For Compliance and Legal Review
Compliance
Architecture
This page describes how Gallus Resolve is built. It states structural controls, not legal conclusions.
Your counsel will reach their own determination about how this system is characterized under the Fair Credit Reporting Act and applicable state law. Our purpose here is to give them the facts they need to do that quickly, in the form they would otherwise have to extract from us over several calls.
Structural Controls
Eight properties of the system, stated flatly.
Each is a property of the code, not a policy commitment that depends on someone remembering it. Where a control is enforced in a specific module, the module is named so that it can be inspected during technical diligence.
The system never contacts a consumer
Gallus Resolve is a decision and audit layer. It does not call, text, email, mail, or perform any collection activity, and it exposes no mechanism by which it could. Consumer contact remains entirely with the agency, under the agency's own procedures and its own regulatory obligations.
Provider credentials belong to the agency
Gallus ships no data of its own and holds no data licence. The agency connects its own provider accounts using its own credentials, under its own contracts and its own permissible-use certifications with those providers. There are no hardcoded provider integrations in the production path; provider API contracts are discovered at runtime from the credential the agency supplies.
Permissible use fails closed
Where permissible use for a source is not verified, the account is routed to Review. It is never cleared to Proceed on unverified permissible use. This is a gate in the decision sequence, not a warning attached to an outcome, and it cannot be disabled by configuration.
Corroboration is counted on provenance, not vendor count
Independence is assessed on who produced the evidence. Commercial aggregators that resell overlapping data are treated as a single provenance family regardless of how many of them are queried, because four vendors reselling one another's records is one source wearing four coats. Evidence the agency supplied about its own consumer cannot corroborate itself. A source we do not recognise counts toward nothing.
Recovery posture is banded, never numeric
Where the system expresses a view on posture, it does so in bands. Account numbers, tradeline detail, and credit limits are hard-blocked from decision output. Statute-of-limitation information is surfaced as a flag for the agency's own review and is never expressed as a legal conclusion about a specific account.
Export is gated by default
A determination is created with masking in a restricted state and export approval in a not-approved state. Both must be affirmatively changed before any unmasked material leaves the system. The default is closed, so an export requires a decision by someone rather than the absence of one.
Every determination is replayable and hashed
Each determination carries a single decision moment threaded through the entire evaluation, so a replay reproduces the original document rather than merely the same verdict. Each carries a SHA-256 hash over a canonicalized projection of the evidence it rested on. A determination that cannot be reproduced is a defect, not a variance.
The decision is deterministic and isolated from any AI path
One module produces outcomes. It does not read the AI investigation planner, and no AI-generated content can reach a determination. Where planning assistance exists in the system, it operates strictly upstream of evidence collection and has no route to an outcome. Identical evidence produces an identical decision.
Boundaries
What Gallus Resolve does not do.
There is no proprietary consumer score, no propensity-to-pay model, and no ranking of consumers by expected recovery.
Gallus reports nothing to any consumer reporting agency and has no furnishing pathway.
A determination is returned to the agency that submitted the account and to no one else. There is no data product.
Where the system learns across determinations, it learns only that two identities are not the same person, carries no consumer data across a tenant boundary, and moves only in the direction of greater caution.
Outcomes describe whether an account may be worked and on what basis. They do not direct treatment, set strategy, or instruct the agency on what to do next beyond the next allowed step.
Diligence
What we provide, and when.
Certified members of the Receivables Management Association International carry vendor-oversight obligations, and most agencies of any size run a vendor security review. We would rather hand your compliance officer a complete file on day one than discover in week six that we are the reason a deal is stalled.
Available on request
- Information security overview
- Subprocessor list
- Data retention and deletion schedule
- Incident response and breach notification procedure
- Mutual non-disclosure agreement
- Insurance certificates
Available under NDA in diligence
- Fair Credit Reporting Act analysis from outside counsel
- Data processing agreement
- Master subscription agreement and permissible use exhibit
- CAS-1 conformance matrix
- Technical architecture walkthrough with the engineer who built it
Materials marked as available under NDA are provided when executed. Where a document is still with counsel, we say so rather than sending a draft.
For Compliance Officers
Send us your vendor questionnaire.
If your firm has a standard vendor security or compliance questionnaire, send it before the first call. It is a faster way to find out whether this is a fit than a demo is, and we would rather know early.
Request Trial