Audit-grade AI means every automated answer carries its own evidence: the source it came from, the confidence behind it, and a record of who or what last touched it. In payments, that standard is the whole point. A statement read incorrectly, a fee misclassified, or a number quietly inferred instead of cited isn't a cosmetic bug, it changes what a merchant pays. So we don't ask you to trust the model. We ask you to check its work, and we build the work to be checkable. This article externalizes the methodology underneath that promise, the same way an auditor would want it written down.
Why "trust me" isn't a methodology
Plenty of tools have added AI in the last two years. Most bolt it on: a chat box over an existing product, a model that summarizes a document and hands you prose. That's useful for drafting. It's the wrong foundation for payments, where the output feeds a pricing decision, a savings claim, or a contract.
The problem with bolted-on AI is that the answer and the evidence get separated. You see a confident sentence; you don't see which line of which statement produced it, how sure the system was, or whether a human ever looked. When the number is wrong, and at scale, some number is always wrong, there's no trail back to the cause. You can't audit a vibe.
We treat AI as the foundation and design the trust controls into the same pass that produces the answer. The model doesn't get to assert a number without attaching where it came from and how confident it is. That single constraint reshapes everything downstream.
The five controls
Here's the full pipeline, control by control. None of these is exotic on its own. The discipline is running all five, every time, and refusing to ship an answer that skipped one.
| Control | What it does | What it prevents |
|---|---|---|
| Dual-model cross-validation | Two independent models extract the same field; we compare | Single-model hallucination passing silently |
| Confidence scoring + thresholds | Every field gets a score; low scores route differently | Uniform confidence hiding the shaky answers |
| Provenance chips / citations | Each value links to the exact source region | Inferred numbers masquerading as read ones |
| Human-in-the-loop | Low-confidence cases go to a person before they ship | Automation overruling judgment on hard cases |
| Idempotent, auditable writes | Every write is replayable and logged | Silent drift and unreproducible results |
Dual-model cross-validation
For the fields that matter, effective rate, interchange, assessments, processor markup, monthly volume, we run two independent models over the same source and compare their answers. Agreement is a strong signal. Disagreement is a flag, not a tiebreaker: we don't average two numbers and move on. A mismatch lowers the confidence on that field and, depending on how far apart they are, routes it to review.
This is deliberately more expensive than one model in one pass. It's the cost of catching the failure mode that single-model pipelines can't catch by design: a fluent, well-formatted, wrong answer that nothing contradicts.
Confidence scoring and thresholds
Every extracted field carries a calibrated confidence score, not a global "the model seems sure" feeling. Scores combine signals, how cleanly the value was located in the source, whether the two models agreed, whether it reconciles arithmetically against related fields (do the line items sum to the total?).
Then we set thresholds and act on them. High-confidence fields flow through. Anything below the bar is held back, marked, and escalated. The thresholds are conservative on purpose: we would rather send a clean field to a human unnecessarily than let a borderline one through unseen. A confidence number you never act on is decoration. Ours gates behavior.
Provenance chips and citations
Every number we surface is tied to its origin, the specific page and region of the statement it was read from. In the interface these appear as provenance chips: tap a figure, see exactly where it came from. The point isn't decoration; it's the difference between a number that was read and a number that was inferred. If a value can't be traced to a source, it doesn't earn a chip, and that absence is itself a signal.
This is also what makes the analysis defensible to someone who wasn't in the room, a partner, a finance team, a future acquirer doing diligence. They don't have to trust the output. They can follow it back to the document.
Human-in-the-loop on low-confidence cases
Automation that can't escalate is just automation that's wrong loudly. When a field falls below threshold, or the two models disagree, or provenance is missing, it goes to a person before it reaches you. The reviewer sees the source, both model readings, and the reason it was flagged, then makes the call.
Crucially, that decision feeds back. A corrected field becomes part of the record and informs calibration, so the same ambiguity is handled better next time. Humans aren't a fallback we're embarrassed by; they're a designed stage, reserved for exactly the cases where judgment beats pattern-matching.
Auditable writes: the part nobody sees
The controls above govern what we read. This one governs what we record, and it's where a lot of AI systems quietly fail.
When the system writes a result, the write is idempotent: running the same analysis on the same input twice produces the same state, not a duplicate or a drift. And it's logged, what changed, when, derived from which source version, at what confidence. Reruns don't pile up phantom records. Corrections supersede cleanly rather than fighting the originals.
That matters for a boring, important reason: reproducibility. An analysis you can't reproduce is an opinion. An analysis you can rerun, with a record of every value's source and every change's timestamp, is something you can stand behind months later when someone asks how you got the number.
What this is, and isn't
A few honest boundaries, because overclaiming would undercut the whole point.
This methodology improves accuracy and makes results checkable. It does not make the system infallible, that's why human review and provenance exist, so the rare error is catchable rather than buried. The confidence scores are calibrated estimates, not guarantees.
To be clear about our role: Relyon is a retail-sales ISO. Processing runs on Fiserv and TRX (TrxServices, an ISO/MSP of Metropolitan Commercial Bank, Member FDIC). We're the sales arm with the analysis layer on top, not a bank or a processor.
And on pricing: the same evidence-first discipline applies. We present pricing as a genuine choice across six models, interchange-plus, tiered, flat, surcharge, dual pricing, and interchange optimization, and let the numbers, traced to the statement, point to the right fit. No default, no thumb on the scale.
The short version
Trustworthy automation isn't a claim you make; it's a property you can demonstrate on demand. Two models check each other. Confidence decides what's safe to ship and what needs eyes. Every number points back to its source. Hard cases reach a human. And every write can be replayed and explained. That's what audit-grade means here, intelligence with an audit trail, built into the foundation rather than bolted on after the fact.