Pre-release. sdlc.cc is not generally available. There is no completed customer deployment and no design partner yet, and per-class detection accuracy has not been published. What is and is not proven →
JOURNEY_SENTINEL_FINTECH
One paste can start three regulatory clocks.
In May 2026 a US bank filed an SEC Form 8-K because an employee put customer names, Social Security numbers and dates of birth into an unapproved AI tool. No attacker. No malware. One person trying to work faster.
What that incident actually cost
CB Financial Services detected the incident on 5 May 2026, determined it material on 7 May, and filed on 11 May — reportedly the first Item 1.05 filing caused by internal AI use rather than an intrusion. One employee action produced obligations on three separate tracks at once.
| Clock | Trigger | Deadline |
|---|---|---|
| Federal banking regulator notice | A “notification incident” is determined | 36 hours |
| SEC Form 8-K, Item 1.05 | The incident is determined material | 4 business days |
| Customer notice under GLBA | Sensitive customer information was misused, or likely was | As soon as practicable |
Regulation S-P adds a 72-hour service-provider notice and a 30-day customer notice, with the smaller-entity compliance date in June 2026. EU firms have DORA treating AI systems as critical ICT assets, and EU AI Act transparency obligations from 2 August 2026. This page describes obligations reported publicly; it is not legal advice, and sdlc.cc is not a certification.
Why your existing controls did not see it
It was a paste, not a transfer
DLP built for email and file movement watches attachments and endpoints. A prompt typed or pasted into a browser tab is neither, and it leaves as ordinary HTTPS to a domain the business has approved.
It was probably a personal account
Independent measurements put roughly half of enterprise AI conversations on personal identities. Controls bound to your tenant — enterprise licences, SSO, vendor admin consoles — never observe those sessions at all.
Blocking the domain moves the problem
Employees who lose a tool they rely on move to a phone, a home laptop, or the next AI site. The exposure continues where there is no telemetry and no record of it.
You cannot reconstruct the prompt
When the 36-hour clock starts, the first question is which data left. Without a record of the send, scoping is guesswork — and the disclosure has to be written anyway.
What sdlc.cc is designed to do
Inspect the prompt in the browser before it is sent, apply your policy to what it finds, and record the decision without recording the text. The employee keeps the tool and sees what changed before pressing send again. A cohort moves from observe to redact or block when you decide — not on install day.
Detector classes configured per policy today are card numbers, IBAN, BIC, US SSN, UK NI, IL ID, NL BSN, DE Steuer-ID, CA SIN, AU TFN, US NPI, email, phone, IP address and credential material, plus your own patterns.
What we have not published
We have not published a per-class detection rate or false-positive rate, so treat the list above as what the policy engine is wired to look for, not as a measured guarantee that each class is always caught.
That is what a pilot is for. You run one cohort in observe mode on your own traffic, and the counts you get back are measured on your data before anything is enforced. If the numbers are not good enough, nothing has changed for your users and you stop.
What your engineers can verify before they trust us
These are properties of the code, not assertions about it. Ask for the repository during a pilot and check them yourself.
Counts, not content
Records hold detector class counts, policy reference, decision and timestamp. No database column can hold a prompt — readable from the migrations in minutes.
Fail closed, not fail quiet
If the gateway cannot be reached or a policy cannot be loaded, the send is held and the employee is told. An unprotected send is never presented as a protected one.
Refuses what it has not implemented
Model paths without a governed handler are rejected outright rather than quietly forwarded — so an unsupported integration fails visibly instead of looking protected.
Your environment if you need it
Run the same engine as a private appliance in your own VPC with Docker Compose or Helm, so prompts stay inside your boundary.
sdlc.cc is a control that reduces what reaches an AI provider and records the decision. It does not certify you against any framework, does not replace your information security programme, and is not a guarantee that every sensitive value is found.
What a first pilot looks like
- Pick one cohort — the team that handles customer records daily.
- Run it in observe for two weeks. Nothing changes for the user; you get counts by data class, measured on your traffic.
- Read the numbers. That is when you learn what this actually catches in your environment, and what it misses.
- Only then move that cohort to redact or block, with a rollback record already written.
We are looking for a small number of design partners to run exactly this. You would be among the first, which is worth saying plainly: you get direct engineering attention and influence over the detector work, and in exchange you are testing something that has not yet been proven on anyone else's data.
Pricing on the pricing page is illustrative and not yet validated with buyers.