Bills
Every bill, in whatever form it arrives, read, checked and held in its own currency.
Intelligence
Ask a question from the header, choose the engine that reads your bills, or let your own AI engine read your instance. Each stays off until a group administrator switches it on.
The rules
The rules, every way in
The assistant and an engine reading through the Model Context Protocol (MCP) server each read as one person, and nothing is sent to any model until a group administrator switches an engine on.
Off until switched on
Until a group administrator switches an engine on, nothing is sent to any model. MCP access stays off the same way, and while it is off every token is refused and none can be made.
Reads as the person
The assistant reads as the person asking, so it sees only what they could open themselves. An outside engine reads as one person too, and never sees more than that person could open in a browser.
Masked first
No bill is sent to the engine until its personal identifiers are masked. Each call leaves an audit record of counts, never content.
Ask
Questions answered from the record
Ask, in the header, lets any member question the assistant about the data they can see.
- It reads
- The overview, services, bills, findings, contracts, budgets, orders and the work queue. It changes nothing.
- Its answers
- Each answer names the areas it read from.
- What it says it is
- The assistant says plainly that it is an AI.
- Masking
- Whatever the engine, everything the assistant sends is masked first, and the answer is restored for you.
- What it never sees
- Its services lookup never returns a phone number or SIM number. It addresses you by name and is never given your email address.
- Your question
- Your question is never written to the logs. The assistant treats what its tools return as data, never as instructions.
- Conversations
- Conversations are not stored; they last only while the panel is open.
- Its engine
- The assistant runs on whichever engine the group chooses, its own included. Turning the engine off switches the assistant off.
Reading a bill
How a bill reaches the engine
CSV and XLSX bills are never sent to a model; a PDF bill is read by the engine only once it is switched on.
An administrator chooses the engine
A group administrator chooses the engine in Settings. Entering its key also needs the right to manage integrations.
The engine is tested
A test checks that the engine answers and that masked identifiers come back intact.
Identifiers are masked
Riopex finds and masks email addresses, labelled names, phone and SIM numbers, and account and circuit identifiers.
The engine reads the masked text
A masked identifier keeps its shape, so the engine can still read the bill. The engine receives only the masked text, never the PDF itself or its file name.
The answer is restored
Each token is mapped back only inside Riopex.
The engine
The engine is the group's choice
The engine is one Riopex runs where your instance runs, one your group provides, or off.
- Inside your network
- A group that allows no outside engine runs one inside its own network.
- What it is sent
- The settings page and the contract state what each feature sends to the engine.
- What masking misses
- The settings page says plainly what the masking does not catch.
- The same mask
- The same identifier gets the same mask every month, so a number not yet in the inventory still matches from month to month.
- The record
- Every call to a model is an audit entry naming the engine, the model and the purpose, never the content. The settings page lists the most recent calls by their counts.
- A refusal
- If the chosen model refuses a bill, it is never passed quietly to another model.
- Its key
- An engine key is sealed with its endpoint and only ever sent to that endpoint, over HTTPS.
MCP
Your own engine, reading your instance
Through its MCP server, your own AI engine can read your Riopex instance.
- Off by default
- MCP access is off until a group administrator switches it on.
- It reads
- The overview, findings, bills, services, contracts, subscribers, orders, budgets and the work queue. Every tool only reads.
- As one person
- An engine reads as one person, and never sees more than that person could open in a browser.
- Sign-in
- An MCP client signs in through your instance's own sign-in over OAuth, with no token to paste. A person makes a token while signed in and sees it once; Riopex stores only its hash.
- Pseudonyms
- An administrator can have names and employee references in results replaced by stable pseudonyms. Phone numbers show by their last four digits only.
- Changes
- An MCP client can list findings, bills and services, subscribe to them and hear when they change.
- The record
- The MCP settings page shows recent calls, and an administrator sees every token in the group.
- Your engine
- Riopex supplies a generic MCP client configuration and leaves the choice of engine to you.
Questions
Questions about intelligence
Can we switch the assistant off?
Yes. A group switches the assistant off by turning its engine off.
Does the masking catch everything?
The settings page says plainly what the masking does not catch.
Can our bills stay inside our own network?
The engine is one Riopex runs where your instance runs, one your group provides, or off.
A group that allows no outside engine runs one inside its own network.
Are conversations with the assistant kept?
No. Conversations are not stored; they last only while the panel is open.
Can an outside engine read our instance without our knowing?
MCP access is off until a group administrator switches it on; while it is off, every token is refused and none can be made.
The MCP settings page shows recent calls, and an administrator sees every token in the group.
Which AI engine should we use with MCP?
Riopex supplies a generic MCP client configuration and leaves the choice of engine to you.
Related
What the engine reads, and how
Security
A dedicated instance for each group, and every connection with its rule.
Integrations
The MCP server beside the bills, monitoring, identity and audit connections.
No bill reaches a model unmasked
Start with three invoices from one company, as the provider sent them.
Request a pilot