Proven Duty

Consumer Duty turned file reviews from a yearly chore into a continuous, evidenced obligation. Enterprise tools like Aveni and AdvisoryAI are built for large firms. Proven Duty is built for the directly-authorised IFA with one to five advisers — the same person who is the compliance officer, the paraplanner, and the adviser all at once, and who now has to evidence every consumer outcome to the FCA.

The problem

The FCA expects evidence trails for every consumer outcome — suitability, vulnerability, value for money, ongoing service delivery. Producing that evidence by hand is where small firms quietly lose hours, and eventually get caught out: a missed service review becomes a fee-for-no-service finding, an unnoticed vulnerability becomes a complaint, a thin suitability file becomes a red flag at the next visit.

The work is also unglamorous and exact. It has to be right, it has to be auditable, and it has to respect that you’re processing people’s financial data. That shapes every decision in the stack.

How it works

Upload a suitability report PDF — or paste the text — and Proven Duty extracts it, scores it against a configurable Consumer Duty rubric, and returns a structured pass / amber / fail scorecard with line-level annotations, stored per client and per review date to build a longitudinal audit trail.

The product spans four surfaces:

• File review automation — PDF in, scored scorecard out, with the rubric held as versioned data rather than a frozen prompt.
• Ongoing service tracker — maps each client to their contracted service level and flags fee-for-no-service risk before it breaches.
• Vulnerability signal log — scans notes and correspondence for health, bereavement, financial-stress, and coercion indicators.
• Outcomes monitoring and Board MI export — the aggregated evidence board the FCA asks for, exportable as PDF or CSV.

Under the hood

• Multi-tenancy done properly — Supabase row-level security isolates every firm at the database level, adviser seat limits are enforced in the signup trigger, and an append-only audit log records every action.
• Weighted-threshold scoring — each rubric check carries a weight, so a single high-stakes failure tips a report to amber even when most checks pass. The thresholds are ≥70% to pass, ≥50% to amber.
• Rubric is data, not prompts — versioned in Postgres, so FCA expectations can evolve without a redeploy.
• A typed AI pipeline — aiCall with Zod validation and retry, structured prompts, and a dual-provider setup with Gemini as the analyser, so a malformed model response can’t corrupt a scorecard.
• Background work via Inngest — report generation, regulatory digests, team invites, and a scheduled GDPR purge — with transactional email through Resend and react-email.
• Hardened for production — sliding-window rate limiting that returns proper 429s, React error boundaries, GDPR data export (JSON and ZIP) and soft-delete with a 30-day grace period, and CI that regenerates database types so they can’t drift from the schema.
• Tested and observable — 194+ unit and integration tests behind GitHub Actions, six branded transactional email templates via react-email, and Sentry watching production.

Every scorecard, signal, and service check is timestamped and firm-scoped, so the data that flags a risk today becomes the board report and the audit trail tomorrow.

• Regulatory feeds and monitoring — an FCA RSS parser, Sentry error tracking, and a launch-readiness checklist spanning ICO registration, a DPIA, and Cyber Essentials.

Proven Duty is the proof that I can build into a regulated domain — where security, auditability, and correctness aren’t optional.