Fintech AI Evidence scans every run of your AI workloads against SOC 2 Type II — live today — with EU AI Act and DORA control packs built and in final outside-counsel review; surfaces gaps before the reviewer does; and exports the audit-ready package a bank's risk team signs off on. Out-of-band, enforced non-custodial.
DORA has been in force since January 17, 2025, and vendor procurement reviews ask for AI evidence today. The EU AI Act high-risk deadline is moving to December 2027 under the Digital Omnibus.
AI vendors selling into banks. Risk teams reviewing AI vendors. Either side, the question is the same: where is the evidence?
Procurement asks: where is the EU AI Act evidence? The DORA ICT-third-party register? The SOC 2 controls mapping? Today your engineering team scrambles a deck. Dobby gives you the actual artifact — same shape, every framework, every reviewer.
Twenty AI vendors are in your pipeline. Each one shows up with a different deck, a different controls map, a different story. Dobby gives every vendor the same shape — control matrix, gap report, manifest — so you compare apples to apples.
Either way, the artifact is the same.
The same scan exports the same shape for all three. Frameworks activate per tenant; controls fail or pass per run.
All three are activated per tenant — switch on what you need, scan against only the active set. SOC 2 scanning is live today; the EU AI Act and DORA packs activate on outside-counsel sign-off.
For this module non-custodial is enforced — your raw payloads land in a customer-owned dataset, never Dobby's store. Dobby reads telemetry out-of-band, scans against active frameworks, and exports evidence; it never sits in the request path.
pip install dobby-collector Stream run telemetry from CrewAI, LangChain, OpenAI, Google ADK, AWS Bedrock, or a custom SDK.Six components per export. Same structure, every framework, every scan. The package a bank's risk team actually asks for — not a deck.
One-page overview — frameworks scanned, overall verdict, top three gaps. Written for the reviewer, not the engineer.
Every control mapped to every run that exercised it. Verdict per control, evidence per verdict.
Every gap ranked by severity — what is missing, why it matters, the fix. Procurement-ready language.
Each individual finding — timestamp, run ID, framework, control, verdict, AI reasoning. Auditable.
Verifiable % per framework — how much of the framework your runs actually exercised. Honest about gaps.
Tamper-evident hash chain over every component. The auditor re-hashes to confirm nothing changed.
Export format: HTML · JSON · ZIP (all six components + signature).
Start with Fintech AI Evidence. Connect a workload, activate the frameworks, export the evidence pack. The same shape every reviewer asks for — out-of-band, enforced non-custodial, audit-ready.
Free to try · No credit card · Out-of-band · Enforced non-custodial