Retail bank contact-centre copilot with a third-party vector store
- Organization
- Harborline Bank
- Vendor / dependency
- Coastline CX Assist (contact-centre copilot)
- Industry
- Financial services
- Headline dimension
- 3.1 Embeddings
Category 7 scores higher (HIGH 7.8), the headline stays on the dependency this case describes; the formula is draft and uncalibrated.
38 agent calls against Amazon Bedrock, five to ten minutes. The expert reading is never sent to the pipeline.Description
What the agents read
Harborline Bank, a mid-sized retail bank, deployed Coastline CX Assist, a SaaS copilot for its 1,400 contact-centre staff. Agents paste account notes, complaint histories and call transcripts into the tool, which answers questions by searching the bank's own knowledge base of product documents and past case notes. Coastline's contract says prompts are not used for training and inference runs in the EU.
During a vendor security review the bank learned that embeddings of its documents and prompts are generated by Coastline's model provider but stored in a managed vector database run by a separate subprocessor in the United States, retained for the life of the subscription. That subprocessor was not on the original subprocessor list and has never been assessed by Harborline's third-party risk team. The same embedding store is shared with two internal pilots that reuse Coastline's retrieval API. Harborline is subject to GDPR and national banking-secrecy law; transcripts routinely contain account numbers and personal financial details.
Expert reading by hazard class
For comparison after a live run; never sent to the pipeline
| Class | Carried by | Score | Rating |
|---|---|---|---|
| 1 Whose AI brain is this, really? | 1.3 Model update / versioning control | 6.1 | MEDIUM |
| 2 What are we feeding it? | 2.1 Prompts / user inputs | 5.3 | MEDIUM |
| 3 What does it create from our data: and where does THAT go? | 3.1 Embeddings | 5.6 | MEDIUM |
| 4 Who's deciding what the AI sees and does? | 4.1 Retrieval pipeline (RAG) ownership | 2.4 | LOW |
| 5 Which humans are actually looking at our stuff? | 5.1 Human review processes | 4.7 | MEDIUM |
| 6 Who's holding the steering wheel? | 6.1 Centralized control plane / admin console | 4.8 | MEDIUM |
| 7 How many companies are really in this chain: and did we agree to it? | 7.1 Downstream subprocessors | 7.8 | HIGH |
Findings
Expert 'what we found' per class, with the vector each score is computed from
- MEDIUM6.1
1 Whose AI brain is this, really?
1.3 Model update / versioning controlCoastline does not run a model of its own; CX Assist is a layer over a large foundation-model provider's API, with inference in the EU as promised. Coastline can swap the underlying model version for all customers at once and announces such changes in release notes on the day they ship. Agents have noticed the tone of suggested replies change twice this year with no advance word.
The bank can keep using the tool, but the AI's behaviour can change under it without notice.
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N/E:P/CR:H/IR:M/AR:M/AU:Y/R:U/V:C · Medium
- MEDIUM5.3
2 What are we feeding it?
2.1 Prompts / user inputsAgents paste full call transcripts and complaint histories into the copilot, so member names, account numbers and dispute details flow to Coastline with every question. Coastline keeps prompts for 30 days for abuse detection, a retention the bank's data map for the ticketing estate never recorded. The bank's product documents and past case notes were also connected for retrieval, which was treated as a configuration step rather than a new data-sharing event.
Sensitive member data leaves the bank with every question, under retention terms nobody in compliance had mapped.
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:A/CR:H/IR:M/AR:M/R:U/V:C · Medium
- MEDIUM5.6
3 What does it create from our data: and where does THAT go?
3.1 EmbeddingsEvery document and prompt is turned into embeddings, and those embeddings are stored by a fourth company, a vector-database vendor in the United States that appears nowhere in Harborline's procurement records because Harborline's contract is with Coastline. Published research shows embeddings can be reversed to meaningful source text. The store is shared with two other internal pilots, so it holds more of the bank's material than the contact centre alone.
A company Harborline has never assessed holds a reversible copy of its transcripts, and the 'no training on prompts' clause does not touch it.
SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:P/CR:H/IR:M/AR:M/S:P/AU:N/R:U/V:C/RE:M/U:Amber · Medium
- LOW2.4
4 Who's deciding what the AI sees and does?
4.1 Retrieval pipeline (RAG) ownershipThe search-and-rank step that decides which of the bank's documents the model sees is Coastline's own service, and Coastline's content filter reads every question and answer before the bank's logging does. Both are run by the contracted vendor rather than a further party, and the bank can see which documents were used for each answer.
Decisions between question and answer are made by the named vendor, and the bank can trace them.
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/CR:H/IR:M/AR:M/R:U/V:C · Low
- MEDIUM4.7
5 Which humans are actually looking at our stuff?
5.1 Human review processesCoastline confirmed that prompts flagged by its abuse filter are read by its own trust-and-safety staff in the EU. Roughly one in two hundred contact-centre prompts is flagged. The bank is not told when a review happens and the reviewer sees the transcript as pasted, identifiers included.
A person at the vendor can read a member's transcript; the practice is standard, in-house and in-region, and invisible to the bank.
SOV:1.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/CR:H/IR:M/AR:M/R:U/V:D · Medium
- MEDIUM4.8
6 Who's holding the steering wheel?
6.1 Centralized control plane / admin consoleThe admin console where Harborline configures CX Assist is hosted in the United States even though inference is in the EU; the regional-processing commitment does not cover it. Administrator access is tied into the bank's single sign-on, and Coastline can change console defaults for all tenants at release time.
The controls sit in a different jurisdiction from the data they govern, though the bank's own identity system still gates who uses them.
SOV:1.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:L/E:U/CR:H/IR:M/AR:M/R:U/V:C · Medium
- HIGH7.8
7 How many companies are really in this chain: and did we agree to it?
7.1 Downstream subprocessorsThe real chain is four companies deep: Coastline, its foundation-model provider, that provider's cloud, and the vector-database vendor. Harborline holds a contract with one of them. Harborline did knowingly adopt the copilot, so governance did run once, but the chain beneath it has changed since without any trigger for a second look.
Member data now sits with three companies the bank has no contract with, and the list can grow without the bank being asked.
SOV:1.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:A/CR:H/IR:M/AR:M/R:U/V:C · High
What the organization should do next
- Ask Coastline for a complete, named subprocessor list, including the vector-database vendor and its hosting jurisdiction, in writing.
- Ask specifically what happens to Harborline's embeddings if it leaves Coastline, and negotiate deletion and residency terms for the embedding store.
- Update the data-protection impact assessment for the contact centre: transcripts now flow to a copilot with 30-day prompt retention and vendor human review.
- Put data-loss-prevention controls on what agents can paste, and route the two internal pilots sharing the embedding store through the same review.
Questionnaire answers
22 of 22 answered · these seed the metric priors
Show all 22 answers
| OP-CR | How damaging would unauthorized disclosure of the data this AI dependency handles be for your organization?Severe: regulated, personal, privileged or trade-secret data |
| OP-IR | How damaging would an undetected change in this dependency's behaviour or outputs be?Moderate: outputs feed business decisions with some review |
| OP-AR | How long could your organization operate acceptably without this AI capability?Days: material business disruption |
| CL-CATEGORY | Which taxonomy category best describes the dependency you are assessing?Data derivatives: embeddings, vector store, outputs, feedback, telemetry, caches |
| D-AV | Where does this dependency run, and who can reach it?Operated by a subprocessor of the vendor (a further hop from your contract) |
| D-AC | What would the vendor, a subprocessor, or a legal authority have to overcome to access the data or change the service?Nothing beyond its standard terms of service or routine legal process |
| D-AT | Can the vendor exercise this control at any time, or only when something specific happens?At its discretion, at any time (standing right under the contract) |
| D-PR | Who is in a position to exercise this control?Any party already in the subprocessor chain |
| D-UI | Does the exposure require any action by your organization?Ordinary use of the service is enough to trigger it |
| D-VC | At this dependency itself, how much confidentiality could be lost?None: no sensitive data is exposed here |
| D-VI | At this dependency itself, how much could its behaviour or outputs be altered without your knowledge?None |
| D-VA | At this dependency itself, could the capability be withdrawn or degraded by the exercising party?None: we could keep operating this component |
| D-SC | Beyond this dependency, how much confidentiality could be lost at other systems or parties?Full: sensitive data becomes readable by a party we never contracted with |
| D-SI | Beyond this dependency, could downstream systems or decisions be altered?Partial |
| D-SA | Beyond this dependency, what would stop working, and could anyone be harmed?Nothing downstream is affected |
| D-E | Has this kind of control actually been exercised against organizations like yours?Demonstrated in research or incident reports, not confirmed against our stack |
| D-R | If the vendor relationship ended tomorrow, could you reconstitute this capability elsewhere?Yes, with manual migration effort (re-embedding, re-integration, re-contracting) |
| D-V | How many of your AI workloads depend on this component?Many or all: shared control plane, gateway, identity or embedding store |
| D-S | Would a loss of control here, on its own, trigger a reportable regulatory violation?Yes |
| D-AU | Could the loss event happen to all of the vendor's customers at once, with no case-by-case decision?No, it requires a discrete action against us specifically |
| D-RE | How much effort would it take to exit this dependency or otherwise mitigate the exposure?Moderate: a project, but no re-architecture |
| D-U | How does the vendor notify you of sovereignty-relevant changes (model versions, subprocessors, hosting, terms)?Disclosed at the time the change takes effect |
Notes: Expert reviewed. Primary vector derived from the questionnaire answers; category vectors and findings confirmed on review. Mirrors the rubric's worked example 4.1 with the organization profile added. The formula rates the embeddings finding Medium rather than High because precedent is proof-of-concept (E:P); a calibration observation for item 47. Category 7 (subprocessor chain) scores higher than the headline because the same unassessed vector-database vendor, viewed as a chain problem with documented precedent (E:A), compounds across the whole chain; the headline stays on 3.1 because the embeddings are the dependency the scenario describes, and the sample walkthrough rates both High.