A governance layer that sits between a client file and the AI doing the work.

Ava 1.0 removes client identity from a financial document, hands the de-identified derivative to an enterprise AI account where a licensed professional does the analysis they would do anyway, and restores the real names into the finished work. A validation report confirms what came back.

It is not an AI product. No model runs inside Ava. It does not reason about credit, score a borrower, or form a view on a deal. It removes the one constraint that stops skilled people from using tools that already exist.

Identity replaced. Financial content untouched.

Ava 1.0 is software that runs on the professional’s own machine.

Nothing hosted. No database. No vendor receiving client content, including us. The deal vault and the token map sit in a folder beside the client documents they describe, on hardware the firm already owns and already secures.

This converts a promise into a fact. A hosted tool’s privacy claim is a contract term. A local tool’s privacy claim is a statement about network topology. Nothing transmitted means nothing to breach at a vendor, nothing to retain, and nothing to attest to.

It also keeps AVA Credit out of the trust chain entirely. Were Ava hosted, the moment a firm’s institutional counterparty ran a third-party review, we would become the third party: vendor questionnaires, sub-processor disclosure, breach notification paths. A five-lawyer practice can install software. It cannot run a vendor onboarding process.

And the token map has nowhere else to live. It is the one file that resolves a token to a real name, so an architecture where it never travels is the only architecture where “never transmitted” is structurally true rather than a policy someone could change.

Three tiers. What varies is where the key sits.

These are not stages a firm graduates through. They are three answers to one governance question, and the right answer depends on who should hold the key rather than on how large the firm is.

The invariant holds across all three: what identifies a client and what makes a deal analyzable are separable, and the key is separable from the analysis. Custody by design, at whatever distance the firm needs.

Four steps, one boundary, crossed twice.

What identifies a client and what makes a deal analyzable are two different things in the same document.

Names, addresses, social insurance numbers, business numbers and account details identify. Loan amounts, appraised values, coverage ratios, rates and three years of margins are what make the file analyzable. Ava removes the first and leaves the second exactly as written, so the model still sees the whole financial picture. It simply does not know whose deal it is.

Synthetic example

Tokens are consistent across a deal and across sessions. A file assembled over four days keeps the same borrower token throughout, so the analysis holds together instead of fragmenting into strangers.

An unread page is an unscrubbed page.

Client documents arrive in whatever state the client sent them. Word files, spreadsheets, clean PDFs, and PDFs that are photographs of paper. Ava identifies the format from the file itself rather than trusting the extension, since files get renamed.

Scanned pages are the security problem, not the convenience problem. Text that cannot be read cannot be scrubbed, and a signature block sitting in an image would pass straight through a scrubber that only sees the text layer. Ava measures every page for both text density and image coverage. If a page looks scanned or carries an unread image region, the document is routed to a document reader before anything else happens. Where that reader is unavailable, the document is refused rather than partially scrubbed.

Ava removes direct identifiers. It does not anonymize a deal.

This is the most important paragraph on the page, so it is stated plainly. A $4.25M first mortgage on an industrial property in Scarborough at 68.5% LTV closing in March stays recognizable to anyone active in that market with every name stripped out. Amount, asset type, location, timing and structure are collectively identifying, and no de-identification tool changes that.

What is delivered is real and worth having. No client name, address, social insurance number, business number, account number or contact detail is transmitted to an external AI provider or left sitting in a chat log. What is not delivered is a file that an informed reader could not trace back to a deal.

Two further limits, stated for the same reason. An unread page is an unscrubbed page. And where one party appears under several spellings, all of them map to one token and restore writes back the first form encountered, with the variants recorded in the map.

Operating on an accurate description of a tool is worth more than operating on a flattering one.

The deadline is not arriving to an empty field. It is arriving to a habit.

OSFI’s Guideline E-23 on model risk management takes effect on 1 May 2027, and it defines a model broadly enough to include AI tools that materially affect decisions. It binds federally regulated institutions directly. Independent firms are reached a different way: through B-10 third-party risk, when the institutions they serve begin asking their channel what AI touches client data, and through the privacy and professional obligations that already apply.

Those questions arrive before the deadline, not after. The firms that answer them well will not be the ones that waited, and they will not be the ones that told their people to stop. They will be the ones that governed the data instead of the behaviour.

Built, running, and not finished.

Ava 1.0 is in active build. The engine works end to end: intake, protected spans, detection, tokenization, restore and validation. It is being run against our own files first, inside our own lending businesses, before it goes anywhere else.

The gate before wider use is accuracy at scale on person detection, measured against a validation corpus rather than asserted. Financial integrity through a full round trip is covered by a test that must pass completely before any client material is scrubbed. Open items are tracked in the technical documentation rather than left implicit, and the honest ones stay on the list until they are closed.