How to add an AI assistant to a mobile banking app safely
Last updated 13 October 2026
Start with reads, keep every change behind a confirmation the customer taps, run actions with the customer's own token, mask what they type before any model sees it, and keep a record your risk team can read. Rendel does each of these by default inside your existing Flutter or web app.
1. Decide what it may read, and what it may change
List the API calls the assistant may use, and mark each one as a read or a change. Reads, such as balances and recent payments, can answer at once. Changes, such as transfers or a card freeze, should always wait for the customer.
In Rendel these are your actions: described once, validated against their schema before anything runs, and switchable off in the console without a release.
2. Put a confirmation in front of every change
The customer should see exactly what will happen, in words the bank wrote, and tap to agree. Rendel's confirmation card is built by its server from your action, never from the model's wording, and the server records the answer with the time, the device and the person.
3. Run as the customer, not as a super-user
The assistant should call your API with the signed-in customer's own token, so the limits, checks and fraud rules you already have keep deciding what is allowed. There is no separate back door to secure.
4. Mask before the model, and keep the record
Emails, phone numbers and card numbers that users type are masked before the model sees them; IBANs and Turkish ID numbers too. Every action is kept with the conversation, and owners can export it for audit.
5. Know where the data lives
Rendel stores data in Frankfurt, in the EU, and the model is not trained on your traffic. For banks in Turkey: after an assessment, a Turkey region or your own servers, by separate enterprise agreement.
Questions
Can the assistant approve a transfer on its own?
No. A change runs only after the customer confirms it on the card, and a success reported without that confirmation is recorded as declined.
Does Rendel hold certifications a bank's vendor review asks for?
Not yet: we hold no SOC 2 report or ISO certificate, and we say so. The security page lists what we have and what we do not.
How long does a pilot take?
Pilots have taken about two weeks from installing the SDK to shipping behind a flag.