01
We map your AI touchpoints
Every place a decision your business makes touches an AI model — internal tooling, vendor integrations, model APIs — gets mapped against where the inference actually runs.
LedgerAI · Quantyx · live since December 2025
AI governance and compliance that never leaves your environment.
AI governance and compliance for regulated businesses. Assess AI governance risk, track compliance obligations, and generate evidence-based documentation for audits and regulatory reviews — with the sensitive half running on-device.
Book a 30-minute walkthroughRising Star Top 5 finalist 2026TransUnion · Banking & Financial Services
21
Companies on LedgerAI
Built with Zanele Simelane. Head developer: Vuyo Nkadimeng. On the App Store ↗
The problem
Sovereignty is usually decided by accident
Most AI adoption inside South African financial services inherits whichever cloud region a vendor defaulted to. POPIA doesn’t ban that — but it does require you to be able to answer, on request, where a decision was actually computed and who could access it. Few institutions can answer that today.
How it works
Three steps
One decision, followed from the moment it touches a model to the moment a regulator can check it.
Attestation, on the device that made the decision
02
LedgerAI attests, on-device
Attestation runs where your data already lives, not in a third-party cloud. Every AI-assisted decision gets a verifiable, auditable record of what happened and where.
03
You get a record a regulator can read
The audit trail is built for the conversation with the Information Regulator, SARB or the FSCA — not retrofitted after the fact.
09:41MAP
Step 01
AI touchpoints
Credit decisioningeu-west-1
Document OCRaf-south-1
Fraud scoringus-east-1
Support copilotap-south-1
Collections triageaf-south-1
KYC screeningeu-west-1
Map the touchpoints
09:41ATTEST
Step 02
On-device attestation
Model callSHA-256 ✓
Input versionv4.2.1
Human overridelogged
Actoranalyst-07
TimestampRFC 3161
Leaves devicenever
Sign in Secure Enclave
09:41AUDIT
Step 03
Audit pack
POPIA s72covered
GDPR Ch. Vcovered
EU AI Actcovered
ISO 42001covered
Chain re-derivedintact
Transfers blocked3
Export for the regulator
Figure · tamper-evidence · every mark is derived from the record before it. A log asks to be believed; a hash chain does not.
What it actually does
Three mechanisms
Named, because a compliance product that will not say how it works is asking for the same trust it claims to replace.
SovereignSwitch
A data-residency control plane built around POPIA s72 and GDPR Chapter V transfers. Cross-border transfers are checked for a legal mechanism before they happen — items without one are blocked, not flagged.
Signed audit packs
SHA-256 hashing, Secure Enclave signing and RFC 3161 timestamps, so an audit pack is evidence rather than a claim.
On-device copilot
Regulated questions run against Apple’s on-device foundation models and cite the specific article or clause they answer from.
Frameworks covered
- POPIA
- GDPR
- EU AI Act
- FSCA
- ISO 27001
- ISO 42001
- SOC 2
- NIST AI RMF
Runs on iOS · iPadOS · macOS · watchOS · Web · Android · Huawei
Figure 3
Why an audit pack is evidence
Every mark is derived from the record before it. The line sweeping across is a single altered byte, and nothing behind it survives the change — which is the difference between a log, which asks to be believed, and a hash chain, which does not. Signing and timestamping that chain is what turns it into something an auditor can check without trusting either of us.
Recognition
A finalist for Most Innovative App
WesBank New Generation Awards 2026. Three entries were shortlisted in the category. Naming the other two is the point: it is what makes the standing mean something.
| Entrant | App | Agency |
|---|---|---|
| AB InBev South Africa | Castle Milk Stout – Songs to Savour | iProspect–dentsu & Egg Studios – Powered by Blue Robot |
| AB InBev South Africa | Castle Lager 130 | EGG Studios. Powered by Blue Robot - iProspect-dentsu |
| Quantyx | LedgerAI | In-house |
The category is for an app developed by a corporate, and the other two finalists are AB InBev campaigns built for the brand by agencies — three agency names between them. Quantyx is the only entrant that built its own: LedgerAI was written by Zanele Simelane and Vuyo Nkadimeng, and is the product the company sells rather than a campaign for something else.
Winner announced 23 September 2026 · NH Sandton · The finalists list ↗
ITWeb, 2026
“Your data never leaves your environment, and we only ever receive what you have cryptographically approved.”
Before you ask
Common questions
Does this replace my compliance team?
No. LedgerAI gives your compliance and risk teams a verifiable record to work from — it does not make compliance decisions for you.
Does any data leave the country?
Attestation is on-device by design: it runs where your data already resides rather than routing it through a third-party cloud region.
What does it cost?
Free for individuals, with no feature paywall. Enterprises pay an annual subscription for a self-hosted deployment; that figure is scoped per engagement rather than published.