Check it before you pay, sign or approve
Verification is not a single tool, it is a layer across your processes. It applies where documents, identities and promises first enter your company.
Forgeries rarely fail on technology. They fail because someone is allowed to ask a question at the right moment.
The check sits in the wrong place. An invoice, a certificate, a photo and a sender address are judged by different people, with no shared rule and no shared record.
Detectors alone do not carry the decision. Tools for spotting AI generated images give unreliable results, especially on compressed or edited material. A score without a process behind it is not a decision.
The evidence is missing. When a case escalates you need to show what was checked, by whom and on what basis. That is exactly what auditors, insurers and liability questions come down to.
Technical checks
- Automated pre-screening of documents, senders, files and metadata
- Matching against registers, sanctions lists and your own master data
- Signals from continuous threat intelligence in line with ISO 27001:2022 A.5.7
Process controls
- Clear thresholds: what passes, what goes to a second review, what is stopped
- Callbacks through known contact channels, never through the details printed on the document
- Handling of authentication information in line with ISO 27001:2022 A.5.17
Human approval and evidence
- A person decides, the system supplies the reasoning and the supporting material
- Supply chain requirements under section 30 (2) no. 4 BSIG are covered along the way
- Complete logging of every check for internal audit, external assurance and insurance
Each area has its own signals and its own pitfalls. The rules for thresholds, callbacks and approvals stay the same.
Invoices, documents, images, email, claims and business partners under one logic
No automated rejection without a traceable reason and approval by your team
Every check documented, so you can show later what was verified and when
Verification
Can you reliably detect AI generated images?
No, and nobody can honestly promise that. Detectors for AI generated images perform very differently depending on origin, compression and editing. That is why the technical check is only one signal among several for us. The decision rests on process controls, callbacks to known contacts and human approval.
Do I need all six areas?
Usually not at once. We start where your risk is highest, most often with invoices and supplier data or with email spoofing. The remaining areas can be added later on the same verification logic, without rebuilding your processes again.
Does this replace our existing approval workflow?
No. Verification sits on top of your workflows in ERP, accounts payable, HR and procurement. We do not change who approves, we change what that person sees and can evidence at the moment of approval.
Which standards and rules apply here?
For the supply chain, section 30 (2) no. 4 BSIG is the anchor. From ISO 27001:2022 you can cite A.5.7 on threat intelligence and A.5.17 on authentication information directly. There is, however, no legal obligation to run any particular verification software.
What happens to the data you check?
Checks are purpose bound and use only the data needed for that step. Results and reasons are logged so they remain traceable later. We do not make automated decisions with significant effect on individuals, approval stays with a person.
Let us walk through your checkpoints
We look at where documents and identities enter your company, and where nobody is looking today. Write to info@cavrix.de.