AI promises every institution the experts only the largest could afford. Synchronos builds them so a community bank, a bookkeeper or a family can own them outright, and check their work.
It studies. It learns. It shares.
The family's papers rest with its bank. The business's books rest with its bookkeeper and its bank. The bank's decisions rest on what both bring it. Each of the three is looking for the same thing, a record it can stand on, and none of them can keep it alone, because the record each one needs is partly in the others' hands.
Inside each, the same is true. A bank's loan passes through five desks that each keep their own version of it. A business has an owner, a bookkeeper, staff and vendors. A family has the couple, the children and the attorney. The record has to hold inside each corner before it can hold between them.
Five desks, one loan. The walls between them are a control and should stay. The record should pass through them without anyone having to rebuild it.
Most owners already trust one person with the books. The record lives with that person, and the owner holds the second key.
The will, the deed, the policies and the real phone numbers, in one place the family and its bank can both reach.
We build with AI and we study it. It is very good at reading, comparing and flagging, and it is dangerous when it decides on its own, when it can't show its sources, or when the data has to leave the building to use it. Our job is to understand both sides, and to build only the kind that people can own and check.
We build the tools and license them to the institutions that use them. What we learn along the way, we write down.
Each venture is a desk where the studio learns something. The machine is the same in all three: a sealed workstation with no network connection, the institution's own method loaded into it, and a log that can't be quietly edited. What differs is the job.
The lender's desk
Your analyst's first pass, done by lunch. The machine reads the file, spreads it by your method and marks the page behind every number, so your people spend their time on judgment rather than data entry. Every decision stays with a named lender, and the loan keeps one record from application to annual review.
Live · pilots 2027Visit smallbanc.comThe bookkeeper's desk
A safe for what a business knows, kept by its bookkeeper. One locked box per client, every invoice checked against the record, and anything that doesn't match held for the owner, who holds the second key.
In developmentComing soonThe kitchen table
A safe deposit box for the papers, offered by the family's bank or credit union. Sealed copies of the will, the deed and the policies, opened only with the family's key and the banker's together, and the precautions that stop many scams before they start.
In developmentComing soonShort, plain and cited. Written for the people at the three desks, and for the boards that ask them what they are doing about AI. Open one to read it here.
An AI-found flaw in the web's plumbing, and whether small banks are ready for what follows.
On October 21 the makers of PHP, the language behind a large share of the world's websites, released fixes for two critical flaws now called PHP2Shell. Rated 9.2 of 10, they let anyone on the internet take over an unpatched web server, with no login, sometimes in a single request. Researchers found them with the help of an AI model; the flaw class had been flagged decades ago and dismissed as too hard to exploit. Word leaked two days early, a public proof-of-concept appeared within hours, and security firms expected mass attacks within minutes of the patch.
What changed. Attackers read a patch as a map to the flaw, and AI does that in hours, not weeks, so anything connected has to win the race to patch every time. "Too hard to exploit" used to be a defense; AI is wearing it down across decades of software. Defenders are swamped by AI-found bugs faster than small IT teams can install fixes. And small is no longer invisible: the OCC warned in June that AI enables automated reconnaissance and rapid exploitation, so smaller banks can no longer assume they are unattractive targets.
Are small banks ready? At the core, mostly yes: accounts and payments sit with large processors that have big security teams and fast patching. At the edges, mostly no: two or three IT staff covering email, the website, laptops, vendor portals and loan software, which is exactly what AI probes. Hundreds of banks share the same vendors, and regulators now ask how long a bank could operate without one; few have a strong answer. And the likeliest losses are people, not servers: the deepfaked call to the wire room, the vendor's changed account, the faked borrower file.
What it means. When the sites and services we all depend on are breached, and they will be, what matters most should not be there. That claim stays true on the worst day; "we stop hacks" does not. The honest limits apply to us too: a sealed box runs software, its updates arrive by hand, and what remains to attack is what is carried in, which is why intake is strict and an independent review comes before any real records go in.
Sources: SecurityWeek, Help Net Security, The Hacker News, watchTowr (Oct 2026) · OCC via Young & Associates (June 2026) · Feedzai via FinanceFeeds · WSJ
What AI is doing to documents and transactions, and what still holds up.
AI has made convincing fakes cheap, fast and unlimited. Invoices, pay stubs, tax returns, voices and faces can all be produced on demand, in volume. Most businesses, banks and households still rely on the test they always have: does it look right? That test is failing.
What we see. Fakes that check out: not one forged page but a whole file that agrees with itself. Faces and voices you know, on a live video call. Requests from real accounts, taken over mid-conversation. Patient cons at scale, with months-long relationships and thousands of targets at once. Attacks on verification itself: the vendor list, the callback number, the account on file. And the liar's dividend: when anything can be faked, real evidence can be dismissed as fake.
What holds up. Verify at the source: the transcript from the IRS, not the return handed over. Confirm by channels set in advance: hang up and call the number already on file. Two keys for what matters, the way two people open a vault. Seal on arrival: fingerprint and sign documents the moment they arrive, with their source recorded. Fewer connections, by choice. People decide, and a log that cannot be edited shows who. And relationships: a long, checkable history is the one thing a forger cannot generate overnight.
Who can keep up. No individual can out-watch an automated adversary. Structure, not vigilance, is the defense, which makes trusted intermediaries more valuable, not less: the bank, the bookkeeper, the process built in advance. Fraud has never been eliminated, only contained. The realistic goal is to be clearly harder than the next target, and to keep losses small, rare and caught early.
Spotting fakes is a race defenders lose. Process is a race they can win.
What a sealed machine is, what it protects, and what it honestly doesn't.
One machine, unconnected by choice. The network jack stays empty, there is no Wi-Fi or Bluetooth inside the box, and every way in and every way out is a deliberate, visible step that gets logged.
Ways in. A scanner cabled to the box, so paper becomes an image: the cleanest path. A write-protected stick issued with the box, used inbound only, never a personal one. Signed updates for the rule book and the software, checked against their signature before anything installs. Optionally, a one-way diode, where files cross as light and nothing can travel back.
Ways out. The screen, which is where most work stays. A cabled printer, because paper carries nothing hidden. Outbound media, used out only, carrying sealed packages for the bank or the CPA and logged when they leave.
Never. A cable to the office network or the internet. Programs, scripts, macros or web pages as input. The same stick used both in and out. Files edited outside and brought back in.
What it doesn't do. It doesn't stop a breach somewhere else; a store that loses your card number has still lost it. It runs software, which has flaws of its own, and its updates arrive slower than a network patch. What is left to attack is what is carried in. The claim is relatively airtight, and checkable, never unhackable.
One design, two settings: a workstation in the bank's credit department, or a box the size of a hardcover book in the bookkeeper's office.
Pilots begin in 2027, one institution at a time. If you sit at one of the three desks and would like to talk, write.
eric@synchronos.comSynchronos Inc. · synchronos.com · October 2026