Use Case: Banking & Finance

The Risk

Traders, analysts, and relationship managers routinely handle sensitive client data. Under time pressure, they reach for AI assistants to draft reports, summarize portfolios, or analyze market data — pasting raw client records directly into ChatGPT, Claude, or Copilot.

Typical Shadow AI incidents in banking:

Scenario	Data exposed	Regulation triggered
Analyst pastes portfolio CSV into ChatGPT to build a chart	Client IBANs, account balances, positions	MiFID II Art. 25, GDPR Art. 5
Trader asks AI to summarize a Bloomberg terminal export	SWIFT codes, transaction amounts, counterparty names	DORA Art. 28, MiFID II
RM uploads client onboarding form for AI review	Full name, DOB, tax ID, IBAN	GDPR Art. 30, KYC/AML obligations
Compliance officer pastes audit findings into AI for a report	Internal control failures, sanctioned entities	DORA Art. 19

What Noxys Detects

Noxys ships Tier 1 (browser-side, offline) recognizers that fire on financial identifiers with no network call:

Recognizer ID	Pattern	Example
FIN-001	IBAN (all 34 country formats)	FR76 3000 6000 0112 3456 7890 189
FIN-002	BIC/SWIFT code	BNPAFRPPXXX
FIN-003	Credit card number (Luhn-validated)	4532 0151 1283 0366
FIN-004	French RIB	30006 00001 12345678901 85
FIN-005	Tax identification number (NIF/SIRET)	362 521 879 00034

Tier 2 (server-side, Presidio NER) adds context-aware detection:

• Name + account number + amount → client financial record
• Company name + SIRET + financial figures → corporate confidential data

Policy Configuration

Recommended policy for a French retail bank:

# CISO Console → Policies → New Policy
name: "Financial Data — Block to Unsanctioned AI"
scope:
  groups: ["traders", "analysts", "relationship-managers"]

rules:
  - condition:
      risk_signals: ["FIN-001", "FIN-002", "FIN-003", "FIN-004", "FIN-005"]
      ai_services: unsanctioned  # any service not in your approved catalog
    action: Block
    coach_message: >
      Financial identifiers detected. This data cannot be sent to unsanctioned
      AI services. Use the approved Noxys-secured AI workspace or contact your
      CISO team.

  - condition:
      risk_signals: ["FIN-001", "FIN-002"]
      ai_services: sanctioned  # e.g. your enterprise Copilot tenant
    action: Log
    redact: true  # send redacted version, log the event

Result: Raw IBAN/SWIFT never leaves the browser to any unsanctioned AI. Your enterprise Copilot receives a redacted version with audit trail.

Detection Flow

Employee (trader) opens ChatGPT
  │
  │  Pastes: "Analyse this portfolio: FR76 3000 6000 0112 3456 7890 189
  │           BNPAFRPPXXX, 2.4M EUR position in LVMH..."
  │
  ▼
Noxys Extension (Tier 1, offline, 1.2ms)
  ├─ FIN-001 match: IBAN detected
  ├─ FIN-002 match: BIC/SWIFT detected
  └─ Risk score: HIGH (2 financial signals)
  │
  ▼
Policy Engine
  └─ Rule: Financial Data — Block to Unsanctioned AI
       Action: BLOCK
  │
  ▼
HTTP request CANCELLED (before leaving browser)
  │
  ├─ User sees: coaching overlay with policy explanation
  └─ SIEM receives: event log (SHA-256 hash, risk signals, user, timestamp)
     → No raw prompt stored

Compliance Mapping

Regulation	Requirement	How Noxys satisfies it
MiFID II Art. 25	Client data handling obligations	Policy blocks raw client data exfiltration; audit log for supervisory review
DORA Art. 28	ICT third-party risk management	AI services classified as third-party ICT; Noxys enforces approved service list
DORA Art. 19	Information security reporting	All block events exported to SIEM; incident timeline reconstructable from logs
GDPR Art. 5(1)(f)	Integrity and confidentiality	Sensitive data never transmitted outside controlled perimeter
GDPR Art. 30	Records of processing activities	Noxys event log provides ROPA-compatible audit trail per user per service

Evidence for Auditors

Noxys generates per-event records containing:

• Timestamp (ISO 8601)
• User ID (pseudonymized or real, tenant-configurable)
• Risk signals triggered (IDs + categories, no raw text)
• AI service targeted (URL + catalog ID)
• Policy applied (name + version)
• Action taken (Block / Coach / Log)
• SHA-256 hash of the prompt (for deduplication, not decryption)

Export via: CISO Console → Reports → Compliance Export or API /v1/events?format=siem.