Documents come in, checked data goes out. Staff decide the doubtful cases.
Applications, supplier invoices, claim forms and letters reach you as scans, PDFs, e-forms and e-Invoices. We build intake that recognises each document type, pulls out the fields you rely on, tests them against your rules and passes only the doubtful ones to a member of staff.
For organisations in Malaysia that receive Malay and English documents as paper, PDFs and e-Invoices, and must be able to trace every value.
The system captures documents from all channels, sorts them by type, reads them and checks them against rules. Any document with a field under the confidence threshold or a broken rule waits in a review queue for a person. Checked data moves into the business system, and the corrections reviewers make are added to the evaluation set.
Before and after
How the working day changes
Today
With the system
Today
Today: Copying from attachments
Staff open every PDF, scan or e-form and key names, amounts and reference numbers into the case system or ERP themselves.
With the system
With the system: Structured data from the start
Each field is captured together with its position on the page, so a reviewer can see the value and its evidence next to each other.
Today
Today: Problems surface late
A missing page or a mismatched figure comes to light weeks afterwards, when a payment fails or a decision is disputed.
With the system
With the system: Checks run on arrival
Completeness, master data and business rules are tested before a case opens, while the sender can still be asked for what is missing.
Today
Today: Equal effort for every document
A complete, legible invoice takes the same handling time as an unclear one with pages missing.
With the system
With the system: Effort goes where it is needed
Clean documents go through without handling. Staff work through a queue of doubtful and unusual cases, each showing why it was held.
Today
Today: No trail behind the data
If an auditor asks where a figure came from, the answer depends on which colleague typed it.
With the system
With the system: A trail for every value
For each field the system keeps the source document, the extracted value, its confidence, the rule results and any change a reviewer made.
Workflow
How the flow runs
Seven steps and one review path. Your process owners agree the thresholds and rules with us, and we tune them on your own documents before anything goes live.
Illustrative workflow
7 steps · 1 human checkpoint
Legend
System
Person
Human checkpoint
Exception path
Document intelligence: illustrative flow with a review path
Read the diagram as text
Along the main path, documents are captured, separated and sorted, read, checked against rules and passed to the business system; the path closes with learning from reviewers.
A document with a field under the confidence threshold, or one that breaks a business rule, leaves the main path after the checks and goes to staff review, where a person confirms or corrects it. It then returns to the main path at the hand-over to the business system.
Staff review is the human checkpoint: no doubtful value reaches the business system without a person.
01
Step 1: Capture from all channelsSystem
Scans, email attachments, portal uploads and e-forms enter a single intake queue, each with a case reference, details of the channel and a checksum. Invoices that already arrive as structured e-Invoices skip extraction and move directly to validation.
02
Step 2: Separate and sortSystem
Bundles holding several documents are separated into their parts. Each part is labelled with its document type and language, which decides the extraction schema and the rules that apply to it.
03
Step 3: Read the fieldsSystem
OCR that follows the page layout reads the text, and a language model fills the agreed fields of a strict schema. Each field comes with a confidence score and its position in the source.
04
Step 4: Check against rulesSystem
Values are tested against master data (customers, suppliers, registration numbers and bank accounts), against rules that compare fields, and against earlier submissions to catch duplicates. Fields above the agreed confidence level that pass every rule continue without handling.
05
Step 5: Staff reviewPerson
A reviewer sees the document next to the extracted values, with the broken rule or doubtful field marked, and confirms or corrects each one.
Exception path: Low confidence or rule broken· Returns to step 6
Human checkpoint
No doubtful value enters the business system until a person has checked it. A reviewer can also refuse a document and ask the sender for a new one.
06
Step 6: Pass to the business systemSystem
Checked data opens or updates the record in the case system, CRM or ERP through its API, with the source document attached and a retention class assigned.
07
Step 7: Learn from reviewersSystem
Every correction a reviewer makes is stored as a labelled example. These examples grow the evaluation set, and thresholds or prompts change only after a new version passes it.
Components
Components we would deliver
01
Channel connectors for intake
Connectors for mailboxes, scanners, portals and e-forms that bring every document into one queue with its details and a case reference.
OCR that follows the page layout, with model-based extraction into versioned schemas per document type, a confidence score per field and the position of each value.
A labelled validation set, release gates and dashboards that track the share handled without review, the reasons for exceptions and any drift in field accuracy.
Deployment in your own cloud tenancy at a hosting location agreed with you and recorded in the contract, with encryption, retention classes and deletion jobs that follow your records policy.
Master data for customers, suppliers and bank accounts
Identity provider that assigns reviewer roles
Controls
Controls built in
Access boundaries
Each reviewer sees only the document types and cases that the role permits. The extraction services hold no standing access to the business system; every hand-over runs under a service account limited to that one integration.
Human review
Cases go to a person when a confidence threshold is not met or a rule fails. Thresholds are set field by field rather than per document, and lowered only once the evaluation set shows that it is safe. Decisions on applications and claims remain with your officers.
Auditability
Per field we record where it sits in the source, the value extracted, its confidence, the rule results, the model and prompt version, and any reviewer change with its reason code. If a personal data breach must be notified to the Personal Data Protection Commissioner, within 72 hours under the Commissioner’s guidance, these records show which documents and fields were involved.
Data protection
Intake keeps only the personal data the process needs, redaction is available when documents must be disclosed, and retention and deletion follow your records schedule. Processing runs at the hosting location recorded in the contract, and any transfer of personal data out of Malaysia is assessed under section 129 of the Personal Data Protection Act 2010 (PDPA).
AI transparency
Model and prompt versions are documented with their evaluation results. Where the output affects people, the use of AI is entered in your AI register and explained in the PDPA notice given to applicants or claimants.
Measures
Measures we would agree
We agree the measures with you in discovery, after recording a baseline from the way documents are handled today.
Measures we would agree
Metric
Why it matters
How we would measure it
01Share handled without review
Why it mattersShows, per document type, how much routine work no longer needs a member of staff.
How we would measure itDocuments that clear every threshold and rule with no review, as a share of the total, from the workflow logs.
02Exceptions and their causes
Why it mattersShows whether exceptions come from poor scans, missing data or rules that should change.
How we would measure itVolume in the review queue by reason code, split by channel and document type.
03Accuracy per field
Why it mattersThe quality measure that counts for the decisions and payments further down the line.
How we would measure itPrecision and recall for each field on an agreed, labelled validation set, repeated at every release.
04Handling time
Why it mattersShows the effort saved, and the effort that moves into review.
How we would measure itTime from receipt to hand-over, and active review time per exception, from the queue timestamps.
No targets are set before a baseline exists.
Rollout
Rollout in stages
Phase 01
Discovery and a baseline
Two or three document types and one channel, with your present volumes and error patterns. We label a validation set from real documents with the personal data removed.
Exit criteria
Agreement on fields, rules and quality levels
Baseline recorded
Privacy review with your data protection officer begun
Phase 02
Shadow-mode pilot
The system reads and checks documents alongside the current process; staff carry on with the work and compare results.
Exit criteria
Field accuracy at the agreed level
Thresholds fixed per field
Workbench training given to reviewers
Phase 03
Live for selected types
Documents of the piloted types go through without review when they meet every check, and a sample of those is inspected.
Exit criteria
Samples show no unacceptable errors
Runbook and monitoring handed to your team
Rollback rehearsed
Phase 04
Wider use
Further document types, channels and languages, each clearing the same evaluation gate before going live.
Licence, grant and assistance applications with their supporting documents at federal agencies, statutory bodies and local authorities, with redaction before records are released.
Customer due diligence files, claim documents and supplier invoices at banks, insurers and takaful operators, with a second reviewer for high-value cases.
Referral letters, medical claim forms and supplier certificates at private hospitals and clinics, with sensitive personal data open only to the roles that need it.
Delivery orders, certificates of conformity and customs declarations matched against purchase orders at exporters.
Illustrative example
Import and export documents at a freight forwarder
Situation
A freight forwarder could receive commercial invoices, packing lists, bills of lading and permits from shippers and agents as PDFs, scans and email attachments. Staff would key the details into the forwarding system before each customs declaration is prepared.
System
One intake would separate each shipment file into its documents, read the agreed fields and match them to the booking, the shipper and earlier shipments in the forwarding system.
Human control
Files with doubtful fields, a value that differs between documents or an unknown consignee would wait for a documentation officer. A person signs off every customs declaration before it is submitted.
What we would measure
Share of shipment files handled without review, exceptions by reason, and field accuracy on a labelled validation set.
Malaysia
Intake under the PDPA and e-Invoice
Documents that reach a Malaysian company often carry personal data, from identity card copies to medical bills. Under the Personal Data Protection Act 2010 (PDPA), as amended by Act A1727, data processors have been bound by the Security Principle since 1 April 2025, and since 1 June 2025 a personal data breach is notified to the Personal Data Protection Commissioner, within 72 hours under the Commissioner’s guidance. We design intake to hold only what the process needs and to show which records a breach touched.
Since 1 January 2026, the last of the four e-Invoice phases, businesses in scope issue e-Invoices validated through the MyInvois Portal or API of the Inland Revenue Board of Malaysia (IRBM). Invoices that arrive as structured e-Invoices skip extraction, while PDFs and scans from suppliers outside the scheme still need it. For group companies in the EU, the GDPR and the EU AI Act shape the same controls.
That depends on your documents, so we measure it instead of promising a figure. We label a validation set from your own documents with the personal data removed and report precision and recall for every field. Extraction models do get things wrong, which is why doubtful fields go to a person rather than straight into your systems.
02Can it read handwriting, weak scans and more than one language?
Handwritten forms and poor scans can be read, at lower confidence, so more of them end up in the review queue. Malay and English documents are first sorted by language, so that each one receives the correct schema and rules.
03We already run OCR or a capture tool. Does it have to go?
Not necessarily. Where your capture layer works, we add validation, review and hand-over around it, and use model-based extraction only for the document types where it improves results.
04Does the system decide on applications or claims?
No. It prepares and checks data. Decisions with legal or financial consequences remain with your officers, under your own policies. Where the EU General Data Protection Regulation (GDPR) covers a company in your group, its Article 22 also limits decisions taken by automated means alone.
05In which location are documents processed and kept?
At a hosting location agreed with you and recorded in the contract. We document every processing step, including any external model service, so that your data protection officer can assess it before go-live and any transfer out of Malaysia can be checked against section 129 of the PDPA.
06Where should a first release begin?
With one document type that arrives in volume and has clear rules, such as supplier invoices or one application form. It proves the flow, the review screen and the measures before more types follow. See Our delivery approach.
Review your document flows with us
Bring two or three document types and the systems they end up in. We will sketch a first release for those documents, in the languages and formats you actually receive.