ecko
KYC and AML review
secret and reveal keep PII out of logs by construction, and capability grants let you prove a component never had network access.
The problem
Know-your-customer workflows combine document OCR, entity matching, and sanctions screening. The sensitive parts - passport numbers, account identifiers, watchlist hits - must not appear in application logs, error reports, or the stdout of a debugging session. Policy documents say "do not log PII"; code review tries to enforce it; neither scales.
Compliance also asks whether the screening step could have phoned home. A dependency update that adds a hidden HTTP client is a recurring nightmare in Python and Node ecosystems.
Why Ecko
- Secrets by type
secret(v)wraps a value soprint,json_encode, and stack traces redact it automatically.revealis explicit - auditors can grep for every place sensitive data becomes plain text.- Capability grants
- Import a package with
grant []and it is mechanically unable to open sockets or spawn processes, regardless of what its transitive dependencies declare. You can point review at the grant line, not a 200-page SBOM. - Offline mock mode
- CI runs the same review logic against deterministic mock responses - no API keys, no sandbox data leaking to a vendor - so policy tests are real tests.
In practice
grant [] # this module cannot use the network
fn screen(name: secret(str), dob: secret(str)) {
# logs show "[secret]", not the value
ai "Sanctions screening summary" from reveal(name)
}
Try it on your workload.