Built for Regulated Industries

Trust & Security

QuickBrief is architected from the ground up for compliance-critical environments. Every design decision prioritises auditability, determinism, and regulatory defensibility.

Core Security Principles

AI is Never the Source of Truth

Deterministic

Our diff engine uses pure cryptographic hash comparison (SHA-256) to detect sanctions changes. AI only summarises what the deterministic engine has already verified. No hallucinations. No guesswork.

RFC 8785 Canonical JSON

Standards-Based

All audit events are serialised using RFC 8785 canonical JSON before hashing. This guarantees byte-identical output across TypeScript and Python, ensuring cross-service hash consistency.

Immutable Hash Chain

Tamper-Evident

Every event includes the previous event hash, creating a tamper-evident chain. Any modification to historical data breaks the chain and is immediately detected by our health monitoring.

1-Minute Health Checks

Proactive

Automated chain verification runs every minute, checking the last 100 events for hash consistency. Full chain verification available on-demand. Any integrity failure triggers immediate alerts.

Confidence-Gated AI

Fail-Closed

AI-generated briefs are automatically scored for confidence. Low confidence (<85%) briefs are rejected. Medium confidence (85-94%) requires MLRO review. Only high confidence (≥95%) briefs can be auto-approved.

Zero-Trust Architecture

Defence in Depth

All API requests are authenticated via signed JWTs. Both the web application and API backend independently verify authentication. No implicit trust between services.

RFC 8785 Canonical JSON — Technical Deep Dive

Why Canonical JSON?

Standard JSON serialisation is non-deterministic — key ordering and whitespace can vary between implementations. RFC 8785 defines a canonical form that guarantees identical byte output regardless of programming language or library.

QuickBrief uses RFC 8785 to ensure that SHA-256 hashes computed in TypeScript (web) and Python (API) are byte-identical, maintaining chain integrity across services.

Implementation Details

1. Keys sorted alphabetically (UTF-16)
2. No whitespace between tokens
3. Integers: no leading zeros, no +
4. Strings: minimal escaping
5. null values preserved
{"action":"CREATE","eventType":"INGEST"}

How We Process Sanctions Data

Step 1
Source Data
UKSL, OFAC, EU, UN
Step 2
SHA-256 Hash
Deterministic
Step 3
Diff Engine
No AI
Step 4
AI Summary
Confidence-gated
Step 5
MLRO Review
Human decision

AI is only used in Step 4 to summarise changes that have already been deterministically identified. The AI never decides what changed — it only explains changes the hash-based diff engine found.

Compliance Features

Built for FCA-regulated firms and enterprise compliance teams

RFC 8785 Canonical JSON

Deterministic JSON serialisation ensures identical hashes across all services. Keys sorted alphabetically, consistent whitespace handling.

SHA-256 Hash Chains

Every audit event is cryptographically linked to its predecessor. 285 events verified and healthy as of Jan 28, 2025.

RFC 3161 Timestamps

Critical events can be timestamped by trusted third-party authorities for legal non-repudiation.

Full Event Sourcing

Complete history of all sanctions changes, briefs, and user actions. Nothing is ever deleted.

Export for Auditors

Audit trail export (CSV) with hash-chain integrity for regulator submissions. Brief PDF export from the dashboard.

Chain Health API

Programmatic access to chain verification status. Quick checks (100 events) and full verification endpoints available.

Data Protection

Encryption at Rest

All data encrypted using AES-256 in our PostgreSQL database.

Encryption in Transit

TLS 1.3 for all connections. No plaintext data ever transmitted.

UK GDPR Compliant

Full compliance with UK data protection regulations. DPA available on request.

Data Minimisation

We only collect data necessary for sanctions monitoring. No tracking, no selling.

Incident Response

In the unlikely event of a security incident, we commit to:

  • Notify affected customers within 72 hours (GDPR requirement)
  • Provide detailed incident report within 7 days
  • Implement remediation and share lessons learned

Questions About Security?

Our team is happy to discuss security requirements, provide DPAs, or arrange a technical deep-dive.