AIHOOTS / memtara

// the suitability companion to the AIHOOTS audit gateway

Prove suitability.
Audit every recommendation.
Comply with DFSA COB 3.4.

A client's own device proves — against terms your risk committee registered in advance — that income, liquid assets, risk tolerance and portfolio concentration each clear a structured product's thresholds. The bank receives one bit and a proof. Real zero-knowledge proofs (Baby Jubjub / Poseidon), not a whitepaper.

Run the demo — one command Book a 30-minute technical call

87/87 Rust tests · 61/61 Noir tests · 134/134 Python tests
real nargo execute, bb prove, bb verify — nothing simulated
one command, about 40 seconds, exit 0, a sealed case file at the end
piloted by 0 banks, and we say so on this page

The file is assembled afterwards

An adviser recommends a structured note. Somebody checks the client qualifies. Then the evidence of that check gets assembled later — from screenshots, a spreadsheet, a CRM note, and somebody's memory of the conversation.

Two years on, a client complains or a supervisor asks. The bank can show that a file exists. What it cannot show is what was actually checked at the moment the recommendation was made, against which thresholds, or that the thresholds were not chosen by the person making the recommendation.

Put a model in that loop and it gets sharper. Ask an LLM to recommend a product and it will do so from the prompt text alone — and prompt text is attacker-controlled. A better prompt does not fix this. A verified fact the model cannot invent does.

How it works

  1. 01

    The bank registers the product

    Instrument, risk level, minimum income, minimum liquidity, maximum concentration — and a risk-committee approval flag. Thresholds come from this registry and nowhere else. A request that supplies its own is rejected with a 400, not quietly ignored.

  2. 02

    The client's device proves

    Four private figures go into a Noir circuit as witnesses and never leave the device. Out comes a proof and one bit. Proving income >= X needs the income, which is precisely why no server can do this on the client's behalf.

  3. 03

    Memtara verifies and attests

    Barretenberg verifies the proof against the registered terms, and a short-lived Ed25519 attestation is signed. Anyone can check it against a published JWKS, offline, without calling us.

  4. 04

    AIHOOTS injects and chains it

    The gateway validates the attestation locally, injects the verified fact into the model's context, and appends the proof hash to its own tamper-evident SHA-256 chain — with no synchronous call back to Memtara.

Watch it happen

$ ./scripts/quickstart.sh

==> [5]  The client's device generates a zero-knowledge proof
  + nargo execute        witness generated
  + bb prove             proof written, 16 kB

==> [6]  Memtara verifies the proof and issues a signed attestation
  + bb verify            accepted
  + verdict              suitable   (public input 11 of 12)
  + attestation          EdDSA, expires in 300s

==> [7]  The claim is injected into the model's context, and logged
  + AIHOOTS audit-verify chain intact

==> [9]  Exporting the Canonical Case File
  + Case_File_20260815T220531Z.pdf      51,263 bytes
  + seal verified

==> [10] What the bank now holds, and what it does not
  holds        a proof, an attestation, a chained audit entry, a sealed PDF
  does not hold  income, liquid assets, risk tolerance, holdings value

✅ CRO Demo Complete. Show this to any Head of Digital Wealth.
Abridged from a real run. Flip one byte in the PDF and memtara-export verify exits 1.

What is actually in the box

Registry, not catalogue

Thresholds live where the risk committee controls them, so the person making the recommendation cannot also set the bar it clears.

A decline is evidence too

The verdict is a public output of the circuit. "Not suitable" produces the same signed, chained, re-verifiable record as an approval.

Canonical Case File

One command exports a sealed PDF of the whole assessment — terms, proof digest, verification key, attestation, both audit chains.

Tenant isolation you can test

Every table is scoped by organisation, and a test fails the build if one bank can see another's registry or evidence.

The vkey divergence check

/health returns 503 if the running verification key differs from the published one — a failure that otherwise has no symptom at all.

Metrics without a tenant label

Prometheus exposition with no organisation identifier, enforced by a test. A scrape endpoint with tenant labels is a customer directory.

What we do not claim

  • Memtara never receives the client's financial figures. It does hold account identifiers, including a mobile number, and an encrypted vault blob it cannot decrypt. Any vendor telling you their system with a users table holds no personal data has not read their own schema.
  • The case file's seal is a detached digest and signature, not a PAdES signature. No PDF reader will show a green tick. The strongest authenticity claim in the pack is the attestation, checkable against the published JWKS.
  • Whether a given artefact is admissible in a given forum is a question for your counsel. What we can say is that it is independently re-verifiable, years later, from a key published today.
  • No SOC 2, no ISO 27001, no independent penetration test, no production uptime history.
  • Neither system measures algorithmic bias or disparate impact. If you have that obligation, this does not discharge it.
  • A hash chain proves internal consistency, not availability. An operator with database access can still destroy a log.

Piloted by 0 banks? Yes. Ready for your bank? Absolutely.

There are no customers, no case studies and no logos on this page, because there is nothing to put there yet. What there is instead is a repository you can clone this afternoon and a demo that either works on your machine or does not.

The first two institutions get direct access to the people who built it, terms that will not exist once there is a reference customer, and real influence over what gets built next. That is the whole trade, and it is the only moment it is on offer.

Check it before you talk to us

Clone it, run ./scripts/quickstart.sh, and read docs/REGULATORY_MATRIX.md — which names its four gaps on page one, before any of the coverage. Then open README.md and skip to "Honest limits".

If it holds up, a fifteen-minute call is the next step. If it does not, we would rather hear which part.

Book 15 minutes Read the code