DocsHelp

FAQ & troubleshooting

Updated 2026-10-07

The questions below are the ones compliance teams at banks and credit unions of every size ask most often in their first months with Zovos. If yours is not here, contact support. We would rather answer it than have you guess.

Ask your administrator to check the member list on the Team and roles screen. A pending invitation can be re-sent from there. Your mail gateway may also have held it. The invitation is sent by WorkOS, our identity partner, from its own sending domain instead of a Zovos address, so a gateway that quarantines unfamiliar senders will catch it. If your institution provisions access through your directory instead, there is no invitation email at all. You simply sign in with your organization's usual single sign-on button once your administrator has assigned you.

Contact your administrator first. Access is granted through your identity provider, and the usual cause is a directory group or role assignment that has not been mapped to a Zovos role yet, or a directory sync that has not run since you were added. Zovos refuses an unrecognized assignment instead of defaulting you into a role. That is why the error appears the instant you arrive and not somewhere deeper in the product. An owner fixes it on the Access & SSO tab in Settings, where directory groups and roles are mapped onto Zovos roles. Once the mapping is in place, sign in again.

The mapping has to exist before the invitation. Every workspace starts with directory mappings for the owner, analyst, internal audit, board and risk approver roles, so those invitations work from day one. A custom role has no mapping until an owner adds one on the Access & SSO tab in Settings. Until then, an invitation into that role is refused with a message saying exactly that. The same applies if an owner has removed one of the default mappings. Examiners are not invited this way. They get a separate time-boxed session, described below. The order to work in is in Onboarding your institution.

An administrator can open that person's row on the Team and roles screen and see their live sessions. Each one shows the device, where the session started, when it was last active and when it expires. The administrator can end one of them or all of them. A revoked session stops working on its next request. Removing the person in your identity provider is still the right first move. Ending sessions is the control for the gap before your next directory sync runs.

Roles are set by your administrator. If your account is managed by your directory, the member row will say so, and the role has to change in your identity provider rather than inside Zovos.

Examiners are not added as teammates. An owner grants a time-boxed, scope-limited session for the examination, read-only apart from a few fieldwork actions. See Roles and permissions.

You need a current version of Chrome, Edge, Safari or Firefox, kept reasonably up to date. Zovos is a browser application, so there is nothing to install and no desktop client. It works on a tablet, but the registers, matrices and workpaper screens are built for a laptop or desktop display.

Onboarding your institution lists what a corporate proxy or firewall may need named. The first entry is the workspace host over HTTPS, including the WebSocket upgrade the collaborative drafts editor uses on that same host. The second is WorkOS, our identity partner, together with your own identity provider, because signing in is a redirect out to them and back. The third is our document storage endpoint, since uploads and downloads go directly between the browser and object storage instead of through the application. Ask support for the exact entry for your environment instead of guessing at it. One related fact belongs in the same conversation. Zovos refuses to be displayed inside a frame, so it cannot be embedded in an intranet portal page.

Yes. Your workspace can be limited to your institution's own network ranges, which you configure in settings. If you are travelling and suddenly cannot reach Zovos, that policy is the first thing to check with your administrator.

Anything you lack permission for is hidden instead of greyed out, so the navigation you see is the navigation you have. If a colleague can see a screen you cannot, the cause is a difference in roles or in the scope of an access group. See Roles and permissions.

Separation of duties prevents it. The approver may not be the submitter, and critical items need two distinct signers. If you are genuinely the only person in the workspace holding the required permission, the decision can still proceed on the sole-operator override, which requires a written justification and is tagged as such in the audit trail. See Approvals and delegation of authority.

Ask your Zovos contact. Agents cite the regulatory library. Until that library has been indexed for your workspace, they decline to run instead of answering without sources. The message you see is the agent naming the missing index instead of producing an uncited answer. Indexing is a one-time step on our side. Despite the wording of the message, it is not something an owner can do in settings. Confirm it before your first agent run. Onboarding your institution puts it in the day-one order.

That is deliberate. A panel with no data behind it, or one withheld from your role, renders nothing instead of a fabricated zero, because a confident zero in a compliance report is worse than an honest blank.

Use Report a bug in the in-app help center. The report carries the screen you were on and your recent in-app actions, and you see exactly what will be attached before it sends. An owner can switch the feature off for the whole workspace, because some institutions forbid sending free-text context to a vendor. When it is off, the option is not shown and you reach support instead.

Yes. Registers such as findings, risks, gaps and loss events export as PDF or spreadsheet files, and most tables offer a quick CSV. Scheduled exports can deliver datasets on a cadence to your own systems.

Yes. Sealed artifacts such as board packs, minutes, workpapers and exam binders carry a content hash recorded in the proof ledger, and a proof pack can be verified offline with a bundled verifier, without trusting the export or us. The audit trail itself is append-only and exports with its filters intact. See Audit trail and exports and Your data: exports, backups and retention.

Your records remain exportable throughout the term, and offboarding is a defined process described in Your data. Our published security posture, including what we do and do not hold today, is on the security page.

No. Every AI output arrives as a proposal with its citations and a confidence score, and becomes authoritative only when a named person accepts it with a rationale. High confidence auto-clears into a review queue, and auto-cleared does not mean approved.

A citation the model produces that does not resolve against the regulatory corpus is dropped, loudly and with an audit entry, instead of being stored. Only the immutable run record keeps the raw output.

Yes. If your institution's policy forbids sending content to a language model, an owner can disable AI processing for the whole workspace, and every path that would trigger it refuses before anything is written. Some analysis is deterministic and uses no language model at all. That includes absence testing, mock exam checks, clause review and launch delta. There is more in How AI works in Zovos.

Yes. Every run pins its agent, model, prompt template version and hashed inputs, so a re-run reproduces the same inputs verbatim and the question is answerable a year later.

The product does not send email today. Notifications are delivered in the workspace, through the bell in the top bar and the panels on the dashboard. Your email choices on the notification settings screen are stored but inert until email delivery is switched on for the deployment. The screen says so instead of quietly dropping messages. Plan around it. Nothing chases an overdue approval or an expiring attestation by email yet, so the workspace is the place to look.

Slack and Microsoft Teams do not depend on email. Once an administrator connects a channel and turns it on under Notifications, those notifications reach it as well as the bell. See Connecting integrations.

The one exception is the teammate invitation, which is sent by WorkOS, our identity partner, from its own sending domain. If invitations are the thing that is not arriving, that is the sender your mail team needs to let through.

No. Your assistant connects to your own workspace only. The workspace it can reach is derived from your verified Zovos sign-in and never from anything the assistant supplies. It can never read another customer's data, and it only ever acts within your own Zovos role. See Connect your AI assistant.

No. You choose the assistant, and Zovos only answers the authenticated requests it makes on your behalf. Zovos never pushes your data to a vendor it selected, and your data is never used to train a foundation model. Your system credentials and logins never reach Zovos at all. When an assistant runs a control test, it authenticates to your systems with your own credentials on your own machine. What Zovos holds is described on the security page.

An owner enables it per workspace under Settings → Integrations → AI assistants. It is off until they opt in. Once on, you can connect Claude, ChatGPT, Cursor, Microsoft Copilot, or Gemini by pointing the client at the Zovos endpoint and signing in with your organization selected. The per-client steps are in Connect your AI assistant.

No. A control test it submits waits for a reviewer other than you before any rating changes. Imports, rollbacks, new tasks and comments on a finding or a risk show a dry run and write only after you confirm. Evidence and import-file uploads are stored when the assistant makes them, but change no register or rating on their own. The assistant can never approve, sign, or dispose of anything, it can never change a record's status, and it cannot administer users. Those actions stay with a named person under separation of duties. Every tool call is recorded in your audit trail, and an examiner session cannot read or change any workspace data over the connector.

An owner opens Settings → Integrations → AI assistants → Connected clients, which lists every connected assistant and when it was last active, and clicks Revoke to stop that client on its next request. It can be restored later from the same panel.

Yes. With the Zovos Evidence Protocol you point your own assistant at Zovos. That can be Claude, GitHub Copilot, Cursor, or ChatGPT. The assistant fetches the published procedure, runs the test with its own tools against your own system, and submits the result plus the raw evidence. An administrator enables it per workspace under Settings → Integrations → AI assistants, and you need a verified email. See Test controls with your own AI assistant.

No. Every external submission enters "pending review" and nothing moves a rating until a person distinct from the tester accepts it. On acceptance the outcome maps to effectiveness, the owner's attestation for the period is satisfied, and a failed test opens a draft finding. By default 5 % of accepted submissions are randomly re-tested. Your administrator can set that anywhere from 0 to 100 %.

Never. Your assistant authenticates to your system with your own credentials on your own machine. Zovos receives only the result and the artifacts you attach. The tester of record is you, derived from your Zovos login. The assistant's name and model are recorded but shown UNVERIFIED, and they are never an authorization signal.

Never upload credentials, tokens, API keys or connection strings. Never upload SAR, BSA/AML or CTR content, which is legally confidential. Never upload customer PII beyond the minimum the control requires. Strip them before upload. Zovos also scans every artifact, refuses credential or SAR content, and quarantines PII. That scan is a backstop, and it does not replace keeping this material out.

No. Building an access group, giving it to more people or mapping it from your directory never changes the price. An access group only bundles roles, job families and a scope.

No. Zovos is priced by your institution's asset tier, and every module is included at every tier. Job families never change the price. The price is not set per seat either. Your agreement records a contracted seat count for planning, and the seat usage shown in settings is informational rather than a cap. Current tiers are on the pricing page.

Email support from the support page. We usually acknowledge new requests within a week, and anything blocking an examination is handled first. Tell us the screen, what you expected, and the display ID of the record involved. That is usually enough for us to find it without asking you for a second round of detail.