# Zomma

> Zomma builds computer-use agents for the financial back office. They work on the portals, registries, PDFs, case managers and internal tools a team already uses, and hand back a finished case file: a screenshot behind every finding and a recommendation for the person who decides. Starting with compliance for payment companies.

## What it is not
Zomma is not a KYC identity-verification vendor, not a screening-list provider, not a transaction monitoring system, not a rules engine and not an RPA tool. It works on top of the lists, systems and tools a team already uses and does the reading and first write-up a person would otherwise do. It recommends; a person decides.

## How it works
- Each agent gets a computer, your logins in a vault, and your written procedure.
- It reads every screen the work needs, the way a person does, so there is nothing to integrate. Every screen it reads is saved as a timestamped screenshot.
- It writes up the case with a screenshot behind every finding and recommends what to do: clear, escalate, or request information. Your team decides.
- In the product, Screening builds the case file and Your cases applies your procedure and recommends the outcome.
- Teams start it on cases they have already closed, compare its recommendations with their own decisions, then let it run on new cases.

## Work it does
- Compliance for payment companies first: KYB and KYC screening, transaction monitoring alerts, and periodic reviews.
- The same agents also handle reconciliations and disputes for payment and fund operations teams.
- Developers can give their own agent a computer through the API. Access is by waitlist.

## Vocabulary
- Computer-use agent: An AI agent that operates software the way a person does: it looks at the screen, moves the cursor, clicks and types. It works in the portals, registries, PDFs, case managers and internal tools a team already uses, so there is nothing to integrate.
- Case file: What one agent hands back after one piece of work: every finding, a timestamped screenshot of every screen the agent read, the procedure step it applied, and a recommendation for the person who decides. One case file per subject. A source the agent could not reach is marked unavailable in the file rather than skipped.
- Screening: The part of the product that builds the case file. Give it a person or a company and it checks the sanctions and PEP lists, the company register, the officers and owners, the website and adverse media, and returns one case file with a screenshot behind every finding.
- Your cases: The part of the product that applies your written procedure to a case and recommends the outcome, with the reasoning under it. Teams start it on cases they have already closed, compare its recommendations with their own decisions, then let it run on new cases.
- Recommendation: The last line of every case file: clear, escalate, or request information, with the evidence and the reasoning under it. The agent recommends. A person on your team makes the decision, and the decision is recorded.
- Replay: The step-by-step record of a run: what was opened, what was searched, when each screenshot was taken and what went into the case file. Your auditor can open it later and see what the agent saw, what it did, and why.
- KYB and KYC: Know Your Business and Know Your Customer checks on a new or existing customer: who they are, who owns and runs them, and whether they appear on a sanctions or PEP list or in adverse media. Zomma builds one case file per subject.
- Transaction monitoring alert: A payment flagged by your monitoring system for a person to look at. Zomma checks the counterparty and the beneficiary, applies the context of the payment corridor, and recommends a disposition with the evidence under it.
- Periodic review: A refresh of the file on an existing customer, on the schedule your procedure sets: re-screening against sanctions, PEP and adverse media and updating what has changed, so a growing book does not mean a growing backlog.

## Who it is for
Compliance and operations teams in the financial back office that want more cases through the same team, with the evidence already in the file when an auditor asks. Starting with compliance teams at payment companies.

## Rules
- The agent recommends. A person on the team makes every decision.
- It runs under the customer's control and supervision, on the customer's procedure and thresholds.
- No accuracy figures are claimed. The measure is capacity: more cases through the same team.
- Zero retention and no training on customer data, in writing.
- Credentials are vaulted and never shown to the model; a person clears every two-factor prompt, and it is logged.
- Customer names do not appear on the site. Worked examples are fictional samples.

## Data handling
- Hosting: AWS us-east-2 (Ohio), single-tenant per customer, encrypted in transit and at rest.
- Model providers: Anthropic and OpenAI, zero data retention, no training on customer data.
- SOC 2 Type 1 audit. A written data flow description is available before any agreement is signed.

## Common questions
Answered in full on the homepage and in https://zommalabs.com/llms-full.txt.
- How do we know it gets the work right?
- Does it work with the tools we already use?
- What can it read and work in?
- Where does our data go?
- How quickly can we be live?
- How is it priced?
- What can our security team review?

## Pages
- [Home](https://zommalabs.com/): What Zomma is, how it works, the compliance work it starts with, and common questions.
- [Enterprise deployment](https://zommalabs.com/enterprise): How Zomma deploys inside regulated teams.
- [How it works](https://zommalabs.com/computer-use): How computer use operates software that has no API.
- [Security](https://zommalabs.com/security): Where data lives, which third-party services touch it, credentials, and the audit trail.
- [Company](https://zommalabs.com/company): Who we are and why.
- [Blog](https://zommalabs.com/blog), [Privacy](https://zommalabs.com/privacy) and [Terms](https://zommalabs.com/terms).
- [Full text for language models](https://zommalabs.com/llms-full.txt)

## Writing
Older posts were written for an earlier fund operations and advisory frame and should be read as dated. The current frame is the one above.
- [How to test AI agents for finance operations before production](https://zommalabs.com/blog/test-ai-agents-finance-operations)
- [FINRA guidance on AI agents, explained for operations teams](https://zommalabs.com/blog/finra-ai-agents-guidance-operations)
- [AI Agents for Transaction Monitoring in Cross-Border Payments: A 2026 Guide](https://zommalabs.com/blog/ai-agents-transaction-monitoring-cross-border-payments)
- [The trust gap: why 95% of fund managers use AI and only 7% run agents](https://zommalabs.com/blog/trust-gap-ai-agents-fund-operations)
- [Why Zero Trust is the Baseline for Implementing Agentic Systems](https://zommalabs.com/blog/zero-trust-agentic-systems)
- [Zomma-ing towards SPIFFE: a Secure Production Identity Framework for Everyone (and their Agents)](https://zommalabs.com/blog/zomma-spiffe-implementation)
- [Can an AI agent replace data entry?](https://zommalabs.com/blog/ai-agent-replace-data-entry)
- [How to Automate Fund Admin and Transfer Agent Portal Work](https://zommalabs.com/blog/automate-fund-admin-transfer-agent-portals)
- [Implementing the Agentic Trust Framework (ATF): Zomma's Playbook](https://zommalabs.com/blog/agentic-trust-framework)
- [Headless vs Headful: Why Computer Use Survives an Agent-Run Internet](https://zommalabs.com/blog/headless-vs-headful-computer-use)
- [Enterprise Computer Use: What It Is, How It Works, and How to Deploy It Safely](https://zommalabs.com/blog/enterprise-computer-use)
- [Computer-Use Agents vs RPA: Why a Decade of Enterprise Automation Kept Breaking](https://zommalabs.com/blog/computer-use-agents-vs-rpa)
- [AI Agents for KYC & Customer-Profile Review: A 2026 Guide for Compliance Teams](https://zommalabs.com/blog/ai-agents-for-kyc-customer-profile-review)
- [Why your best operations person is your biggest risk](https://zommalabs.com/blog/ops-knowledge-loss-financial-services)
- [How to reduce manual data entry in operations](https://zommalabs.com/blog/reduce-manual-data-entry-financial-services)
- [What does it cost to automate an operations workflow?](https://zommalabs.com/blog/cost-automate-back-office)
- [Automation tools for the legacy systems teams still use](https://zommalabs.com/blog/desktop-automation-legacy-software)
- [How long should an operations automation project take?](https://zommalabs.com/blog/how-long-rpa-implementation)
- [How to automate computer work without an API](https://zommalabs.com/blog/automate-desktop-without-api)
- [RPA vs AI agent: what operations teams should know](https://zommalabs.com/blog/rpa-vs-ai-agent)

## Contact
- Email: hello@zommalabs.com
- LinkedIn: https://www.linkedin.com/company/zomma
- X: https://x.com/zommalabs