Bank partner review checklist (internal / shareable)

Use this page before you call the partner portal “ready for bank review.” It is written for AIS editorial, product, security, and legal reviewers, but the language is plain enough to share with a bank project office if you want a joint sign-off ritual.

:::tip How to use it

• Treat each section as pass / fail / not applicable.
• Anything fail blocks external publication until fixed or explicitly waived by product + legal.

:::

1) Accuracy - no unverified claims

• Every numeric SLA, uptime %, latency, or limit is either contract text, measured in the target environment, or marked placeholder / TBD on the page.
• Product behavior (features, endpoints, webhooks, roles) is described as typical or deployment-specific where the repo is not a single source of truth for all banks.
• Jurisdiction (e.g. NBE, GDPR) is framed as “where applicable” or “confirm with AIS”, not as universal legal fact.
• Cross-links resolve (no broken internal links); pnpm -C documentation-site build passes with AIS_DOCS_STRICT_LINKS at the level you use for release (see /docs/site-deployment).
• OpenAPI snapshot and narrative do not contradict each other on the same page without calling out version / drift.

2) Security - no secrets, no internal endpoints

• No live passwords, API keys, JWT samples with real signatures, or .env copy-paste anywhere in bank paths.
• No private hostnames, internal IPs, or “you must use this URL” unless that URL is already a public contract (prefer placeholders + “AIS provides endpoints per contract”).
• Staff-only pages that index repo paths do not embed clickable file:// or non-public URLs.
• Screenshots (if added later) are redacted and approved for external use.

3) Compliance language - no overclaims

• No phrase implies regulatory approval of AIS by a supervisor unless you have written evidence.
• “Compliant,” “certified,” “guaranteed,” and “always” are either removed or tied to a named standard + scope + date (or replaced with “designed to support”).
• Legal advice disclaimers remain on Risk & compliance-style pages; this portal does not interpret statute.
• DPA / subprocessors / residency are contract pointers, not invented facts.

4) Navigation completeness

• Navbar shows exactly Start here, Products, Use Decision PRO, For your team.
• Footer columns (Get started, Products, For your team) match the IA.
• Hub sidebar is only Start here · Legal · How products fit · Role journeys.
• Staff annexes (deeper-reading, staff-guide-index, staff-pointers) are unlisted.
• Platform is URL-only, not in the bank navbar.

5) Guardrails - noisy repo trees

• No doc plugin path points at documentation/Extra, Advanced, Migrated, Rules/cursor-plans, or Kiro dumps.
• Partner navigation does not list pytest, agent packs, deployment, or duplicate “what is” essays.

6) Sign-off (fill in)

Role	Name	Date	Pass
Editorial / product			☐
Security review			☐
Legal / compliance (if external)			☐

---

Next: Known gaps · How products fit · Start here