AI INVESTIGATOR

The case, not
the dataset.

POVA is an AI investigator. Give it the records, logs, and contracts you already have. It cross-checks everything against everything else, and where timelines, facts, and relationships stop fitting their context, it builds you a case. Sometimes that’s an operational or financial misalignment. Sometimes it’s a hidden agenda, or someone quietly connecting things that were never supposed to touch.

The POVA guardian raccoon
Full population, not a sample
No live system access
On-prem or air-gapped
Every finding tied to source
01 / ANATOMY

What a POVA case contains

01

Named subjects

People, vendors, accounts and service identities. Not anonymous anomaly scores.

02

Money

Amounts, accounts, and the exposure at stake, reconciled against the ledger.

03

Chronology

What happened, in order, with the timestamps that put it there.

04

Relationships

Who is connected to whom, including the ties nobody declared.

05

How it was done

Ripple effects across systems, the vendors and people someone brought along, the slow siphoning that stays under every threshold.

06

Exact source proof

Every claim points to the file, row, and log line it came from.

07

Competing explanations

The innocent readings, tested and either ruled out or left standing.

08

Decisive next action

What to do Monday: revoke, recover, escalate, or close it out.

And the audit of itself

Coverage, method, and what was not examined. Stated, not implied.

02 / EXHIBIT

One finding, opened

Anonymized from a live case. This is the unit of work, not a chart.

CASE 41-C · FINDING 07 SUPPORTED · ACT NOW
SUBJECT
Vendor 3312 · “Northgate Facilities”
Approver: employee 8871
MONEY
1,284,900
WINDOW
14 months
RECORDS
3,041
CHRONOLOGY
MAR 04Bank details changed 40 minutes after approver login. MAR 06First payment released below the dual-approval threshold. MAR–APR19 further invoices, all 1–3% under the same threshold. APR 22No goods-receipt record exists for any of them.
COMPETING EXPLANATIONS
Legitimate vendor migration: no matching contract amendment in the population.
Emergency spend: threshold behavior is consistent, not urgent.
Structuring around a control, by someone who knew where it sat.
SOURCE PROOF
ap_master.csv · rows 88,412–88,431 vendor_audit.log · 2026-03-04T22:41Z approvals_export.xlsx · sheet 2, rows 913–932 gr_receipts.csv · no match (verified absence)
DECISIVE NEXT ACTION

Freeze vendor 3312, pull the 19 invoices for recovery, and review every approval by 8871 in the same window.

03 / CASE FILES

Three closed cases

Anonymized from real engagements. Ask us for the specifics under NDA.

BANKINGUNEXPLAINED ACCESS
SUSPICION

Dormant elevated access and after-hours system activity.

IN THE RECORDS

Privileges kept after role changes. After-hours access that bypassed change management. Gaps in the audit trail.

OUTCOME

Access revoked, logging enhanced, regulator informed.

FOOD & BEVERAGEHIDDEN AGENDA
SUSPICION

Earnings and inventory stopped matching the evidence around them.

IN THE RECORDS

Likely manipulation, concentrated around a management change, with dates, amounts, and the people involved.

OUTCOME

Evidence package handed to the legal team.

REAL ESTATEMISALIGNMENT
SUSPICION

Subcontractor billing that didn’t line up across properties.

IN THE RECORDS

Divergent billing, recurring maintenance issues, and work-order timing that pointed to padding.

OUTCOME

Contracts renegotiated, preventive maintenance put in place.

04 / METHOD

Plug and play

01
Point it at your data. Retained data or fresh exports: system logs, communications, audit trails, ledgers. No credentials change hands.
02
Go do other things. It works the population on its own, record against record, until the misalignments surface and become cases. Ready in one to two weeks, depending on data size, complexity, and the hardware you give it.
03
Open the case. Signed, board-readable at the top, evidentiary underneath. Read it in the simple POVA case viewer, or export it into the case management system you already use.
ALL OFFLINE · ON PREMISE · AIR GAPPED · NO NETWORK ACCESS
05 / SECURITY

Offline, inside your facility

The analysis never touches the internet. POVA runs on your hardware, or on POVA BOX, a sealed offline appliance. Your data stays in the room it started in.

+Air-gapped analysis: no telemetry, no error reporting, no background sync.
+No third-party AI in the analysis path. Your data never reaches an outside model.
+Deliverables are self-contained offline files. POVA retains nothing after delivery.
+The case registry can be delivered encrypted, readable only by the people you name.
+Deterministic analysis: same input, same result, with an embedded audit trail.
ISO 27001 · 22301 · 42001 · FULL SECURITY DOCUMENTATION AVAILABLE ON REQUEST
06 / FOUNDER

The person behind the system

POVA is built by Roy Daya. He has spent more than 25 years getting reliable answers out of data, across fraud investigations, industrial safety systems, and audit analytics. He holds a Kellogg MBA and founded AppliedML, the computer-vision company with more than fifty AI solutions running on industrial sites.

LINKEDIN →
IN THE PRESS

Bring the export. We’ll tell you what’s in it.

On a scoping call, an expert works through your data with you and tells you straight: is there a case here, and what is it worth.

BOOK A SCOPING CALL
You don’t need to prepare anything.