How does PCI DSS apply to an on-premise AI document extraction system in a retail company?

PCI DSS Requirement 3.4 mandates encryption of stored cardholder data, and Requirement 12.8 requires a formal risk assessment for any new technology. Forfis treats the AI layer as an extension of the existing PCI scope: the model runs inside the client's VPC, API keys rotate on a 90-day schedule, and the integration layer (Slack/Teams webhook) never receives raw PAN data. The audit trail logs every extraction event with a hash of the source document, satisfying Requirement 10.2.2 logging controls.

What does an eight-week AI pilot look like in practice?

Forfis uses a fixed-scope pilot model: one workflow, one team, eight weeks. The pilot includes a measured baseline (cycle time, error rate) captured in week one, model selection and fine-tuning in weeks two to four, integration with the existing Slack or Teams channel in weeks five to six, and a two-week shadow run where the AI drafts and a human approves every output. The pilot ends with a go/no-go decision based on whether the error rate falls below the agreed threshold (typically 3% for document extraction).

How does Forfis keep regulated data on-premise while integrating with Slack or Teams?

The model runs on the client's own GPU hardware (typically an A100 or H100 node), so no document data leaves the building. Forfis configures the inference stack (vLLM or TGI) inside the client's VPC, and the Slack or Teams integration uses a lightweight API gateway that forwards only the extracted fields, not the raw document. The model itself is an open-weight LLM (Llama 3 70B or Mistral 7B, depending on the document complexity) fine-tuned on the client's historical extraction examples.

How does Forfis decide which workflow to automate first?

Forfis starts with a process audit that maps every manual touchpoint in the target workflow. The audit identifies which documents are highest-volume, which fields are most error-prone, and where the current cycle time is longest. The pilot then targets the single workflow with the best ratio of volume to complexity. For a 300-person e-commerce company, that is usually invoice processing or supplier onboarding documents, not the full document pipeline.

What metrics does Forfis measure in a document extraction pilot?

The pilot ships with a before/after baseline: cycle time per document, error rate (measured as field-level mismatches against a human-verified sample), and the number of manual interventions required. For document extraction, Forfis typically targets a 60-80% reduction in cycle time and an error rate below 3%. The baseline is captured in week one using a 200-document sample, and the post-pilot measurement uses the same sample size to keep the comparison valid.

Why does Forfis use open-weight models instead of OpenAI or Anthropic APIs?

Forfis uses OpenAI or Anthropic APIs for tasks where quality is the primary constraint and data sensitivity is low (e.g., ticket triage, first-response drafting). For document extraction on regulated data, Forfis uses open-weight models (Llama 3, Mistral) running on the client's own hardware. The choice is driven by the data residency requirement, not by model quality alone. The architecture is model-agnostic: the integration layer treats the model as a swappable component, so the client can switch providers without re-architecting the pipeline.

How does the human-in-the-loop model work in Forfis's delivery?

The AI drafts the extraction or classification, and a human approves anything that touches money, health data, or a contract. For document extraction, the human review is typically a spot-check of 10-20% of documents in the first month, tapering to 5% once the error rate stabilizes below 3%. The approval step is built into the Slack or Teams workflow: the AI posts the extracted fields to a channel, a human clicks approve or flag, and the flagged items go to a queue for manual correction.

What industries and company sizes does Forfis typically work with?

Forfis works with companies in fintech and payments, healthcare, e-commerce, B2B SaaS, logistics, insurance, and professional services in Tier-1 markets. The typical client is a 200-500 person company that has already automated one process and is looking to scale without adding headcount. The engagement starts with a process audit, moves to a fixed-scope pilot, and then to rollout and managed operation. Forfis is a product studio with eight years of delivery experience, not a consulting firm.

Forfis Blog

Swiss E-Commerce Firm Cuts Invoice Processing Time 71% with On-Premise AI

Written by

Forfis

E-commerce and Retail

Background: A 300-Person Swiss E-Commerce Firm at Capacity

This case study is a composite based on patterns observed across Forfis engagements. We do not name real clients. The company described here is a mid-size e-commerce and retail operator based in Zurich, with roughly 300 employees across operations, customer service, and finance. The stack is a mix of a legacy ERP (SAP Business One), a modern CRM (HubSpot), and Slack as the primary internal communication channel. The company had already automated one process — a basic rules-based invoice matching workflow — and was looking to extend AI automation to the next layer of back-office work without adding headcount. The constraint was clear: the finance team was at capacity, and the CTO had a hard deadline to reduce manual data entry before the next fiscal year close.

Challenge: 12 Hours a Week Lost to Manual Data Entry

The finance team was spending an estimated 12 hours per week on manual document extraction: pulling supplier invoice fields (vendor name, amount, tax code, line items) from PDFs and entering them into the ERP. The error rate on manual entry was around 8%, and each correction cycle added 45 minutes of rework. The operational pressure was threefold: the fiscal year close was eight weeks away, the team had no budget for additional hires, and the company was in the middle of a PCI DSS re-certification audit, which meant any new system touching payment-related data had to pass a formal risk assessment under Requirement 12.8. The CTO needed a solution that would free senior staff from routine work without introducing a new compliance liability.

Approach: On-Premise Llama 3 with a Slack Approval Loop

Forfis ran a two-week process audit that mapped every manual touchpoint in the invoice processing workflow. The audit identified that 70% of the extraction work involved supplier invoices in a consistent PDF format, making them a strong candidate for a fixed-scope pilot. The pilot used an open-weight model (Llama 3 70B) fine-tuned on 500 historical invoice examples, running on the client’s own A100 GPU node inside their VPC. The integration layer connected to Slack: the AI posted extracted fields to a dedicated channel, a human approved or flagged each entry, and approved fields were pushed to the ERP via its REST API. The entire pilot ran in eight weeks, with a measured baseline captured in week one and a shadow run in weeks seven and eight.

Outcome: 71% Faster Cycle Time, 2.4% Error Rate

The pilot reduced the average cycle time per invoice from 14 minutes to 4 minutes, a 71% improvement. The field-level error rate dropped from 8% to 2.4%, below the 3% threshold agreed in the pilot scope. The human approval step required intervention on roughly 15% of documents in the first two weeks, tapering to 6% by the end of the shadow run. The finance team reported that the senior staff who had been doing manual entry were now spending that time on supplier negotiations and exception handling. The PCI DSS risk assessment was completed in week six, and the audit trail (every extraction event logged with a document hash) satisfied Requirement 10.2.2 without additional controls.

Lessons for Teams Scaling AI Without New Hires

Baseline before you build. Capturing a 200-document baseline in week one is non-negotiable. Without it, you cannot prove the pilot worked, and the go/no-go decision becomes a gut call. Forfis treats the baseline as a contract: the same sample size, the same measurement method, before and after.
Pick the highest-volume, lowest-complexity workflow first. The pilot should target the workflow where the ratio of document volume to format variability is highest. A consistent PDF format with 70% of the volume is a better pilot candidate than a mixed-format pipeline with 30% of the volume.
The approval loop is the product, not the model. The Slack channel where a human clicks approve is where the real value lives. The model is a swappable component; the approval workflow is what the team actually uses every day.
PCI DSS compliance is a design constraint, not an afterthought. The on-premise architecture and the audit trail were built in from day one, not bolted on after the pilot. Requirement 12.8 risk assessment and Requirement 10.2.2 logging were part of the pilot scope, not a separate workstream.

Swiss E-Commerce Firm Cuts Invoice Processing Time 71% with On-Premise AI

Background: A 300-Person Swiss E-Commerce Firm at Capacity

Challenge: 12 Hours a Week Lost to Manual Data Entry

Approach: On-Premise Llama 3 with a Slack Approval Loop

Outcome: 71% Faster Cycle Time, 2.4% Error Rate

Lessons for Teams Scaling AI Without New Hires

Comments

Leave a Reply Cancel reply

More posts

German E-Commerce Brand Cuts First-Response Time 63% With a pgvector Voice Agent

AI Process Audit and RAG Pipeline for Fintech Lead Qualification in Austria

Austrian E-Commerce Firm Cuts Candidate Screening Cycle Time 40% with AI Pilot

How a Zurich Professional Services Firm Cut Monthly Close From 14 Days to 4