Skip to content
Start free

AI document review for banks, on your own servers

DocsGPT reviews, classifies and routes bank documents on the bank's own servers — including fully air-gapped on existing GPUs — with deterministic checks, cited AI steps and human approval for uncertain cases. A large Central European bank, whose name is under NDA, cut time-to-action from 24 hours to 16 minutes on 10,000+ documents a day.

Book a demoFree 30-minute on-prem review

Last updated:

Document review pipeline
  1. 01IntakePDF · scan · fax
  2. 02OCR & extractionDocling · Tesseract or DeepSeek-OCR
  3. 03Classification / checksLLM · regulation text
  4. 04Decisionclass + certainty score
  5. 05 · humanRouting or approvalCEL condition · below threshold → person
Text version

Five stages: documents arrive as PDFs, scans or faxes; OCR and extraction produce text and fields; an AI step classifies or checks them against regulation text; the workflow emits a decision with a certainty score; a CEL condition routes confident cases automatically and stops uncertain ones for a human approver.

The situation

  • Policy

    Cloud AI is ruled out by policy: data residency and supervisory expectations mean the model, the embeddings and the vector store must stay inside the bank.

  • Hardware

    The hardware is what is already in the racks — typically T4-class GPUs — so model size and inference have to fit existing capacity rather than assume new purchases.

  • Audit

    Decisions must reference current regulation and stay auditable, with a compliance officer approving uncertain cases and every approval recorded.

What DocsGPT does here

Workflow 01

Document classification and routing

Inbound PDFs, scans and faxes are OCR'd, then a Workflow classifies each document (AI Agent node), routes it on a CEL condition (If / Else node) and hands confident items on through a Code node — to a queue or an internal endpoint. The detector outputs a class and a confidence score; below a threshold the item stops for a person instead, and a rejected item is logged and not handed on.

OCR (Docling with Tesseract or DeepSeek-OCR) · Workflow builder · AI Agent · If / Else (CEL) · Code node · human approval

Built for the client · the bank's classification pipeline, the OCR tuning for degraded scans and handwriting, and the connection into the core-banking system.

Workflows →Knowledge →

Workflow 02

Transfer and payment review

Deterministic checks run as Code and Set State nodes (name and company matching, currency conversion, amount calculations); agent checks read the transfer purpose against regulation text held as a knowledge source. The End node renders the decision with its certainty score from a template; the approver report is generated as a versioned DOCX or XLSX artifact, and nothing is actioned until a person approves. Loan pre-screening and dispute intake follow the same shape: rigid calculations plus a qualitative reading against the rules.

Code · Set State · AI Agent · End node (decision) · DOCX / XLSX approver report · human-in-the-loop approval

Workflows →Guardrails & Human-in-the-loop →

Workflow 03

Scheduled compliance monitoring

Schedules run an agent once or daily, weekly, monthly or yearly, with run history and auto-pause, and each schedule names the tools that still need a person's approval. The agent reads submitted statements through the PostgreSQL connection (credentials encrypted, writes ask first) or the API tool, compares them with agreed thresholds and alerts the relationship manager through a webhook into the bank's own systems or a self-hosted ntfy server; Telegram is an option only where the deployment has internet egress, which an air-gapped bank does not. A policy lookup agent answers staff AML, KYC and GDPR questions with page-cited answers.

Schedules · tools that need approval · PostgreSQL connection · API tool · webhook / self-hosted ntfy · cited answers

Agents →Connectors →Search & Retrieval →

Workflow 04

Audit-ready archive and evidence

Every answer carries its citation (title, source, page). Guardrail activity records every block, redaction and flag; Admin › Activity is append-only and exports as CSV or NDJSON for a SIEM; the execution trace of each run shows which sources, tools and model steps produced a decision — the explanation a reviewer or supervisor asks for. Approver reports from transfer review are kept as versioned DOCX or XLSX artifacts, and an evidence-collector agent searches the archive to assemble a package for an auditor.

Citations · Guardrail activity · Activity feed (CSV / NDJSON) · execution traces · DOCX / XLSX artifacts

Guardrails →Admin, Security & Analytics →Artifacts →

Each bank workflow separates what is computed deterministically, what the model reads, and where a person approves.

Bank document workflows: deterministic, AI and human steps and the DocsGPT feature that runs each
 Deterministic stepAI stepHuman stepFeature
Document classification and routingOCR, CEL route on class and confidence, Code node hands confident items onAI Agent node outputs class + confidenceLow-confidence items stop for a reviewer; rejections are loggedWorkflows · If / Else · Code
Transfer and payment reviewName and company matching, currency conversion, amount calculations (Code, Set State)Transfer purpose read against regulation textApproval on the decision and the DOCX / XLSX approver report before any actionWorkflows · Guardrails
Scheduled compliance monitoringSchedule, threshold comparison via the PostgreSQL connection or API toolAgent reads statements and writes the alertRelationship manager acts on the alert (webhook or self-hosted ntfy)Agents · Schedules
Audit-ready archive and evidenceAppend-only Activity feed (CSV / NDJSON), run tracesEvidence-collector agent searches the archiveAuditor receives the versioned packageAdmin · Artifacts

Core-banking integration and OCR for degraded scans are project engineering, not listed features; the Code node hands items to a queue or endpoint the bank already exposes.

Classification and routing workflow · one run
  1. startStartdocument · OCR'd text
  2. ai agentClassifyclass + confidence
  3. if / elseRouteclass · confidence
  4. codeHand offqueue or internal endpoint
  5. endEndrun logged
humanHuman approvalapprove → hand off · reject → logged only
Text version

1. Start (a document with OCR'd text) → 2. Classify (AI Agent node: class and confidence) → 3. Route (If / Else node on class and confidence) → 4. Hand off (Code node: queue or internal endpoint) → 5. End (run logged). Branch from Route when confidence is below 0.8: Human approval; approved items return to Hand off, rejected items are logged and not handed on.

app · agent run · approval prompt
app · agent run · approval prompt
app · agent · Guardrail activity
app · agent · Guardrail activity

Evidence

Results from named deployments, with the source.

24 h → 16 min

A large Central European commercial bank processes 10,000+ inbound documents a day; time-to-action fell from 24 hours to 16 minutes, with over 99.5 % classification accuracy, running fully air-gapped on the bank's existing NVIDIA T4 GPUs.

Source: EU bank, name under NDA

1–2 days → ~5 min

Transfer-document review that took 1–2 working days (P95) now completes in about 5 minutes, with 12 deterministic and agent checks and human approval for uncertain cases.

Source: Bank (POC), name under NDA

How it is deployed

Air-gapped is the usual posture here: zero-egress mandates.

Banks run DocsGPT fully local: a local inference engine (Ollama, vLLM or llama.cpp), local embeddings, pgvector or FAISS, and local disk or a self-hosted S3-compatible store for files, with zero external network. It ships as Docker Compose or Kubernetes manifests and signs staff in through OIDC SSO with SCIM provisioning and role-based access. On-premises with a cloud LLM is also possible where policy allows — that is a hybrid posture, not air-gapped.

Documentation

What a first project looks like

Scope, measure, then decide.

  1. 01

    Pick one document class or one review type

    Together with a sample set that already has known outcomes, so accuracy can be measured rather than judged.

  2. 02

    Build the benchmark suite with the bank's subject-matter experts

    Assertions on cited sources, content and latency, run from the CLI.

    docsgpt-cli bench

  3. 03

    Stand up on the bank's hardware and select the local model by benchmark

    The POC compared 5+ open-source models on the bank's own test set before choosing one.

  4. 04

    Build the workflow

    Deterministic checks, agent checks and the approval report, with the certainty threshold agreed with compliance.

  5. 05

    Run against the baseline

    Measure time-to-action and classification accuracy on the sample set against the current process.

  6. 06

    Production hardening

    SSO, SCIM, roles, usage quotas, Activity export, traces into the bank's monitoring, the security checklist, backups, and the runbook for the bank's operators.

    docsgpt backup · docsgpt doctor

A proof of concept is typically stood up within a week, with production readiness targeted at about 30 days. On-premises and air-gapped work is priced from $10,000 — see pricing.

Related

Frequently asked questions

What is the best AI tool for regulatory compliance?

There is no single best tool; for banks the qualifying test is whether it runs inside your network, cites its sources and lets a compliance officer approve uncertain decisions. DocsGPT meets those three tests and is open source (MIT), so the bank can inspect the code it runs.

Can SOC 2 compliance be automated?

Not fully: SOC 2 is an audit of your controls, and no software certifies you. DocsGPT supports the evidence side — an exportable audit log, Guardrail activity, run traces, cited answers, versioned outputs — but does not hold or grant a SOC 2 report itself.

Can a bank run AI without sending data to the cloud?

Yes. DocsGPT runs with a local model, local embeddings and a local vector store, with zero external network; one bank runs it on its existing NVIDIA T4 GPUs.

How are uncertain cases handled?

The workflow produces a decision with a certainty score; below a threshold it stops and generates a report for a human approver, and nothing is actioned until approved. Each decision is recorded with the run.

Which models does it use?

Any: open-source models served locally (Qwen, Llama and others via vLLM or Ollama) or cloud providers where policy allows. Model choice is made by benchmark against the bank's own test set.

See DocsGPT on your documents

A 30-minute demo on your use case, or a free on-premises review with an engineer.

Book a demoFree 30-minute on-prem review