Why Bookend
Your documents never leave the bank.
Most document-AI vendors assume cloud inference on your loan files. Bookend ships as containers that run inside your network with the model baked into the image. There is no tenant to secure, no data-processing addendum to negotiate for loan documents, and nothing to explain to your vendor-risk committee about egress.
Architecture
Inside your network, on your terms
- Reference sizing: 16 vCPU, 64 GB RAM, 500 GB storage. No GPU. Per-bank volumes are well within CPU inference.
- Database: PostgreSQL by default or your SQL Server — same schema, same forward-only migrations, two principals (owner for migrations, least-privilege for the application).
- Updates: signed releases you pull on your own change-control schedule. No unattended updates. Preflight checks refuse to start on a schema mismatch.
- Core hosted by Jack Henry? The containers still run in your network and reach the core over jXchange as they would on-site.
- Air-gapped: supported. Heartbeats off; a signed quarterly usage report replaces them.
Explainability
Deterministic rules, human approval
The model’s job is narrow: classify documents and find fields. Judgement — does this rate agree with that one, does this guarantor have a guaranty — is a versioned rule with a page that explains what it compares and with what tolerance. That is what makes a finding defensible to an auditor, reproducible on the same input, and safe to tune by policy rather than by retraining.
Reproducible
Same package, same rules version, same findings. The ruleset version is stamped on every reconciliation run.
Tunable by policy
Money, rate and date tolerances and name normalization are settings, not model weights. Reason codes are yours.
Reviewed by a person
Every loan passes a specialist. Nothing is boarded, and no wire leaves, without approval inside your existing maker-checker controls.
Controls
Maker-checker, everywhere it matters
The person who stages a boarding cannot approve it, even as an administrator. The person who stages a wire cannot approve it. Overrides carry reason codes and justifications; escalations are recorded and mailed. Sealed loans are read-only. These are enforced in the platform, not suggested by a procedure.
Model risk
A validation pack for your model inventory
Under SR 11-7 and OCC guidance, proportionate to a community bank, the extraction model is an item in your inventory. Every signed release ships with its validation pack: test sets, accuracy by field type, known failure modes, monitoring and change history. Confidence gating routes low-confidence numeric and party fields to a person rather than accepting them.
Metering
Exactly what leaves the bank, shown on screen
Bookend is priced per closed loan, so it needs a count. The heartbeat carries an install id, the version, the period, one integer and coarse health — nothing else — and the Metering screen shows the payload verbatim before and after it is sent. Air-gapped installs generate a signed quarterly report instead.
Start with a Closing Workflow Review
Forty-five minutes with your head of loan operations: we map approval → documents → execution → boarding → funding, count the touches, and pull three recent boarding exceptions. You get a one-page Closing Error and Capacity Map — whether or not you go further.