Vigilant + Codex · SEC · FINRA · FinCEN · DOL

The AI-native compliance platform

Trustscape's Vigilant maps every obligation your institution carries — SEC, FINRA, FinCEN, DOL/ERISA — to the controls, owners, and evidence behind it, on a rulebook that Codex keeps verbatim and point-in-time. Grounded, exam-ready, always current.

Book a working session → Explore the platform

45 minutes · your rulebook, live

app.vigilant.com/dashboard

Live compliance posture dashboard: 90 total obligations, design and effective coverage tiles, open remediation banner, coverage trend and obligation status charts

Compliance that's an extension of your operations

Rules arrive as structured, point-in-time data — and checks run against your real records, not a spreadsheet copy.

✦ 3 findings on WSP §4.2Supervision procedures don't reflect the amended FINRA 3110.19 — here's a redline ready for review.

Agent

Compliance Agents

Your records and your rulebook, in sync (finally)

Vigilant's Compliance Agent checks your records against the rules Codex publishes and drafts grounded findings; the Audit Agent walks the evidence chain; the AutoMapper proposes obligation-to-control mappings. Every proposal lands in a review queue, governed from Agent Admin.

Agents propose · people approve

# Query the corpus directly
GET /v1/rules/{uri}?as_of=2026-07-26
X-API-Key: ••••

{ "uri": "codex://us/finra/rule/3310",
"normative_effect": "obligation",
"provenance": { "signature": "ed25519…" } }

Codex API

Built for compliance teams, designed for developers

Query SEC, FINRA, FinCEN, and DOL rules as structured JSON over REST — any provision as of any date, classified by normative effect, every answer signed. API-key secured.

REST · JSON · API keys

Vigilant Assistant

On every screen — and it knows which one

Ask about the page you're on, or anything in your program, without leaving it. Answers come from live compliance data with the governing citation attached — the same grounded agent, the same guardrails, whether you ask from the quick panel or in a full Chat conversation.

Discover the Assistant →

Tools for teams who care about defensibility

Vigilant streamlines the whole program — obligations, controls, policies, vendors, evidence, and remediation — with proactive, relevant AI checks.

Obligations register in the live product: citations, titles, regulation, source, and risk columns

Vigilant · Compliance Workspace

One reading of program health

Obligations, rules, controls, and mappings with maker-checker approval — plus AML/KYC and surveillance cases worked in the same graph, so coverage and casework never drift apart.

Coverage · Cases · Remediation

Early access Evidence Library in the live product

Verbatim grounding

Findings you can defend line by line

Every automated finding quotes the exact regulatory text it was checked against — filed in the Evidence Library and assembled into the 3120 report from live data.

Evidence Library · 3120 Report

Connected knowledge

A connected layer for regulatory knowledge

Unify every source — eCFR, FINRA notices, FinCEN advisories, your own policies — into one intelligent layer that lives in your workspace, your checks, and far beyond.

Explore Codex

📜eCFR 🏛FINRA 📋Your policies

◆Codex

✓Agents ✦Assistant ⌁API

Enterprise-grade compliance intelligence

Vigilant and Codex scale with your firm — the security, control, and flexibility regulated institutions need.

Learn more

Identity & access

SAML 2.0 and OIDC single sign-on, SCIM 2.0 provisioning from Okta or Entra, and TOTP MFA you can enforce org-wide. Roles live in the database — some thirty named permissions, custom roles without a redeploy, approval as a distinct right.

Audit trail & AI accountability

A hash-chained, immutable audit log with a verify-chain endpoint — and a second chain recording every AI inference across all 23 agents, with the model version pinned. Every agent has a deterministic fallback, so nothing silently depends on a model.

Data isolation & encryption

Business-unit scoping is enforced at the data layer, so every query — including what an agent can see — is filtered by design. External auditors see only their engagement, with sensitive evidence redacted; connector credentials are encrypted at rest.

Governed workflows

States, transitions, role gates, and SLAs are configuration, not code. Approval chains, event-triggered automation rules, and AI review thresholds decide what needs a human — and the audit log records who that human was.

SAML 2.0+ OIDC SSO

SCIM 2.0Provisioning

Ed25519Signed records

WORM17a-4 storage

Integrations & API

Jira and ServiceNow, bi-directionally, with conflicts surfaced rather than overwritten. Outbound webhooks with delivery and retry, evidence connectors for AWS Config, Okta, Entra ID, and GitHub, and a versioned public REST API with scoped keys and rate limits.

Deploy anywhere

Docker Compose to start; Azure, AWS, or GCP to scale; storage on local disk, Azure Blob, or any S3-compatible store, including on-prem. Choose your LLM provider — Anthropic, Groq, or Google — with per-provider throttles.

Records integrity

Codex keeps every source document in WORM storage with ten-year immutable retention, built for SEC 17a-4(f). Every commit is Ed25519-signed and the public key is published — your auditors can verify our content without trusting our word.

Migration & support

White-glove migration from spreadsheets and legacy GRC — import controls, risks, and mappings straight from a CSV or Excel export — plus 1:1 support and training so you're running fast.

Coverage