Compliance software you can actually check
A regulator does not ask whether your software has good intentions. They ask for a figure, and they expect it to be right. So we build DueCheck to a standard where every figure it produces can be re-derived, re-proved and explained years later
The same ownership structure, calculated two ways
Five points below the truth
Beneficial ownership is where this matters most. When one person holds a stake through two separate companies that both own a third, there are two genuine routes to that third company and both of them count. Software that follows the simpler path reports thirty percent. The correct figure is thirty five
Nothing about the lower figure looks wrong on screen. It sits above the twenty five percent threshold, so no status changes and nothing is flagged for review. It is simply five points below the truth, on one of the few numbers a regulator reads closely
We treat every percentage as an exact decimal value, never an approximation, because a chain of holdings multiplies a small error into a figure someone has to defend
The same discipline runs through the rest. A match score and a risk score answer two different questions, so they are never blended into one number. A factor a source did not publish is not scored as zero, because that would penalise a client for what someone else failed to print. Every assessment records the inputs it used, so it can be reconstructed long after the fact
Every release is proved before it is allowed to exist
Not reviewed. Proved, by machine, against a real database, in the same order every time
- 01Every changed file checked for syntax and for house standards
- 02The full unit suite, twice, and the two runs must agree exactly
- 03The end to end walk, exercising the real system as a person would use it
- 04A signed package built and verified against its own signature
- 05Installed onto the previous release carrying real data, and proved to upgrade
- 06Rolled back, and proved to recover cleanly
Only then is the release tagged and made available. A test count is not a marketing figure. It is the number of specific promises about the software that a machine re-proves every time a single line changes
Updates that install themselves, and can be undone
DueCheck is hosted and operated by IXXO in the EU, and installed on a firm's own server only where the firm requires it. Every installation takes the same releases, which makes updating a product in its own right rather than an afterthought
- A signed package that checks itself. It verifies its signature before writing anything at all
- A backup before every change. Every file it is about to replace is kept, and database changes are applied in order
- Rolled back if anything is not right. No maintenance window, no consultant on site, no command line
- Honest about its own condition. The health page separates work that started from work that finished, because a light that turns green when a task begins stays green through every task that never completes. Ours turns green when the work is done
Everything we learn is written down and carried forward
The project keeps a single working file of hard won engineering knowledge, read at the start of every piece of work rather than consulted after something goes wrong
It records the specific behaviours of the databases, browsers, protocols and third party services this platform depends on, and how each of them must be handled. Ninety three entries so far, every one of them earned in practice rather than copied from a manual
The effect compounds. Knowledge that would normally live in one senior engineer's memory, and leave when they do, is instead available to everyone who touches the system, on the first day. It is the reason the platform gets faster to build on rather than slower, which is the opposite of what usually happens
Rigour is what makes it fast
This standard is usually assumed to be the enemy of delivery. In practice it is the reason for it
In just 21 months, we built our AML platform from the ground up and brought it into live operation as a fully installed, self-updating system. We also integrated a third-party identity verification service, with real customer verifications now flowing successfully through the entire process from start to finish
Verification is not what costs time. Rework costs time. Finding a wrong figure on a Tuesday takes an hour. Discovering it a quarter later means reopening every client file touched since, and explaining the gap to someone entitled to an answer
We would rather spend the hour
Four questions worth asking any vendor
Feature lists look alike. These do not
- 01How is it tested, and can you see the numbers?
- 02What happens when an update fails halfway through?
- 03Can a figure it produced last year be re-derived and explained today?
- 04Who holds the knowledge, and what happens when they leave?
We can answer all four, in detail, with evidence. We would be glad to