The World's First Zero-Outbound,
Non-Custodial OTC AI Engine.
Automate trade negotiation, live rate enforcement, and intent structuring across WhatsApp, mobile apps, and enterprise APIs — without ever disclosing your treasury keys or changing your regulatory compliance posture.
Enterprise Infrastructure · Independently VAPT-Audited · June 2026
Every other AI OTC tool asks for your keys.
We built an engine that doesn't.
The Old Way
AI Chatbots Today
- Hand over Prestmit / Breet API keys to a third-party AI vendor
- Third-party servers ping your internal rate database on every request
- AI can be tricked into quoting inflated payouts via prompt injection
- Supply-chain breach at your AI vendor exposes your treasury credentials
- CBN compliance complications from third-party key custody arrangements
- 15-minute manual chats, staff bottlenecks, and missed high-volume trades
The Vulcan Way
Zero-Outbound AI
- You inject your own live rates directly — Vulcan reads them in memory
- Zero outbound calls from Vulcan to your servers, ever, by architecture
- Server-side math guardrail blocks any AI-quoted anomaly exceeding 2%
- We physically cannot store or lose your keys — enforced in code
- Non-custodial profile means no PSSP/MMO license obligations for us
- 2-second automated flows with structured JSON intent output, 24/7
Zero-outbound is not a feature. It's our foundational legal and commercial differentiator.
By refusing to accept, store, or request client API keys, Vulcan eliminates its surface area as a supply-chain attack target and removes CBN PSSP/MMO licensing obligations entirely.
How Vulcan AI Works
A single stateless API call powers the entire conversational trade flow. Your backend stays in control at every step. Vulcan AI provides the brain — you keep the keys.
You Inject Live Rates
On every chat turn, your backend sends your current trading rate matrix directly in the API request body. Vulcan reads it in-memory — zero latency, zero outbound calls, zero exposure of your internal systems.
Vulcan AI Negotiates the Trade
Our AI engine engages your customer in natural conversation, quotes prices using your injected rates, collects their bank details, verifies KYC ceilings and daily limits, and structures the trade — all autonomously, in seconds.
Your System Executes
Vulcan returns a clean, structured JSON intent object. Your servers execute the payout using your own securely held keys. Tier 1 desks execute autonomously. Tier 2/3 receive a handoff ticket for a human agent. Vulcan never touches a single Naira.
POST /v1/engine/chat · Stateless · JSON · No Webhooks · No Persistent Connections
Inbound Context Injection
One endpoint. One stateless call per turn. Your rates, your keys, your execution.
Per-Turn Rate Injection
Your rateContext map must be included on every single request — including mid-conversation turns. Vulcan never caches it. No cache = no staleness = no manipulation window.
No Credentials Accepted
Your gateway key authenticates your vendor identity. Vulcan receives no treasury keys, no Prestmit/Breet tokens, no internal API secrets — by API design.
Server-Side Math Verification
After every AI negotiation, Vulcan recomputes expected payout from your injected rates. If AI-quoted payout deviates by more than ±2%, the trade is blocked before a response is returned.
Structured Intent Output
On trade completion, you receive HANDOFF_TICKET_INTENT (Tier 2/3) or EXECUTE_TRADE_INTENT (Tier 1). Your systems execute using your own locally-held keys.
Critical Requirement
Omitting rateContexton any turn — even when the customer is just saying "yes" — returns HTTP 400 and breaks the conversational flow.
1POST https://api.vulcanai.com.ng/v1/engine/chat2Content-Type: application/json3x-vulcan-gateway-key: vk_live_your_secure_token_here45{6"vendorId": "native_desk_001",7"customerId": "wa_2348031234567",8"message": "I want to sell a $100 iTunes USA card",9"kycLevel": "Tier_2",10"dailyLimitRemaining": 500,11"rateContext": {12// Your live rates — injected EVERY turn, never cached13"itunes_usa_physical": 405,14"itunes_usa_ecode": 385,15"steam_usa_physical": 410,16"usdt_trc20": 148017}18}
Endpoint
POST /v1/engine/chat
Auth Header
x-vulcan-gateway-key
Response Always
HTTP 200 + reply + intent
Choose Your Deployment Model
Every tier runs on the same battle-tested engine. Your tier determines how trades are executed and how rates are sourced — not the quality of the AI.
TIER 3 — WHATSAPP / TELEGRAM
Copilot
₦2,500,000
one-time + ₦750,000 / mo
TIER 2 — WEBSITE / MOBILE APP
Native App
₦5,000,000
one-time + ₦1,500,000 / mo
TIER 1 — ENTERPRISE BACKEND
God Mode
₦10,000,000
one-time + ₦3,000,000 / mo
Feature
TIER 3 — WHATSAPP / TELEGRAM
Copilot
TIER 2 — WEBSITE / MOBILE APP
Native App
TIER 1 — ENTERPRISE BACKEND
God Mode
Setup Fee
One-time
₦2,500,000
one-time
₦5,000,000
one-time
₦10,000,000
one-time
Monthly Retainer
Recurring
₦750,000 / mo
₦1,500,000 / mo
₦3,000,000 / mo
Deployment Channel
Rate Sourcing
AI Intent Output
Autonomous Payouts
Dev Infrastructure
KYC & Guardrails
Omnichannel DB Sync
Best For
No self-serve. No freemium. All onboarding is concierge-managed for quality control and contractual accountability. · Pricing in NGN.
Built for Risk Officers. Verified by VAPT.
Every security claim below is an architectural fact — not a marketing assertion — independently verified through a full SAST and penetration test audit completed June 2026.
Independent SAST/VAPT Audit — June 2026
5 vulnerabilities identified and patched across LLM Security, Auth, Cryptography & API Abuse vectors
Zero Key Custody
We physically lack the infrastructure to store your treasury keys. Our engine accepts no credentials, stores no credentials, and makes no outbound calls to your systems. A complete breach of Vulcan's infrastructure exposes zero client keys. Enforced in code, verified by audit.
Prompt Injection Guardrails
After every AI negotiation, a mandatory server-side validator recomputes the expected payout from your injected rate matrix. Any AI-quoted payout that deviates by more than ±2% is hard-blocked before the response is returned. An adversary cannot trick the AI into offering a higher rate — the math enforces reality.
CBN Compliance — No PSSP/MMO License Needed
Because Vulcan never routes Naira, crypto, or holds execution credentials, integrating our AI does not trigger PSSP or MMO licensing obligations for Vulcan. Your compliance posture is not complicated by our presence on your tech stack.
30-Day Chat Data TTL
All conversation sessions in Firestore are subject to a strict 30-day Time-To-Live automatic deletion policy. Server logs run through a five-pattern PII masking pipeline — redacting bank account numbers, EVM addresses, BTC addresses, and email addresses before reaching cloud dashboards.
Timing-Safe Authentication
All API key comparisons use Node.js crypto.timingSafeEqual() with fixed 128-byte padded buffers, eliminating timing-oracle side-channel attacks that would otherwise allow offline key recovery through response latency analysis.
Idempotent Intent Emission
Firestore-backed distributed transaction locking guarantees exactly one trade intent per negotiated trade — regardless of concurrent retries, network instability, or concurrent API calls from multiple server pods. Float-drift in AI-quoted values is eliminated by integer-cent key construction.
AES-256-GCM Encryption
12-byte random IV, 16-byte auth tag, 32-byte key validation. Authenticated encryption prevents silent data tampering.
Cross-Tenant Isolation
vendorId sourced exclusively from authenticated session — never from the request body. Structural isolation confirmed by audit.
Bi-Annual VAPT Cadence
Mandatory re-audit scheduled following any new AI model rollout or prompt engineering change.
Scale Your Desk. Keep Your Keys.
Stop losing trades to slow manual replies. Stop risking your treasury with insecure chatbots. Our enterprise team manages every step of onboarding — from MSA signing to UAT and go-live. Most clients are live within days.
Contact Enterprise Sales
No demo forms. No automated funnels. You speak directly to the team that builds and operates Vulcan.
All onboarding is concierge-managed. No self-serve provisioning.