compliance outputs, automated approvals and recommendations are provided for informational purposes only and do not constitute legal, regulatory or professional compliance advice; that the customer must independently verify all AI-generated outputs before relying upon them and assumes sole responsibility for decisions based on them; and that the vendor disclaims liability for regulatory penalties arising from reliance on automated outputs without independent review by qualified compliance personnel.

A separate clause states that the service is designed to assist with SEC and FINRA compliance but does not guarantee compliance, and that the customer remains solely responsible for all compliance obligations, regulatory filings and supervisory decisions. Configuration is handled the same way: the vendor gives implementation assistance and does not warrant that any configuration satisfies the firm's regulatory obligations. Who the product is for, what it is not, and whose judgement governs are each stated. Verified 20 September 2026.

A governance posture is stated and no mechanism sits behind it. The published position is that the platform executes compliance operations under human governance, that the AI is policy-aware and configured to each firm's compliance manual, and that it runs on zero-data-retention AI; the agreement adds an acknowledgement that artificial intelligence is inherently not error-free. The vendor also publishes a recorded session for compliance officers on what AI can and cannot do in automating compliance work, which is education for buyers rather than a statement about its own model.

Nobody inside the company is named as accountable, nothing is published about what is tested before a change ships, and there is no disclosure of whether output differs across channels, languages, firm types or the populations an adviser communicates with. On a product whose false-positive rate is its headline claim, the absence of any published testing regime behind that number is the gap. Verified 20 September 2026.

Most of the ground is covered, and the incident clause is stronger than most in this index. Published: TLS 1.2 or above in transit and AES-256 at rest, role-based access control, multi-factor authentication and single sign-on, firewalls, intrusion detection and vulnerability scanning, employee training and confidentiality undertakings. Retention is the customer's to set, with the agreement making the firm responsible for configuring retention periods to its regulatory requirements, alongside write-once archiving to the 17a-4 standard.

The AI layer is described as zero-data-retention. The agreement commits to notifying the customer within seventy-two hours of confirming a security incident involving data subject to Regulation S-P, providing written detail of the incident's scope, preserving forensic evidence, producing incident reports suitable for regulatory examination and cooperating with the customer's own notification obligations. The gaps: no subprocessor list was located, and the security page itself would not render. Verified 20 September 2026.

A real published position, and the exposure the product creates sits outside it. The Master Services Agreement carries a mutual indemnity with stated scope: the vendor defends claims that its underlying software infringes third-party intellectual property, the customer defends claims arising from its own use and its inputs, with six carve-outs and a defined procedure. Liability is capped at the fees paid or payable in the twelve months before the claim, with consequential, indirect, punitive and lost-profit damages excluded both ways and indemnification obligations sitting outside the cap.

The vendor warrants that the services will be provided in a professional and workmanlike manner by qualified personnel. What is expressly excluded is the loss a compliance officer would actually fear: the agreement states that the vendor is not liable for regulatory enforcement actions, fines or sanctions imposed on the customer or its personnel, and disclaims liability for penalties arising from reliance on automated outputs without independent review. No insurance is referenced. Verified 20 September 2026.

The systems this work actually lives in are named, in the agreement rather than on a logo wall. The agreement lists what a customer connects: email through Gmail and Microsoft Exchange, communication platforms including Slack, WhatsApp, LinkedIn and Telegram, and financial data providers including Plaid for brokerage account feeds. The estate puts the count at more than sixty communications channels captured, supervised and archived in real time, and a July 2026 integration adds Claude Enterprise, pulling employee conversations from that platform into the same books-and-records archive.

What is not published is depth: nothing describes what syncs in which direction, what a firm must configure beyond the agreement's statement that permissions, authentication and access controls are the customer's responsibility, and no developer documentation or API reference was located. The agreement is also frank that third-party integrations are a convenience, that continued availability is not guaranteed, and that the vendor is not liable for data gaps arising from them. Verified 20 September 2026.

Cloud delivery is implied throughout and neither half of the question is answered. Nothing published states where the data sits: no region, no country, no cloud provider, and no residency option for a firm with obligations outside the United States, although the agreement's export control clause bars access from embargoed countries. Nothing published states how customers are separated from one another either: no tenancy model, no single-tenant or private option.

The one separation fact that is published sits inside an account rather than between accounts, in the multi-tenant workspaces offered to compliance consultants so they can run several client firms from one login, and in the branch and org-chart structure. The page where residency would normally sit, the vendor's security page, returns navigation only because the site renders client-side, and one search on its own vocabulary recovered nothing; that limit is recorded rather than read as an absence. Verified 20 September 2026.

Standards are named and no route to the evidence was found. The footer carries three marks on every page: ISO 27001, the AICPA SOC badge and GDPR, and the security page's own published description names SOC 2 compliance alongside bank-level encryption and zero-retention AI. Named standards put this above the floor, which is reserved for a site claiming certification without naming one. What is absent is everything a buyer would check them against.

No audit period, no scope or coverage statement, and no auditor is published anywhere. No trust centre exists and no request route for a report was located, so nothing is shown to be obtainable with or without a sales conversation. The security page itself returns navigation only, the site being client-side rendered, and one search on the vendor's own security vocabulary recovered no body text; that retrieval limit is recorded rather than treated as an absence.

What is contractual rather than certified is the incident clause, recorded on the stewardship row. Verified 20 September 2026.

A retention promise is made about model providers who are never identified. The estate repeats that the platform is powered by zero-data-retention AI and that supervision runs through privacy-first, zero-retention models, which is a commitment about what a provider may keep. No provider, model or version is named anywhere for the review engine, nothing says where inference happens, and nothing commits to telling customers when any of it changes.

One name does appear and it is not the model behind the reviews: a July 2026 integration with Claude's Compliance API pulls employee conversations out of Claude Enterprise into the archive, which makes that platform a source of records to supervise rather than the engine doing the supervising, and it is recorded as an integration. The agreement adds nothing on the point beyond permitting the vendor to train on aggregated and anonymised inputs and outputs. Verified 20 September 2026.

The shape is visible and the number is not. Six modules are published as separate solutions, testing programme, marketing, people oversight, communications, account surveillance and branches, so a buyer can see what the product is divided into. The agreement names the billing structure: fees are set in an order form, invoices fall due within thirty days, past due balances carry the lesser of 1.5 per cent a month or the legal maximum, order terms renew automatically for successive twelve-month periods unless either side gives thirty days' notice, and fees can be raised on thirty days' notice at renewal.

The audit clause names the unit in passing, requiring the customer to keep records of user counts and module usage relevant to its payment obligations. No rate, band, minimum or implementation figure is published anywhere, there is no pricing page in the navigation or footer, and the only route is a demo request that asks for firm size in four bands. Verified 20 September 2026.

Four buyer segments, each tied to the rules it answers to, and no statement of where the product stops. Broker dealers get supervision under FINRA Rules 3110, 3120 and 3130 with 17a-4 and write-once retention and evidence for the chief executive's annual certification. RIAs get SEC Rule 206(4)-7 operationalised, with programme testing, annual reviews and Marketing Rule workflows. Private funds get personal trading surveillance against restricted lists and blackout windows with Code of Ethics attestations and conflict tracking.

Compliance consultants get multi-tenant workspaces to run several client firms. Firm size is addressed from one to fifty users up to more than five thousand on the demo form, and the named customers span a large retail broker, a wealth platform and small advisory groups. What is absent is the boundary: nothing says which regimes are out of scope, and a firm with banking, insurance or non-US obligations is left to infer. Verified 20 September 2026.