Grahak
Third-party risk for a UK business

Check the businesses you deal with, and keep checking

Grahak vets, onboards and keeps watch on the businesses you deal with. That means your suppliers, your partner banks and your channel partners. Claude reads the documents and does the checks. Named people approve on their own phones. Your ledger pays.

Coming soon. Grahak isn't on sale yet. The price will be announced at launch.

Runs on your own computerRuns on your Claude subscriptionPeople approve on their own phones

How it works

From the first document to a business you're cleared to pay.

1

You drop in the documents

Everyone drops files into one folder on a Google shared drive. Grahak takes each new file once. Claude works out what it is and who it's from, and Grahak files it. A file it isn't sure about goes to Quarantine for a person to look at.

2

Grahak runs the checks

It screens the business against sanctions lists. It also screens the business's other names, its parent, its owners, its directors and its signatories. It reads company records from Companies House and looks for news about them. Claude sorts each hit and suggests what it means. A compliance person decides.

3

It works out the risk

Your policy gives each business a risk tier and a score. The score comes from fixed sums. Claude can't make it look better. Claude can only raise findings, and a finding only makes the score worse. Claude writes up the assessment.

4

People approve

Each role your policy asks for approves on their own phone. Each approver is a different person. The person who owns the relationship can't approve it. If the tier, the answers, the evidence or the findings change, earlier approvals stop counting.

5

Your ledger pays

Two different finance people check the bank details. Grahak writes a file of approved businesses for your ledger. You import it, and your ledger pays. Grahak reads the ledger's own files back and checks them.

What you get

Its first release candidate covers all of this.

Three kinds of business

Suppliers, partner banks and channel partners each get their own risk questions, their own evidence and their own approvers. Each is paid in its own way. A partner bank is always Tier 1. You can change all of it in your policy without changing any code.

Screening every night

Grahak checks the UK Sanctions List, UK investment bans, the UN list, the US OFAC lists, the EU list and disqualified directors. PEP lists are optional. Each night it screens everyone again. It records the list versions on every run, so any decision can be worked through again for an auditor.

Payment fraud made hard

Grahak never stores bank details. One finance person calls the business on a number from an independent source. A second person types the details in again from the ledger screen. If they don't match, everything stops. A request to change bank details raises an alert by itself.

A watch that keeps going

After approval, Grahak keeps watch. It handles requests, reviews, risk acceptances, the register, offboarding and a board pack. Each day it flags evidence that is running out and screening that is out of date.

Paying, from invoice to ledger

Grahak takes an invoice through to a file for your ledger. An invoice from a business that isn't approved raises an alert at once. It also does self-billed commissions for channel partners, and checks the fees your partner banks charge.

A record of everything

Every step goes into a log. Each entry is linked to the one before, so an entry can't be changed without it showing. The log says who or what acted, when, on what evidence and under which version of your policy.

People decide

Claude suggests. People decide. Claude and the scheduler hold no roles. Each of these needs a named person with the right role, on their own phone, unlocked with a passkey:

  • Accepting evidence.
  • Approving a business.
  • Checking bank details.
  • Releasing a payment hold.
  • Approving a file for the ledger.

Blocking a business, placing a payment hold and raising a finding happen at once. Undoing any of them needs a person. A document can't move a case on by itself, even one that tells Claude to approve it.

What it doesn't do

We'd rather you knew this now.

  • It doesn't pay anyone, and it isn't a ledger. Your ledger pays.
  • It never stores bank details. It keeps a fingerprint of the account and its last four digits.
  • Its sanctions lists come from OpenSanctions. Their data is free only for non-commercial use, so your business needs an OpenSanctions data licence.
  • It reads company records from Companies House. A business outside the UK is entered by hand from its registry extract.
  • Screening people is processing personal data. Before you go live, your business needs a lawful basis, a DPIA and rules on how long it keeps the data. That paperwork is yours.
  • The computer it runs on must stay on overnight. If screening hasn't run for three days, onboarding stops until it has.
  • Some things are left for later on purpose. These include a portal for businesses to upload to, HMRC's VAT check, Confirmation of Payee, approvals in Slack and Peppol e-invoicing.

Where your data is kept

Your documents stay in your shared drive. Grahak's records stay on the computer it runs on. Back that folder up.

  • The reading is done by your own Claude, on your own Claude account.
  • Grahak fetches sanctions lists, company records and news listings. The query is a company number or names.
  • A licence check sends a licence ID, an installation ID and the version you run.
  • The files for your ledger leave when your people take them to it. Nothing else is uploaded.

What you need

  • Claude Code, signed in to a Claude subscription that includes it.
  • Node.js 22 or newer.
  • One computer that stays on overnight.
  • A Google shared drive, synced to that computer with Google Drive for desktop.
  • A phone for each person who decides anything, unlocked with their face or fingerprint.
  • An OpenSanctions data licence. A free Companies House API key is optional, and we recommend it.
  • A ledger. Grahak comes with layouts for NetSuite and Sage Intacct. Check them against your ledger's own import template before the first import.

Why it is built this way

  1. 1Pay once

    You buy Grahak once. There is no subscription to manage. The licence does not run out. It comes with a year of free upgrades. When that year ends, it keeps working on the last version you were given.

  2. 2Your data stays on your computer

    Grahak runs on your own computer. Your own Claude subscription does the thinking. You don't upload your data to another cloud service. Our servers never see your data. They hold only your licence.

  3. 3Get more from your Claude subscription

    Grahak runs on your Claude subscription. You can use the same Claude for other work in your business too.

You need a Claude subscription that includes Claude Code. Claude is made by Anthropic. Polyglyph Analytica is independent of Anthropic.

Coming soon

Grahak isn't on sale yet.

Price to be announced

The price will be announced at launch. You'll be able to try it free for fourteen days from the first time you use it. When you buy, you get:

  • One seat, for one person on one computer at a time. You can move the seat to a new computer.
  • A licence that doesn't expire. Your copy keeps working for as long as you like.
  • Twelve months of updates. After that, you can choose to renew updates each year. It never renews automatically.
  • Your money back in full if you change your mind within thirty days, with no reason needed.

Contact us

Email hello@polyglyphanalytica.com
Polyglyph Analytica Ltd. Registered in England and Wales, company number 17495579.
Registered office: Montclare, Orpington Bypass, Badgers Mount TN14 7AG