Self-hosted compliance AI
Regulatory answers you can actually cite.
Self-hosted AI that answers U.S. financial-regulation questions — lending rules, BSA/AML and related federal regulation — and returns the sources behind every answer. It runs on your own infrastructure, with no third-party AI service in the path.
Illustrative example
Running in your VPC
Within 30 days of receiving the completed application. The written notice has to state the action taken and either give the specific reasons or tell the applicant they can request them. The sections cited below set out the rest of its content.
12 CFR § 1002.9(a)(1)(i)
12 CFR § 1002.9(a)(2)
12 CFR § 1002.9(b)(2)
Cited from 12 CFR 1002.9 — nothing left the network
What it does
Everything it tells you, it can show you.
Four things a compliance team actually needs from a research tool, and no claims we can’t point at.
01
Answers with their sources
Every answer comes back with the notes it was built from and where each one came from. When the knowledge base doesn’t cover a question, it is designed to say so instead of guessing.
02
Your data stays put
Runs on your own hardware or VPC from a Docker Compose definition. By default no third-party AI service is involved, and no prompts or answers leave the machine.
03
A corpus you can audit
Every note is labelled by source type — verbatim regulation, agency guidance or analytical convention. Notes that need legal judgment are flagged, not settled. 54 of the 55 CFR sections it cites are backed by an archived, hashed eCFR snapshot.
04
Fits the stack you have
An /ask endpoint and an MCP endpoint, so the tools and agents you already run can query the same knowledge base. Remote access needs API keys and is rate-limited per key.
Coverage
What the corpus covers today.
Answers come from a curated library of source cards: regulation text and agency guidance, each tied to where it came from, with a dated copy of every cited CFR section on file.
Outside these areas it is built to decline rather than guess. It does not manage that every time yet, which is why we list what is missing as plainly as what is there.
BSA / AML
Payments
Deposits
Credit
Lending
Not yet covered
How it works
Three steps, and the order is the point.
01
Regulatory material is structured and indexed deliberately, not scraped. This is the part that takes the work, and it is the part that decides how good the answers are.
02
Hybrid keyword and embedding search pulls the notes that bear on the question, each traceable back to its source.
03
A small open model, running on your own hardware, writes the answer from those notes and returns the sources it used.
We are deliberate about that order. The value sits in the corpus and the retrieval, not in the model weights. That is why it runs on hardware you already own, and why it gets better as your corpus grows rather than when somebody else ships a new model.
Deployment
Runs where your data already lives.
Most compliance teams cannot send customer records to a third-party API, and most AI tools require exactly that. JDM is built the other way around: the corpus, the retrieval layer and the model all sit inside your perimeter.
By default there is no call out to a vendor in the answer path, and no prompts or answers leave the machine.
Deployment
On-prem or your own VPC
Base model
Open weights, self-hosted
Integration
REST API and MCP server
Corpus
Yours to inspect
Data egress
None by default
Lenders and fintechs
Origination, servicing and settlement rules
BSA/AML teams
Bank Secrecy Act and anti-money-laundering obligations
In-house counsel
Anyone answering to an examiner
Where we are
Early, and we would rather say so.
As of October 2026, JDM Inc is pre-launch. The knowledge base, retrieval and self-hosted packaging work today. Answer quality is what we are refining: in testing, the system declined 9 of the 14 questions its knowledge base doesn’t cover, and no compliance professional has reviewed the knowledge base yet.
Source-verified knowledge base and retrieval
Working
Self-hosted deployment
Working
API and MCP integration
Working
Evaluation set (CFR-QA)
In development
Review by compliance professionals
Not yet
SOC 2 report
Not yet
General availability
Not yet
If you want to be one of the early teams, we will tell you plainly whether it is ready for your use case before you commit anything to it.
Research
We publish what we measure.
We mapped 8,532 papers on AI for regulated finance, then labelled the most-cited finance and legal retrieval papers by what each one actually measures. Accuracy appears in 71% of them; refusal in 2%. So we built CFR-QA, an evaluation set that scores refusal in both directions, and published its design before any result.
71%
of labelled finance and legal RAG papers measure end-task accuracy
2%
measure refusal or abstention
77
items in CFR-QA v0.1, refusal scored both ways
Read the research →
FAQ
Questions compliance teams ask first.
Does any of our data leave our network?
Not by default. The knowledge base, the search and the model run on your own hardware or VPC. No third-party AI service is involved, and no prompts or answers leave the machine.
Which regulations does it cover?
U.S. lending rules, including Regulation B; the Bank Secrecy Act and its anti-money-laundering rules; related federal regulation; and UCC Article 9 as enacted in state law. Send us the question you need answered and we will tell you whether the knowledge base covers it today.
How do I check an answer?
Every answer comes back with the notes it was built from and where each one came from. 54 of the 55 CFR sections it cites are backed by an archived, hashed snapshot from the eCFR, and each can be checked against the live eCFR for amendments.
What happens when it doesn’t know?
It is designed to decline and say what is missing rather than guess. In testing it declined 9 of the 14 questions its knowledge base doesn’t cover. That is not all of them yet, and we report the figure rather than round it up. See how we test refusal.
What does it need to run?
A Docker Compose deployment on your own infrastructure. It exposes an /ask API and an MCP endpoint for agent tools; remote access requires API keys and is rate-limited per key.
Is it production-ready? Do you have a SOC 2 report?
Not yet. JDM Inc is pre-launch: there is no production deployment or SOC 2 report on record, and no compliance professional has reviewed the knowledge base yet. We will tell you plainly whether it fits your use case before you commit to anything.
Is it legal advice?
No. It is a research tool for compliance teams. Decisions stay with your compliance staff and counsel.
Design partners
Tell us what you would point it at.
Send us the question your team keeps having to answer by hand. We will tell you whether the corpus covers it today, and what it would take if it does not.
research@jmvent.com
We reply to everyone.