Check Demo Talk to us
What it removesPlatformSovereign AIBuilt for NepalTalk to us
Masto Fin · Business process management for banks

Humans make the final click that decides.

Filling in a KYC form. Opening an account. Applying for a credit card. And the bank's own internal work — listing a vendor, a purchase decision that crosses five desks. These are no longer things people do. They are things that run, and stop at the one judgement that needs a person.

Check Demo Talk to us

The demo is the real product, running. mastofinbank.cellapp.co

Working in the build you can open today
  • OpenID Connect sign-in with PKCE
  • Dual control that refuses a self-approval
  • Reference data read live from the service
  • English and नेपाली
  • A written reason on every change
What it removes

One vendor.
Nine desks.
Then one.

Vendor onboarding is the honest example, because nobody thinks it is glamorous and everybody has lived it. Here is the same registration, walked twice.

Today, on paper

Nine human touches. Seven of them are re-typing something that already exists.

  1. Vendor Emails documents. Someone prints them.
  2. Front desk Keys the vendor into a register by hand.
  3. Front desk Walks the file to Compliance.
  4. Compliance Checks PAN and the blacklist, writes the result on the file.
  5. Front desk Re-keys the result into the register.
  6. Department head Reads it, recommends, signs, sends it on.
  7. Procurement Sets category and limit. Signs. Sends it on.
  8. Approving authority Reads. Approves.
  9. Someone Types the vendor into the core system. Files the paper.

Where the file is right now: ask around.

On Masto Fin

The same nine steps. Eight of them stop being work.

  1. Vendor Submits once, on the portal, in English or Nepali. automatic
  2. Form Enforces the checklist. An incomplete file cannot be submitted. automatic
  3. Documents Arrive classified, indexed and versioned against the case. automatic
  4. Checks PAN, blacklist and duplicate-vendor run as service tasks. automatic
  5. Routing Who sees it next is in the process model, not in an inbox. automatic
  6. Clocks The SLA starts, and escalates itself when it is missed. automatic
  7. Audit Every step writes its own record as it happens. automatic
  8. Core system Written once, by the integration, from the data already captured. automatic
  9. Approving authority Reads the case and decides. the human step

And the person who prepared it cannot be the person who approves it.

Read this before you believe the picture above That walk is how Masto Fin models the process — it is a design, drawn from a real Nepali bank's procurement workflow, not a recording of a live deployment. Which of the pieces underneath it you can actually use today is on the next section, labelled one by one. We would rather you check.

The platform

Every part,
and where it is.

A banking platform that overstates itself gets found out in the room, by the customer. So each capability below says what stage it is at, in the same three words we use internally.

Live
You can do it in the demo, today, against a running service.
In build
The service and its tests exist; the screen in front of it is not finished.
Designed
Specified, licence-cleared and architected. Nothing is running yet.
Live

Dual control, and what the screen says about it

Save the change and the service answers 202, change requested. Not 200. Not "saved". Nothing has moved yet, and the screen says so in both languages:

This does not save. It raises a change request.

यसले सुरक्षित गर्दैन। यसले परिवर्तन अनुरोध खडा गर्छ।

Change requested — not applied

परिवर्तन अनुरोध गरियो — लागू भएको छैन

The maker cannot be the checker. Neither can the maker's delegate, nor the person whose authority the maker is currently holding, nor anyone joined to them by a chain of live delegations — because two-person control that a delegation can walk around is not two-person control.

Live

Sign-in

OpenID Connect authorization-code flow with PKCE S256, against Keycloak federated to the Bank's directory. No password is ever typed into the application. The role codes and the permission version come from the token.

Live

Admin console

Lookups and reference tables read from the running admin service — not from a fixture. Concurrency is honest too: a read hands you an ETag, a command without If-Match is refused with 428, and a stale one with 412.

In build

Audit trail

Every state change writes an event through an insert-only database account, into an append-only outbox. The contract makes an event with no actor, action or entity impossible to construct — the compiler refuses it before the schema runs. The hash chain over those records, and the chain heads written to WORM storage, are in build. The finished property is tamper-evident: you can prove a record was altered. We do not say it cannot be.

In build

Process designer

Real BPMN 2.0 on bpmn-js, executed by Flowable over REST — not a diagram that documents a process someone coded separately. The model is the thing that runs. The library screen is in the demo; the canvas is the next build.

In build

Forms and data capture

One form definition serves the branch, the intranet and the customer portal, on web and on phone, from a single Expo codebase. Rules in FEEL, decided by DMN tables the business can read.

In build

Cases and documents

A case holds the file, the correspondence, the checklist and the decision trail in one place. Documents are versioned, classified and retained against the case, not against a folder someone named.

In build

SLA and escalation

Business time, computed on the banking calendar rather than on a 24-hour clock: a Sunday is 420 working minutes, a Friday is 300, Saturday is the weekly holiday, and a public holiday is not a breach. A target that is missed escalates itself.

Designed

Sovereign AI

The model, the retrieval and the guard rails are specified, licence-cleared and architected. Nothing is deployed. What it is built to do →

Sovereign AI · Designed, not yet deployed

The model runs
inside your building.

This is the section a competitor cannot copy by writing it down, because it is an architecture decision taken early and a licence register kept since. Everything here describes what the platform is built to do. No model is answering a customer today, and we will not pretend one is.

01

Inside the data centre

An open-weight model served on vLLM, on hardware in the Bank's own data centre. Not a key to somebody's cloud with a Nepali label on it.

02

No outbound route

There is no egress path from the inference zone. Only the AI gateway may open a connection to the model; every other service is refused by network policy and by the mTLS allowlist, and the refusal is logged.

03

It cannot read past your permissions

BGE-M3 embeddings in PostgreSQL with pgvector. The caller's entitlements are a SQL filter applied before the vector search, so retrieval cannot cross a branch, a department, a role or a classification — not even by accident, not even when the answer would have been useful.

Audited

Every AI action writes the same kind of audit record as a human one: who asked, what was retrieved, what came back, what it was used for.

Role-gated

An AI capability is a permission like any other. If your role cannot see the data, the assistant cannot either.

Human-reviewed

Nothing an AI drafts — a rule, a form, a routing change — takes effect until a person has read it and approved it through the same dual control as everything else.

It stays in Nepal

Data, backups and inference all sit in the Bank's data centre and its DR site. Nothing leaves the country, because nothing leaves the building.

The limit, said out loud Voice is English commands and English dictation. Nepali is a fixed command grammar — a defined set of spoken commands, recognised reliably — and not open dictation, because the open Nepali speech models good enough to promise it either do not exist or carry a licence we will not ship. Nepali retrieval, on the other hand, works well, which is why the design leans on it.

Built for Nepal

Not localised.
Built here.

The difference shows in the small decisions — the ones a product translated after the fact gets wrong, and an officer in a branch notices on the first day.

English and नेपाली, everywhere

Both languages ship in the same build, down to the error messages. Not a glossary bolted on: the Nepali is written as Nepali, and the tests assert Devanagari rather than merely asserting the string is not blank.

स्वीकृतिका लागि पेस गर्नुहोस्

The Sunday-to-Friday week

Business time is computed on the banking calendar. Sunday to Thursday is a full day, Friday is short, Saturday is the weekly holiday, and a Dashain closure is not an SLA breach. The same answer comes back from the API preview and from the timer that fires.

Nepal Time as a constant

UTC+05:45, all year, as arithmetic — never read from the host's time-zone database. A business date that a phone and a server disagree about is a reconciliation defect nobody can reproduce.

BS dates, and why one half is switched off

Dates are stored in AD and shown alongside Bikram Sambat. Today the BS half of the date field is on screen, labelled, and disabled with the reason visible, because the conversion table is not in this build yet — and Nepali months run 29 to 32 days on a pattern that is tabulated, not calculable.

We could have guessed. A guessed BS date is wrong exactly at the month boundary a Nepali officer checks first, and an effective-from date that is one day out is a wrong interest rate on a real account. So it is switched off, and it says why.

Shaped for the regulator

Dual control on every configuration change. A tamper-evident record of who changed what, when, and with which reason — the reason is mandatory and at least five characters, and it goes into the audit record, not just the ticket.

On-premise, and on purpose

Kubernetes in the Bank's data centre with a DR site, container images pinned by digest and mirrored to the Bank's own registry, and an open-source licence allowlist enforced in CI so nothing copyleft or non-commercial reaches a runtime image.

See it before you believe it

Open the demo.
Then ask us the hard one.

Sign in, raise a change, watch it refuse to let you approve your own work. Bring the question you think will break it — that is the useful meeting.

Check Demo hello@masto.one mastofinbank.cellapp.co