AI Use & Disclosure

AI assists — never replaces — the licensed compliance professionals on our team. Today, AI is used across the following FIN Group properties:

• FIN Group / fingroup.io & fincompliance.io — blog drafting, marketing copy, internal research, and the content recommendation engine on this site.
• RegReview.io — calendar generation, deadline classification, and first-pass summaries of regulatory updates.
• InvestPrep.io — investor onboarding workflow drafting, document classification, and KYC/AML packet summarization.
• ADScanner.io — initial flagging of Marketing Rule (Rule 206(4)-1) issues in advertisements, social posts, and pitch decks.
• FIN Portals, FIN Continuity, FIN Books, FIN Audits — drafting, summarization, and routing assistance inside client portals.

Every AI-generated output that affects a client deliverable is reviewed by a licensed compliance professional before it is sent, filed, or relied upon. AI shortens the path to a draft; a human owns the final answer.

Our team members hold credentials including CCO, IACCP®, CSCP®, and Series 7/24/63/65/66, and operate under FIN Group's own internal AI Acceptable Use Policy.

• AI does not provide legal advice. FIN Group is not a law firm and no attorney–client relationship is created by using our sites or platforms.
• AI does not make final compliance determinations. Final regulatory judgment always rests with your firm's CCO and registered principals.
• AI does not guarantee regulatory outcomes, exam results, or that any filing will be accepted.
• AI does not replace primary regulatory sources (SEC, FINRA, state regulators, IARD/CRD/EDGAR). Always verify against the source of truth.
• AI can hallucinate. Outputs may be plausibly worded but factually wrong; treat them as starting points, not final work product.

Our platforms call third-party large language models through secure server-side APIs. We currently use models from OpenAI, Google (Gemini), and Anthropic, accessed through enterprise gateways that operate under zero data retention (ZDR) terms — meaning your inputs are not stored by the model provider and are not used to train their foundation models.

The following always apply:

• API keys live in encrypted server-side secret vaults — never in your browser, never in client code.
• Client data is transmitted over TLS 1.2+ and processed in US-based infrastructure by default.
• We do not sell, license, or repurpose client data for model training, advertising, or analytics.
• You may request, at any time, that we exclude any specific document, dataset, or workflow from AI processing.

For our full list of sub-processors and security posture, see the FIN Group Trust Center.

RegReview.io, InvestPrep.io, ADScanner.io, and the FIN Group client portals are built with AI-assisted engineering — engineers use large language models to draft, refactor, and test code. We hold that work to the same governance standard we apply for clients:

• Named owner per release. Every change has an accountable human owner; no AI-generated code reaches production unreviewed.
• Human code review gate. Regulatory logic — filing deadlines, rule citations, Marketing Rule tests, KYC/AML steps — is reviewed by a licensed compliance professional, not just an engineer.
• Version-controlled change history. Source control retains what changed, when, by whom, and why, so a change log can be produced on request.
• Staged testing. Changes are exercised in development and staging before release; regulatory content changes are validated against primary sources.
• No client production data in development. Development and test environments use synthetic or de-identified data. Client records stay in production.
• Secrets segregation. API keys and credentials live in encrypted server-side vaults, are never committed to source control, and are never present in client-side code.
• Model & tool register. We maintain an internal inventory of the models, coding assistants, and development platforms used to build our software — disclosed in the Trust Center sub-processor table.
• Prompt & output recordkeeping. Development prompts and outputs relevant to regulatory logic are retained alongside the change record.

Development platform, coding assistants, hosting, edge runtime, and source-control vendors are all named in the Trust Center sub-processor list. Firms performing outsourcing-rule (Rule 206(4)-11) diligence can request our written SDLC and AI-development control summary for their file.

The SEC has brought enforcement actions against firms for misrepresenting their AI capabilities ("AI washing"). FIN Group will not claim that any platform "automatically passes" an exam, "guarantees" compliance, or operates without human review. If you ever see marketing language on our sites that overstates what AI does, please email support@fincompliance.io and we will correct it.

• Opt out of AI processing on specific documents or workflows — email support@fincompliance.io.
• Request a model & sub-processor list in writing for your due diligence file.
• California residents: you have additional rights under the CCPA/CPRA. See the Privacy Policy "Your Rights" section.
• Outsourcing-rule readiness: we can provide a vendor due-diligence packet (security, sub-processors, AI use) for your CCO file.

We update this disclosure whenever our model providers, data flows, or AI features materially change. Material changes are noted in the effective date at the top of this page.

Questions? Contact our compliance team or email support@fincompliance.io.