AI safety guardrails, built for banking
General-purpose guard models weren't trained on BFSI data. Meta's PromptGuard — the fastest available — flags 96.9% of legitimate banking queries as harmful. Not deployable in production. Aval was trained exclusively on BFSI adversarial data: 0.5% false-positive rate, 13 attack categories across the FinProof BFSI taxonomy, 11.6ms. Prism, our fine-tuned safety LLM, handles what a classifier can't — multi-turn conversations, agentic workflows, and the complex policy reasoning that SR 11-7 and RBI examiners will ask about.
Control behavior at runtime — before it reaches your customer
Aval sits in front of every prompt and response, classifying across the full FinProof BFSI taxonomy — 13 attack categories, 36 subtypes, from KYC & AML bypass and unlicensed investment advice to regulatory KPI gaming and agentic trust exploitation. Every inference returns a structured confidence vector across all categories, not a binary flag.
FinProof Taxonomy — 13 Attack Categories · 36 Subtypes
finproof.ai ↗Each category maps to a specific regulatory obligation (SEBI, RBI, EU AI Act, SR 11-7). Aval scores across all 13 attack categories per inference — not a rule-based filter. Full taxonomy →
Runtime protection
Detects prompt injection, jailbreaks and malicious intent in real time, blocking what's harmful before it executes.
Compliance-ready
Aligned to RBI, SEBI, DPDP, ISO 27001 and SOC 2 from day one, with audit-ready evidence for every decision.
Two guard models
Aval — fast classifier, 8K context, 11.6ms. Prism — fine-tuned safety LLM for multi-turn and agentic reasoning. Both trained exclusively on BFSI adversarial data.
Zero model changes
Deploy as a guardrail layer in front of any LLM, no retraining, no fine-tuning, no architectural rework.
Low latency
11.6ms inference on a single RTX 4090, fast enough for real-time customer and agent workflows.
Explainable output
Every inference returns a structured confidence vector across safety axes, not a binary flag.
Your AI infrastructure shares memory to go fast. That shared memory is ungoverned.
Zytra is the only platform that governs the KV cache layer, the one place where tenant data mixes and identity disappears.
Detect before damage
Published research shows shared inference caches can leak up to 99% of a prompt through timing alone. Zytra detects cross-tenant leakage in real time, before it reaches your incident log.
Forensic Replay & Isolation Proof
Every cache access is signed, attributed, and recorded in a tamper-evident chain. Every cache access is forensic-replay-capable — reconstruct the exact context state at any point in time for regulatory investigation. When a regulator asks whether tenant A's data ever served tenant B, you show them proof, not a policy.
Delete with certainty
Subject erasure requests touch the cache too. Zytra tracks what entered the cache, scopes it to the right owner, and produces a signed deletion certificate, with honest disclosure of what was cleared and when.
Works alongside vLLM, llm-d, and other inference engines. No engine fork required.
Accurate, and safe to ship
On raw prompt-injection recall the field is close, Meta’s PromptGuard edges Aval (1.000 vs 0.994). What separates a benchmark from production is false positives, where Aval leads by a wide margin.
| Model | Size | HackaPrompt R | AgentHarm FPR | WildGuardMix F1 | Latency |
|---|---|---|---|---|---|
| Aval v1.5 | 307M | 0.994 | 0.5% | 0.303 | 11.6ms |
| PromptGuard-86M Meta | 86M | 1.000 | 96.9% | 0.095 | 8ms |
| LlamaGuard-3-1B Meta | 1B | 0.0% | 0% | 0.0 | ~60ms |
PromptGuard’s 96.9% AgentHarm FPR flags nearly every legitimate banking query as harmful, not deployable in production; Aval’s 0.5% reflects BFSI-specific training. HackaPrompt R (recall) and AgentHarm FPR come from different benchmark suites, so a high recall score does not imply a low false-positive rate. Meta’s PromptGuard is faster (8ms vs 11.6ms) but unusable at that FPR. Source: reproducible evaluation on the public FinProof set · RTX 4090. Aval (307M classifier, 8K context) benchmarks independently from Prism, Zytra’s fine-tuned safety LLM for complex multi-turn and agentic reasoning.
Minimal overhead, total oversight
Governance without friction across all four layers of AI infrastructure.
Model registry
Centralized inventory of every model in production, with versioning and lineage tracking.
Safety guardrails
Runtime protection with Aval classifiers preventing hallucinations and prompt injection.
Drift detection
Real-time monitoring for data drift, performance degradation and behavioral anomalies.
Audit & explainability
Complete decision trails with SHAP/LIME explanations for every prediction.
Multi-layer governance
Model, agent, application and network-level controls for comprehensive oversight.
Compliance-ready
Pre-configured for RBI, SEBI, DPDP Act, ISO 27001 and SOC 2 requirements.
8 capability sections · 59+ modules
One unified platform. Eight integrated capability groups. Deployed as SaaS, on-premise, or hybrid.
AI Asset Registry
8 modules
Catalog · Discovery · Scan · Registration · AI Bill of Materials
GRC & Policy
7 modules
Risk Tiering · Compliance · Policy Packs · Controls
Assessment & Evidence
5 modules
Questionnaires · Evidence · Approvals · Collaboration
Workflow & Process
5 modules
Control Plane · SLA · Task Library · Stakeholders
Evaluations & Scanners
6 modules
Evals · Red-team · Scanners · Benchmarks
Guardrails & Runtime
5 modules
Policy Engine · Prompt Guard · Output Filters · Aval · Prism
Agent Mesh & FinOps
8 modules
Agent Registry · Orchestration · Cost Tracking · Budgets
Observability & Infra
5 modules
Dashboards · Alerting · Audit Logs · Infra Config
Where the market falls short for banking
General-purpose guard models weren't trained on BFSI data. The published FinProof benchmark shows 96.9% false-positive rate on legitimate banking queries for the fastest general-purpose alternative — undeployable in a customer-facing production environment. Source: FinProof leaderboard ↗
Horizontal governance platforms frame AI risk around EU AI Act checklists. They carry no SR 11-7 depth, no RBI circular alignment, and no banking-native vocabulary. They produce dashboards for compliance teams — not signed evidence chains for OCC and RBI inspectors. Zytra was built by people who understand that a banking regulator will ask for evidence, not a policy document, and that your model validation committee needs OSCAL exports, not a PDF report.
Absent from most platforms or sold separately — bundled into security vendors where it loses independence and BFSI specificity.
30 attack operators, tree-of-attacks, multi-turn escalation, agentic scenarios. Runs continuously — not only at audit time.
General-purpose training produces high false-positive rates — flags legitimate banking queries as threats. Not deployable in production.
Aval: 307M classifier, 8K context, 0.5% FPR, 11.6ms — the only production-safe score on FinProof. Prism: fine-tuned safety LLM for complex reasoning, multi-turn flows, and agentic edge cases. Both BFSI-trained.
No independent BFSI benchmark exists. Vendor-run evaluations can't be replicated — most are archived.
Open-source, reproducible, published on Hugging Face. Any third party can verify results. MLCommons AILuminate aligned.
Platforms produce event logs — no chain of custody, no policy linkage, no format regulators can inspect in an enforcement proceeding.
Structured evidence your regulator can inspect — not raw logs your team has to interpret.
Horizontal products don't speak SR 11-7, don't know the three-lines-of-defense model, and can't map controls to specific RBI circular clauses. They produce dashboards. They don't produce examination-ready evidence.
India (RBI 2024 AI Circular, SEBI, DPDP Act), US (SR 11-7, OCC, FFIEC), Europe (EU AI Act, EBA, DORA). Every control mapped at clause level, not framework level — the difference between passing an examination and preparing for one.
Most vendors cover one or two of these capabilities in isolation. Zytra integrates all four — a red-team engine that finds gaps, a guard model that closes them at 0.5% FPR, a benchmark that measures both independently, and a governance layer that records everything in the format your OCC examiner or RBI inspector will accept. When they operate as one system, your safety posture improves continuously instead of degrading silently between audits.
Aval is the only guardrail with India-specific BFSI threat detection
Aadhaar number detection, PAN number blocking, India-specific financial advice violations, DPDP Act inference controls. No global guardrail platform has these. Aval does.
India regulatory coverage
RBI, SEBI, DPDP — the only platform that maps all three at clause level with examination-ready evidence.
Explore →DPDP Act inference pipeline controls
How Zytra enforces DPDP obligations at the AI inference layer — consent, PII detection, data minimisation.
Read →AI governance for NBFCs
RBI AI obligations apply to NBFCs. Zytra is the only platform with NBFC-specific mappings.
Explore →CERT-In AI cybersecurity blueprint — 12-hour mandate, AIBOM, adversarial testing
India's first AI-specific cybersecurity guidance: formal AI governance as security control, xBOM/AIBOM, adversarial testing mandate. Converges with MRMF validation and kill switch requirements.
Read →MeitY India AI governance guidelines — Seven Sutras, AIGG TPEC AI Safety Institute
India's national AI governance framework November 2025. Banks satisfying RBI FREE-AI are automatically aligned with MeitY national framework — same Seven Sutras, single governance program.
Read →RBI Payments Vision 2028 AI governance — DPIP, UPI fraud, kill switch obligations
RBI declared "AI-led, data-driven" payments at FIBAC 2026. Digital Payment Intelligence Platform (DPIP). ₹805 crore UPI fraud 2024-25. Five payment AI types in MRMF scope.
Read →Deploy AI safety in days, not quarters
See Aval running against your toughest adversarial prompts.