Every customer call contains something personal: a name, a phone number, a complaint, sometimes a card number read out before anyone can stop it. When a bank adds AI to its support line, the first question should not be what the AI can do. It should be where the conversations go.
Hosted by someone else, or installed by you
Many AI support products run in the vendor's cloud. Calls are streamed out, processed, stored and shown back to staff through a web dashboard. That can be convenient, but it means customer data lives outside the bank, under someone else's controls.
A self-hosted system is installed in the bank's own environment, on its own servers or private cloud. Recordings, transcripts, tickets and the customer directory stay there. The bank's own security team decides who can reach them.
What to ask any vendor
- Where are recordings and transcripts stored, and who can access them?
- Can the system run without an outbound internet connection?
- Does it have any connection to core banking, balances or transfers?
- Are card numbers, PINs and OTPs removed before the AI or staff see them?
- Is every reveal of a customer's contact details recorded in an audit log?
- How are releases signed, and can you see what is inside each one?
How the Cre8tiveGene AI Receptionist answers them
It is installed on the bank's servers with Docker or Kubernetes, including offline installs. It has no access to core banking and refuses banking identifiers. Card numbers, PINs and OTPs are removed from transcripts, tickets, summaries and staff screens. Phone numbers and emails are masked, and every reveal is logged. Releases are signed and ship with a software bill of materials, with source-code escrow available.
The Nigeria Data Protection Act 2023 sets out how personal data must be handled. Keeping conversations inside the bank's own environment makes those obligations simpler to meet and easier to prove.
