Confidential · Prepared for Gusto · Office of the CLO & CTO · TKT-GUS-2026-05
Tok · To  (the system of record for enterprise AI)

AI AccountabilityInfrastructure.

For Gusto: the control plane and system of record under every AI decision you’re accountable for.

Run AI at the speed of Claude, with full integrity, control, and regulatory compliance. Other tools patch AI risk. Tokto operates the layer where AI actually runs.

AI RISK LITIGATION SECURITY INSURANCE COST REGULATION
Prepared for
Dina Segal · Chief Legal Officer
Copy
Office of the CTO · Platform & Security
From
Rob Matzkin · Tokto.ai
Scope
Capabilities only · no commercial terms

“We’re literally selling compliance. It is the product… it better be right and your paycheck better come in on time.”

DINA SEGAL · CHIEF LEGAL OFFICER · GUSTO
01 · The accountability layer

Three modules. One checkpoint.

Tokto runs as a unified control layer in the path of every AI call. Inspect. Enforce. Record. Each module solves a problem the office of the CLO and CTO already owns.

1

System of Record

The immutable record beneath every AI decision Gusto is accountable for.

  • Immutable, tamper-evident trail
  • Full attribution: who, when, which model, which policy
  • Regulator-ready export, scoped per vertical
2

Real-Time Checkpoint

The control point inside every AI conversation.

  • Inspect prompts and responses pre-delivery
  • Enforce policy by team, role, or model
  • Block, redact, warn, or route, at the moment of interaction
3

Verification & Oversight

Your eyes where your team can’t physically be.

  • Your verification agents sit on the checkpoint
  • Flagged calls pause for review or run and escalate
  • An auditable agent workforce, not endless headcount
02 · Why now

The control surface is catastrophically breaking.

You have excellent policies, a deeply embedded legal & compliance org, Runlayer gating MCP connections, and enterprise agreements with the model providers. None of it fully holds, because “everybody is coding now.” The control surface moved from a few sanctioned apps to every employee with a Claude window and an idea.

Regulation arriving
Aug 2, 2026

The EU AI Act’s high-risk obligations, including record-keeping, become enforceable. The bar is rising on a clock.

Live exposure
8.5%

of enterprise prompts already contain data that should never be shared. For a regulated platform, each one is a named exposure.

Velocity

the old pace of building. Your team “physically can’t keep up” and “can’t be in every room all the time.”

03 · The thesis

You already sell compliance. AI is the thing most likely to break it.

Gusto’s moat is not features. It is that a small business can hand you payroll, benefits, 401(k), and the movement of real money, and trust it will be right, on time, and defensible to a regulator. The same Claude workflow that let one person rebuild an incumbent marketing-review tool to 85% in two days is also one where customer PII, privileged analysis, or a regulated decision can leave the building in a single prompt, with no record it happened and no control that could have stopped it.

The strategic claim

For a company whose product is compliance, AI governance is not overhead; it is product integrity. The faster Gusto adopts AI, the more the control layer becomes the thing that lets you keep selling trust at all.

Your AI use isn’t horizontal. It sits on top of a regulatory surface with named owners:

Broker-dealer & retirement (FINRA)

The bar isn’t “we use AI responsibly”; it’s “show us exactly how this decision was made.” This is people’s 401(k).

Money transmission · ~40 states

You move billions, and each license carries its own examination and recordkeeping expectations.

Financial-crime compliance

SARs, AML, enhanced due diligence, fraud, with teams in the US and India whose volume scales with the business.

A daily cadence of inquiry

Not because anything is wrong, but because normal exams and oversight never stop.

Layer AI onto that and three gaps appear that policy alone cannot close:

You can’t see

Every AI call across every provider: Claude, ChatGPT Enterprise, and the agents multiplying underneath.

You can’t control

The calls that matter, in real time, before something privileged or regulated leaves the building.

You can’t prove

After the fact, what actually happened, for a regulator who is asking right now.

04 · The category

From sprawl to one checkpoint.

Most “AI governance” is a dashboard bolted onto one provider’s enterprise tier, which gives you per-provider blind spots the moment you run Claude and ChatGPT Enterprise side by side. Tokto turns ungoverned, many-to-many sprawl into a single governed control point, without changing how people work.

Today · many-to-many

EmployeeCo-work agentAML agent Marketing reviewVerification agent ClaudeChatGPT Ent.Agent → agent

No single place to see, control, or prove what happened.

TOKTO CHECKPOINT
inspect · enforce · record

With Tokto · one governed path

ClaudeChatGPT EnterpriseAny modelAny agent chain

One policy. One record. Every call inspected, enforced, and written to an immutable trail on your own infrastructure.

05 · What you said, answered

Your needs, paired with the specific capability that answers each.

This is the heart of it. Each item below is something you raised on the call, matched to what Tokto does about it.

Privilege & unauthorized legal use of AI

“A CEO used AI to do legal analysis and it was held against him in court… how do you recognize when a non-lawyer is using AI for legal advice, and protect that?”
A policy rule detects when a non-lawyer is soliciting legal analysis or pasting privileged material into a model, and can block it, redact it, or route it to corporate legal, before it becomes discoverable. For an in-house team this is one of the cleanest, most defensible controls Tokto offers, and it generalizes across your whole counsel network.

FINRA, retirement & the regulator-facing record

“We have deep vertical requirements… the very unique things FINRA wants to see when they come in and see a retirement product. This is people’s 401(k).”
Every AI call is written to an immutable, on-prem record: prompt, response, who, when, which model, which policy fired, what action followed. The checkpoint is configured per vertical, so a FINRA-facing retirement workflow carries its own rule set and evidence schema, distinct from money-transmission. “Show me how this decision was made” becomes a query, not a months-long project.

Financial-crime compliance at scale

“We can’t keep just adding people… part of that team has to be agents, with the deep experts overseeing and accountable for the work.”
AML, SARs, and enhanced-due-diligence agents can run on the Tokto checkpoint. Every agent action is inspected, quality-gated, and recorded; flagged items pause for human review or run and escalate. Your senior analysts supervise an auditable agent workforce instead of reviewing every case by hand, and each decision carries the trail proving a junior-analyst-or-better standard was met.

Verification agents: eyes where your team can’t be

“How do we build agents that can be our eyes where we don’t have eyes, and bring things to us as we need them?”
This is native to the model. Your verification agents sit on the checkpoint; Tokto routes flagged calls to them for inspection, pauses or releases based on their finding, and surfaces what matters back to your team. You define what “bring it to us” means; the checkpoint enforces it across every room you can’t physically be in.

Claude-speed marketing review with real controls

“The challenging part we’re spending double-click time on is the controls, without taking away the speed of the Claude. No other solution can give that to us.”
Tokto is exactly that missing layer. Your team keeps the Claude co-working agent that does the review at full speed; the checkpoint wraps it with marketing-compliance controls, redaction, and an audit trail. Speed and rigor stop being a trade-off because they live in different layers, which is why we’d suggest this as the first pilot.

Configurable to your domain, without us learning it

“I don’t need your team to know the requirements, but I need to be able to configure the solution so it works for the very unique things FINRA wants.”
Exactly the design intent. Tokto is the technology layer; your retirement experts (including the team you acquired) configure the rules and evidence schema for their domain. We bring the universal checkpoint and a library of out-of-the-box compliance modules; you bring the depth. Where you’d rather not build it, major implementation partners (including Big Four practices) can configure it with you.

Multi-provider reality, alongside Runlayer

“We’re Claude and ChatGPT Enterprise… nobody can just connect an MCP, it has to go through security and through Runlayer.”
Tokto is provider-agnostic and sits in the call path regardless of model, so Claude and ChatGPT Enterprise are governed by one policy and one record. It complements Runlayer rather than competing: Runlayer governs which connections exist; Tokto governs and records what flows through them once they do.
● For the Chief Legal Officer
06 · The control plane

Regulator-readiness as a default, not a fire drill.

You made the cost concrete: the difference between Tokto and its absence is “the difference between you and months of work.” When a regulator asks how a decision was made, the honest answer for most AI-using companies today is reconstruction: pulling logs that were never designed to answer the question. Because Tokto’s record is generated at the moment of every call, regulator-readiness becomes a property of the system rather than an effort you mount per inquiry.

CapabilityWhat it gives the CLO’s office
Immutable, on-prem recordEvery AI call captured at source; nothing to reconstruct, nothing that left your control to be governed elsewhere.
Per-vertical evidence schemaThe fields FINRA expects for retirement differ from a state MTL exam; each is captured to its own standard.
Policy-fire trailNot just what was said, but which rule fired and what action followed: the “how was this decided” answer.
Query, scope, exportRespond to an inquiry by filtering to regulator, product, person, and window, in minutes.
Forward-compatibleBuilt anticipating record-keeping mandates (e.g. the EU AI Act’s logging direction), so a rising bar doesn’t mean re-architecting.
Agents managing agents: the inspection layer that survives it

We aligned on where this goes: agents, then agents managing agents, then “one person managing a thousand,” with agents becoming buyers too. In that world, human-by-human review is mathematically impossible. The checkpoint doesn’t care whether the caller is a person or the fourth agent in a chain: every layer passes through the same inspection and lands in the same record. The same checkpoint that governs internal use governs the customer-facing surface too: the chatbot that should never hand out advice it isn’t allowed to give.

● For the Office of the CTO
07 · Architecture

Two planes, one substrate.

The execution plane runs the AI interaction inline, on the hot path, adding ~150ms and invisible unless policy intervenes. The record plane proves what happened, asynchronously, in a sealed ledger. The user never feels the control unless your policy says they should.

Execution planeHot path · ~150ms
CALLER
app · agent · user
REGULATE
inline policy + snapshot
ROUTE
provider + model select
EXECUTE
model + tool calls
CACHE
evidence-aware reuse
RESPONSE
re-inspected → user
⛬ Ethical engine · validate for bias, hallucination & unsafe content before delivery
▼   async · non-blocking   ▼
Record plane · AI System of RecordSealed ledger
OUTBOX
durable queue
PROJECTION
evidence domains
SEAL
hash chain
REPLAY
re-project, never re-run
VIEWS
stakeholder surfaces

Integration, latency & deployment

WHERE IT SITS

Inline, provider-agnostic

“Our pipe and our checkpoint between your pipes.” Coexists with Runlayer: Runlayer governs which connections exist; Tokto governs and records what flows through them.

DEPLOYMENT

On-prem, fully sovereign

Top-tier encryption; the system of record lives on your servers, and the policy SLM can run on your premises, so even model-assisted governance never moves sensitive content off-site.

EXTENSIBILITY

Rules + modules + your agents

Deterministic rules for must-always-behave cases; pluggable compliance modules; and your own verification agents inserted into the inspection path to pause, QA, or escalate.

100%
of requests supervised; no call goes around the foundation
~150ms
added latency, invisible unless policy intervenes
On-prem
self-hosted; raw data never leaves your environment
1 policy
across Claude, ChatGPT Enterprise & agents
08 · System of Record

When the regulator asks, the record already exists.

User, prompt, model, response, policy, decision, timestamp, cost. Every AI interaction at Gusto is stored as a tamper-evident record on your own infrastructure, SIEM-ready and queryable. When a FINRA examiner, a state money-transmission auditor, or your own board asks what your AI actually did, you answer with evidence instead of effort.

The literal system of record

Most AI logs were never built to answer a regulator's question. Tokto's record is generated at the moment of every call and sealed so it cannot be altered after the fact, so the artifact a FINRA, state MTL, or BSA/AML examiner wants is created as the work happens, not reconstructed months later.

How it works

Every call follows the same path, and the last step is the one a regulator cares about.

User
User / app
Prompt
Input
Model
Claude · ChatGPT Ent.
Response
Output
Policy & decision
allow · redact · block · route
Timestamp & cost
UTC · USD
System of record
Stored & sealed

The immutable, tamper-evident record

A single AI call, captured field by field. Prompts and responses are stored as cryptographic hashes, so the record proves what happened without exposing the sensitive content itself.

Immutable, tamper-evident record · one interaction
Record ID
01J9X7…K3F9
User
j.rivera@gusto.com
Prompt hash
a73ec…92b1
Model
claude-sonnet-4
Response hash
9bd1e…7f21
Policy / decision
FINRA-Ret v2.1 · Allow
Timestamp (UTC)
2026-05-22 13:45:22.123Z
Cost (USD)
$0.0124
Prev hash
0000…8a7d

Record integrity: a blockchain-style hash chain

Each record carries the hash of the record before it. Change any field in any record and its hash changes, which breaks every link that follows. Tampering is not just discouraged, it is mathematically detectable.

0000…8a7d 8a7d…b2c1 b2c1…d4e5 d4e5…f6a7 f6a7…9b8c 9b8c…3d2e 3d2e…7f41
Cryptographically sealed. Any change breaks the chain, which is exactly what makes the trail defensible in an exam or in discovery.

What the record lets you do

01 · Queryable

Any inquiry becomes a filtered query

Filter to a regulator, a product, a person, and a window. Fast, indexed search across every field, on your own infrastructure.

-- Every AI-touched retirement decision, Q1 2026 -- scoped to the FINRA examiner's request SELECT * FROM ai_interactions WHERE product = 'retirement_401k' AND policy = 'FINRA-Ret v2.1' AND timestamp >= '2026-01-01' AND timestamp < '2026-04-01' ORDER BY timestamp ASC;
02 · Replay without re-running

Reconstruct exactly what happened

The record stores the prompt, response, model, and decision, so you reconstruct and verify the actual interaction without calling the model again. No token cost, and no risk of a different answer the second time, which matters when the thing you are proving is what happened, not what would happen now.

03 · Async enrichment (non-destructive)

Add context later, never change the original

Tag and enrich records after the fact without touching the sealed entry or the runtime decision. The original is preserved; only searchability improves.

  • User department: Retirement Ops
  • Product line: 401(k)
  • Data sensitivity: PII
  • Tags: FINRA Q1, Examiner-AF-2026
  • Use case: Retirement-Review
04 · Export

One click, regulator-ready

Produce an audit package scoped to a single request: the records, the policy that fired, the decision trace, and the hashes that prove integrity.

Audit package · ZIP  (JSON + CSV + PDF + hashes)

SIEM & enterprise integrations

The record is enterprise-owned and lands where your security and audit teams already work.

SIEM
Splunk, QRadar, Microsoft Sentinel
Data lake / warehouse
Snowflake, BigQuery
GRC / risk / audit
Governance and audit platforms
DLP / security
Data-loss-prevention and security tooling

How it answers each of your regulators

Your regulatorWhat the record gives you
FINRA · broker-dealer & retirement"Show exactly how this 401(k) decision was made" becomes a scoped query plus a replay of the actual interaction, captured to the per-vertical evidence schema an examiner expects.
Money transmission · ~40 state licensesEach license's recordkeeping expectations are answered by a per-state scoped export, generated from the same underlying record.
BSA / AML · SARs, EDD, fraudThe trail proves an agent's decision met a junior-analyst-or-better standard, with full attribution and replay for every flagged case.
Attorney-client privilegeWhen a privileged prompt is detected and routed to legal, the record proves the protection fired before anything became discoverable.
EU AI Act · Article 12 record-keepingImmutable logs generated at source and retained on your own servers, built anticipating logging mandates so a rising bar does not mean re-architecting.
Immutable by designSearchable at scaleVerifiable integrityRegulator readyEnterprise owned
09 · Use case

Written for the seat that owns every regulated decision.

Not a generic template. This is the same control plane, mapped to what matters when your product is compliance, you answer to roughly 40 regulators, and 500,000 businesses trust you to get it right.

Legal & Compliance · Regulated fintech SaaS

You sell compliance. Now your AI has to prove it.

Tokto gives Gusto's Chief Legal Officer one record that ties every AI prompt, every model output, and every agent decision to a person, a policy, a product line, and the regulator it answers to, across roughly 40 money-transmission licenses, FINRA retirement, and BSA/AML, before the inquiry, the exam, or the discovery request arrives.

What keeps you up at night

On a single ordinary day, a money-transmission examiner in one state, a FINRA review of a retirement product, and a BSA/AML inquiry all want the same thing: exactly how a decision was made. Your team is building 10 to 100 times faster than before on Claude and ChatGPT Enterprise, everybody is coding now, and you cannot be in every room. The policies are excellent. The record is not there.

What you get
  • Every prompt and response tied to a person, a role, a product line, the policy that fired, and the regulator it answers to, with Claude and ChatGPT Enterprise governed under one record.
  • A queryable trail for FINRA, roughly 40 state money-transmission examiners, BSA/AML oversight, and your own board, scoped to regulator, product, person, and window.
  • Privilege protection at the prompt: unauthorized legal analysis blocked or routed to corporate legal, PII and regulated decisions redacted before they leave the building.
  • Financial-crime and verification agents that run at Claude speed under human-accountable supervision, every action inspected, quality-gated, and recorded.
What can go wrong without it
  • A non-lawyer pastes privileged analysis into a model and it becomes discoverable, the exact problem you raised on our call.
  • An AI-assisted retirement (401k) decision lands with no record of how it was made. FINRA asks, and reconstruction takes months.
  • An AML or SARs agent makes a call no human can defend, with no trail proving a junior-analyst-or-better standard was met.
  • A customer-facing chatbot gives advice it should never give, across 500,000 clients, with no checkpoint that could have caught it.
How it works for you

Tokto sits inline between your people, your agents, and every model, alongside Runlayer. Every prompt and response routes through a checkpoint in about 150ms, inspected against your policy and written to an immutable, on-prem record. The marketing-review workflow your engineer rebuilt to 85% in Claude in two days keeps its speed; the checkpoint adds the controls, the redaction, and the audit trail. The checkpoint does not care whether the caller is a person or the fourth agent in a chain, so the same inspection covers agents managing agents and the customer-facing surface too.

When a regulator asks how an AI-touched decision was made, the answer is one filtered query, scoped to that regulator, that product, that person, and that window, instead of months of reconstruction. The Chief Legal Officer sees the same view as the CTO, the financial-crime team, and the examiner.

The case you raised

You flagged a recent matter in which a chief executive's AI-generated legal analysis, produced without counsel, was later used against him in litigation. The question it raises for every in-house team is how you recognize when a non-lawyer is using AI for legal work, and protect privilege before the output becomes discoverable. That detection-and-routing rule is one of the cleanest, most defensible controls Tokto offers, and it generalizes across your whole counsel network.

Privilege and unauthorized AI legal use, case reference ↗
10 · Boundaries

What Tokto is not.

Not a model.We don’t compete with Claude or OpenAI; we govern and record what flows to and from them.
Not a connection gatekeeper.Runlayer-style approval of which MCPs exist is a different job; we govern the content once a path is live.
Not a domain authority.We don’t claim to know FINRA’s retirement expectations better than your team. We give your experts the controls to encode them.
Not a policy document.Policies and procedures don’t cut it anymore because people route around them. Tokto is enforcement and evidence, not a PDF.
Not a speed tax.If governance slows the work to the point people avoid it, it has failed. The whole design premise is the opposite.
Not slideware.The back end is the kind of thing our CTO demos live, and that anyone technical on your side can drive once configured.
11 · The pilot

A pilot we could start this quarter.

Proposed first cut: marketing review, Claude-speed, fully controlled

You have the highest-signal starting point already in hand. Your engineer rebuilt the incumbent marketing-review tool to ~85% in Claude in two days; the remaining work is precisely the controls layer Tokto provides. We’d point that exact workflow through a Tokto checkpoint in a contained pilot: same speed, now with redaction, marketing-compliance rules, and a full audit trail.

First 30 days
Technical walkthrough with your CTO and the marketing-rebuild engineer; scope the pilot; stand up a sandbox checkpoint in observe mode.
By 60 days
Configure marketing-compliance rules with your team; run real Claude traffic through the checkpoint; validate ~150ms latency; produce the first regulator-style evidence export.
By 90 days
Move the pilot to enforce; review the audit trail with legal and compliance; scope the second vertical (retirement/FINRA or AML).
12 · Next step

The difference between you and months of work.

You’re building, by hand and under deadline, the thing Tokto is: real-time control plus an evidence trail, without losing the speed that made AI worth adopting. We’d be glad to put the checkpoint in your CTO’s hands to test against the hardest workflow you’ve got.

✉ Reach out to Rob · Rob@tokto.ai
SOC 2 Ready · GDPR Compliant · On-prem available