Official product guides and resources for MonkeyCode.
DEPLOYMENT SCENARIO · VERIFIED 2026-08-05
Banks, insurers, and fintechs adopt AI coding under frameworks the tools were not designed around: DORA operational resilience, ICT third-party risk, outsourcing rules, and internal audit. A self-hostable, open-source platform moves the decisive controls — code location, egress, logging, retention — inside your boundary. This page maps the finance-specific questions; it is not a certification and not legal advice.
The finance frame
Your obligations depend on entity type and jurisdiction; classify the tool before piloting it.
An AI coding platform is ICT tooling. Vendor-hosted agents enter your ICT third-party register; a self-hosted platform lands in your own resilience scope instead — with obligations you already know how to operate. See the DORA and delivery-stability analysis.
Source code processed by an external agent service is a material dependency for most outsourcing frameworks. Self-hosting converts that assessment into internal controls. Compare deployment paths in the self-hosted guide.
Internal coding use and customer-facing AI output are different analyses — Article 50 transparency applies from August 2, 2026 for the latter. Read the Article 50 briefing.
AGPL-3.0 source availability lets security and audit inspect what actually runs; obligations for modification or network service need qualified legal review.
Audit evidence pack
Produce these from your own deployment; no vendor page can supply them.
Where the platform sits in your ICT register: criticality, dependencies, recovery objectives, and the exit plan if you must stop using it.
Every boundary — Git providers, model endpoints, packages, logs, backups — with owner, credential, retention rule, and allowed path. Start from security and data-flow boundaries.
Which agent actions require human approval — merges, deployments, dependency changes — and logs proving the gates were enforced on real tasks.
A reproducible record of tasks, acceptance outcomes, review effort, and failures, using the pilot methodology and open dataset schema.
Deployment posture
Not every repository needs the same boundary; write the tiers down and enforce them.
Non-sensitive repositories can trial the hosted workflow to establish fit before any infrastructure investment. Verify the provider's terms first on the pricing facts page.
Proprietary code runs on infrastructure you operate, with model routes you configure. Requirements and steps in the installation guide.
For trading, payments, or other high-sensitivity code, zero-egress operation demands local models and internal mirrors — see air-gapped deployment.
Size environment hosts by concurrent tasks, not headcount, with the capacity calculator and TCO estimator.
DORA pillar mapping
An engineering view of the five pillars, not legal advice — confirm scope for your entity with counsel and your risk function.
| DORA pillar | How an AI coding platform is implicated | Evidence to hold |
|---|---|---|
| ICT risk management | The platform and its model routes are ICT assets in your risk framework | Entry in the ICT register with criticality and dependencies |
| Incident management | Agent actions and failures need detection, logging, and reporting paths | Per-task logs and an incident runbook covering agent behavior |
| Resilience testing | Upgrades, model outages, and environment failures must be exercised | Recorded recovery and staged-upgrade test results |
| Third-party risk | Hosted agents are ICT third parties; self-hosting shifts this to internal controls | Vendor assessment or internal-control evidence, plus an exit plan |
| Information sharing | Threat intelligence on agent-run attacks informs your controls | Notes linking external incidents to your control updates |
Self-hosting a platform like MonkeyCode converts several third-party questions into internal-controls questions your audit function already evidences. This mapping is engineering guidance, not a compliance opinion.
Phased rollout
Each phase yields an artifact your risk and audit functions can review before the next begins.
Register the platform as an ICT asset, define repository sensitivity tiers, and write the acceptance criteria a pilot must meet.
Run acceptance-tested tasks on non-sensitive repositories, capturing outcomes, review effort, and failures with the pilot dataset schema.
Enforce egress allowlists, credential rotation, review gates, and retention rules; rehearse the incident and recovery runbooks.
Promote to production for approved tiers, keep the ICT register and evidence pack current, and schedule periodic resilience tests.
Common questions
Related: GDPR and deployment, proprietary code safety, the broader regulated-industries guide.
