Project
Trust & Legal
Written for the people who evaluate software before a bank is allowed to run it: procurement, vendor risk, model risk, and legal. Plain statements, no theater.
What Zolva is, and is not
- Zolva is open-source software (Apache-2.0) that you install and operate inside your own infrastructure. It is a Python package, not a hosted service.
- There is no Zolva cloud, no Zolva account, and no telemetry. The project cannot see your deployments, your prompts, or your customers.
- Because there is no hosted service, there is no SOC 2 report for Zolva itself: there is nothing of ours holding your data to audit. Your deployment inherits your controls: your VPC, your IAM, your monitoring, and the platform's built-in controls below.
- Zolva is not a law firm and this page is not legal or compliance advice. It describes technical controls that your compliance function can map to its own obligations.
Data flows
- Customer data: reaches agents only through the tools you register (your API clients, your auth). Zolva's operational stores (sessions, audit log, failure queue) are files or databases in your infrastructure.
- The only egress is the LLM call you configure. The bridge supports in-house gateways and local models, and optional PII redaction before any provider call. Your data-processing agreement is with your model provider, not with Zolva.
- Channels: messages transit the channel providers you declare (for example Meta's WhatsApp Cloud API or a speech vendor). Those are deliberate, per-channel decisions recorded in config your reviewers can read.
Compliance mapping
Regulatory frameworks for high-risk AI converge on four demands. Zolva's controls are designed so that operating the platform produces the evidence:
| Expectation | Raised by | Platform control that evidences it |
|---|---|---|
| Transparency | EU AI Act; SR 11-7 | Audit log stamped with config version and instruction-file hash: any response is replayable to exactly the configuration that produced it. |
| Traceability | EU AI Act; SR 11-7 | Append-only, hash-chained audit records; edits, deletions, and reordering are detectable by verify(). |
| Human oversight | EU AI Act; RBI digital-lending norms | One handover path for agent decisions, guardrail violations, tool crashes, provider failures, and customer requests; irreversible actions can require human confirmation. |
| Ongoing monitoring | SR 11-7; EU AI Act | CI-gated evals on the worst cohort, scheduled drift runs, synthetic patrols including adversarial personas, and the SARR scorecard. |
| Conduct rules | RBI digital-lending norms | Contact-hour windows, mandatory disclaimers, and refusal rules enforced as config; never rules cannot be disabled. |
Mapping a control to your specific legal obligation remains your compliance function's judgment; the platform's job is to make the evidence exist.
Supply chain & release integrity
- Three runtime dependencies:
pydantic,httpx,pyyaml. The dependency policy is frozen and enforced in review. bandit,pip-audit, lint, strict typing, and the full test suite run in CI on every commit, on a three-version Python matrix.- Releases are tagged on GitHub with the exact source; install pinned versions
(
pip install zolva==X.Y.Z) and verify with your own artifact scanning, as you would any dependency. - Vulnerability handling: coordinated disclosure with a 72-hour acknowledgement. See the security policy.
License & warranty
Zolva is licensed under Apache-2.0: you may use, modify, and run it commercially, including in production at a regulated institution. Per the license, the software is provided "as is", without warranties or conditions of any kind; the full text governs.
Contact
Security reports: private vulnerability reporting on GitHub (see the policy). Everything else: GitHub issues.