> ## Documentation Index
> Fetch the complete documentation index at: https://docs.leapfinancial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Lola Send is a conversational AI platform that enables financial institutions to deploy intelligent agents on messaging channels for regulated remittance workflows.

Lola Send is built on Celai, Leap Financial's proprietary agentic framework. It orchestrates multi-step conversational workflows where AI agents collect information, invoke backend services through tool functions, and guide senders through regulated processes — all within a chat interface.

The primary channel is WhatsApp, with support for Telegram and omnichannel routing via Chatwoot.

## Why Lola Send

<CardGroup cols={2}>
  <Card title="Bank retains control" icon="sliders">
    Financial institutions configure agent prompts, tool availability, middleware ordering, channel allowlists, and escalation rules. Lola Send is a platform the bank deploys and controls — not a black-box service.
  </Card>

  <Card title="Security-first architecture" icon="lock">
    Encrypted callbacks (AES + HMAC), JWT session tokens with EC key pairs, secret management through Doppler, and non-root containerized deployment. No credentials are hardcoded; no sensitive data persists in conversation state.
  </Card>

  <Card title="Compliance integration" icon="scale-balanced">
    Lola Send orchestrates CIP/KYC verification flows and routes senders based on AML screening verdicts — but never makes compliance decisions. The bank's compliance services retain full authority. Human escalation via Chatwoot is available at every stage.
  </Card>

  <Card title="Human-in-the-loop by design" icon="user-check">
    No operation executes without explicit sender approval through authenticated web widgets. Every financial action requires the sender to confirm details in a secure, external interface before Lola Send proceeds.
  </Card>

  <Card title="PCI compliance" icon="credit-card">
    Card data never enters the chat layer. All payment instrument collection is handled in external vaulted widgets, isolating sensitive cardholder data from the conversational pipeline entirely.
  </Card>

  <Card title="AI safety" icon="shield-halved">
    Agents operate with scoped capabilities — each has a defined set of tool functions and a bounded system prompt. Prompt injection protections, hallucination control through tool-function-only data retrieval, and restricted agent routing prevent misuse.
  </Card>
</CardGroup>

## Security posture

Lola Send is designed for deployment in regulated financial environments. Security is not a feature layer — it is the foundation of every architectural decision.

```mermaid theme={null}
flowchart LR
    subgraph chatLayer["Chat layer"]
        A["Sender message"] --> B["Middleware\nauthentication"]
        B --> C["Agent\n(scoped tools)"]
        C --> D["Output\nvalidation"]
    end
    subgraph approvalLayer["Approval layer"]
        D --> E["Authenticated\nweb widget"]
        E --> F["Card vault\n(VGS)"]
        E --> G["Encrypted\ncallback"]
    end
    subgraph executionLayer["Execution layer"]
        G --> H["Backend\nexecution"]
    end
```

| Principle                     | Guarantee                                                                                                                                               |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| No operation without approval | Every financial action requires explicit sender confirmation via authenticated web widget — the chat channel alone cannot trigger execution             |
| Zero card data in chat        | PAN, CVV, and expiry are captured exclusively in PCI-scoped widgets with VGS vaulting — the AI layer never sees raw card data                           |
| Prompt injection containment  | Scoped system prompts, fixed tool sets, middleware-enforced authentication — sender input never reaches system instructions                             |
| Hallucination prevention      | All financial data comes from verified tool functions, not model generation — exchange rates, recipients, and balances are never fabricated             |
| VPC-contained data            | All services deploy within the VPC; Gemini runs on Vertex AI with VPC Service Controls; OpenAI calls operate under zero-retention enterprise agreements |
| Human escalation              | Chatwoot integration enables the bank to route any conversation to a live human agent at any point                                                      |

<CardGroup cols={3}>
  <Card title="AI safety" icon="shield-halved" href="/lola/security/ai-safety">
    Prompt injection, jailbreak, and hallucination defenses.
  </Card>

  <Card title="Human-in-the-loop" icon="user-check" href="/lola/security/human-in-the-loop">
    Two-phase confirmation and callback-gated execution.
  </Card>

  <Card title="PCI compliance" icon="credit-card" href="/lola/security/pci-compliance">
    Zero card data exposure through tokenized vaulting.
  </Card>
</CardGroup>

## Explore the documentation

<CardGroup cols={2}>
  <Card title="Platform overview" icon="building" href="/lola/overview/platform">
    Architecture layers, message flow, and bank control points.
  </Card>

  <Card title="Architecture" icon="cpu" href="/lola/architecture/celai-framework">
    Celai framework internals, agent orchestration, and middleware pipeline.
  </Card>

  <Card title="Security and compliance" icon="shield" href="/lola/security/architecture">
    Defense-in-depth security, data residency, and compliance integration.
  </Card>
</CardGroup>