Eli
What we solveHow it worksWhy EliSecurityTrust center
Log inOpen the demo

A clear trust boundary before a college shares data.

Financial-aid work can involve federal tax information and student PII. This page separates what the current synthetic demo implements from the controls and contractual decisions still required before production data. The public demo uses 100% synthetic data, and raw FTI is outside Eli's present boundary. The full pilot packet, FTI boundaries, AI governance, FERPA, GLBA, RBAC, and draft HECVAT response materials live in the Trust center.

Data handling
In transitTLS 1.2+ (Vercel edge + Supabase)
At restProvider-managed storage encryption; application-layer field encryption is not yet implemented
Tenant isolationRow-Level Security is enabled in the repository schema; server-side institution scoping is also enforced
Access modelLeast-privilege; server-only service role; no client DB access
RolesAdmin / Reviewer / read-only Auditor
Audit trailWorkflow and human actions are hash-chained and exportable; this is tamper-evident, not immutable
Demo data100% synthetic, no real student, IRS, or FAFSA records
Model card
Modelsclaude-sonnet-4-6 (via Anthropic / Vercel AI Gateway)
AI doesReads documents, narrates reasoning, drafts outreach, answers questions
AI does NOT decideThe dollar rules, $25 trigger, all-or-nothing, Per-Computer, SAI, are deterministic code
Human in loopIdentity, conflicts, non-filers, PJ, and low-confidence always route to a person
Measured accuracy100% field accuracy on a synthetic corpus (n=52), 0 hallucinated fields (last eval 2026-06-09)
GuardrailA self-check runs before any autonomous correction; flags route to a human
Known limitsThe accuracy corpus is synthetic documents, not scanned IRS originals; SAI/Pell figures are directional estimates finalized against federal tables

Accuracy is measured against a labeled synthetic corpus, summarized below; a scanned-document benchmark is in progress.

Regulatory posture
  • Intended FERPA role. Eli is designed to serve under an institution's direct control with purpose-limited access. The school-official designation must be made by the institution and written into a counsel-reviewed agreement before student records are processed. [34 CFR 99.31]
  • Raw FTI excluded. The current demo does not ingest raw FA-DDX or transcript FTI. Any future tax-data scope requires a fresh control, contract, and legal review; MFA, application-layer field encryption, and independent testing are not represented as complete. [NIST SP 800-171 r3]
  • TPS status is scope-dependent. Human review and decision-support design do not settle Third-Party Servicer status. The institution and qualified counsel must classify the actual statement of work before an operational Title IV pilot. [34 CFR 668.2]
  • Records retention. Verification records are retained for at least 3 years after the end of the award year, then eligible for secure destruction. [34 CFR 668.24(e)]
Fraud & identity controls
  • Explainable demo scoring. Synthetic applications receive a deterministic 0–100 score from named fixture signals; the UI shows the contributing signals and synthetic ring clusters. Production validation and monitoring remain open.
  • Identity-review workflow. The demo records a synthetic review method, reviewer, date, and evidence state. It is not connected to an identity provider and does not establish production IAL2 assurance. [34 CFR 668.57]
  • OIG referral packet. The demo prepares a synthetic evidence packet and hash-chained register entry. It does not transmit a referral to OIG or claim an immutable external record. [34 CFR 668.16(g)]
Auditability

The demo keeps a replayable, hash-chained record of workflow actions, extracted fixture values, reconciliations, reviewer decisions, and cited rule references. The trace and sample audit packet are exportable for evaluation. Production completeness, retention execution, and auditor acceptance must be validated in a scoped pilot.

Auditable by design

A replayable record on every case.

Each line shows what the AI read, the deterministic decision, the governing rule, and the person who signed off. Redacted and exportable.

case traceredacted / synthetic
✓identity verified · method=live-video · IAL2 · 34 CFR 668.57
✓extracted AGI $52,000 · source=IRS transcript (Per Computer) · conf 0.98
→conflict: amended return (1040-X) · routed to a human
✓SAI recomputed · deterministic engine · delta logged
✓decision of record · approve & correct · by aid administrator
·retained per policy · 34 CFR 668.24(e)
Sample proof artifacts
AUDIT.PDFAudit package sample›TRACE.JSONReasoning trace JSON›EDE.TXTEDE correction sample›IDV.CSVV4/V5 identity CSV›
Measured accuracy
100%
field accuracy (n=52)
$0
dollar mean-absolute error
0
hallucinated fields
21
labeled fixtures in the corpus

Last run 2026-06-09, against a labeled synthetic corpus (clean and OCR-degraded renders, not scanned IRS originals). The signed-in demo shows the full eval detail and the live human-override rate.

Try a demoHow Eli works

Synthetic demonstration environment. No real student, IRS, or FAFSA records.

Eli

The AI operations platform for financial aid offices. Software your team runs, or a managed service we run with you. A person signs every consequential decision.

What we solveHow it worksWhy EliSecurityTrust centerThe 5-minute proofThe 90-day pilotLog in to the demo
Questions? founders@tryeli.comSynthetic-data demo. No real student, IRS, or FAFSA records. © 2026 Eli.