Credorafor Sapphire Bank

Pre-approved corporate credit, decided inside Exasol.

An ExaThon India 2026 project, a hands-on try-out of the Exasol Personal Local Starter Kit and Exasol Personal, deployed on AWS. Sapphire Bank is fictional and all data is synthetic.

Anamika · Product Manager @ Equitas Small Finance Bank

credora.loan the app docs.credora.loan credora.link 3rd party data via API

Built for ExaThon India 2026 · Powered by Exasol

Personal

The bank already holds the data. Offers are still slow and manual.

To make a corporate customer a credit offer, someone has to visit six systems, three in the bank and three 3rd party.

Analyse the customers we have, then offer them credit first.

1,000 companiesexisting current-account customers, 2 to 5 partners each

Analysed in Exasolbank data, bureau, GST and AA data, risk model, policy

Pre-approved offeramount, ROI (rate) and tenure, plus a negotiation limit

RM calls the customerand negotiates inside the limit, no trip back to credit

PDprobability of default

How likely the company is not to repay, from a model trained on the bank's own past loans. Graded A1 (under 1%) to D (12% and above).

RAROCrisk-adjusted return

(Rate − cost of funds − operating cost − PD × loss given default) ÷ capital held. Every offer must clear the 15% hurdle.

DSCRdebt service coverage

Cash the company generates ÷ what the loan costs it each year. At least 1.25 for the offer, 1.10 at the negotiation limit.

GSTgoods and services tax

Monthly sales each company files with the tax network, GSTN, for 2 to 10 years per company. Late filings and a gap to bank credits are warning signs.

CIBILIndia's credit bureau

A score for every partner and a commercial rank (CMR) for every company. A partner below 600 or a CMR of 9 or worse means no offer.

AAAccount Aggregator

With the customer's consent, the partners' accounts at other banks. The consent expires, so Exasol purges the data on time, with proof.

Everything meets in Exasol, and leaves as a decision.

Bank data is read in place, 3rd party data is fetched via API by UDFs, and every person and the AI read results as their own Exasol user.

StoreCompute in ExasolOrchestration, AISecurity3rd party APIPeople, web

One engine does seven jobs, and the data never leaves it.

Exasol Personal used to the full, with open-source extensions from both GitHub organisations, exasol and exasol-labs.

Virtual schemas push the work down. Nothing is copied.

Feature step 7 aggregates core banking by account and month. Exasol hands the join, the filter and the GROUP BY to Oracle.

-- RUN_ANALYSIS, step 7 INSERT INTO CREDORA_STAGE.CA_MONTHLY SELECT t.ACCOUNT_NO, a.OWNER_ID, TRUNC(t.TXN_DATE, 'MM') MON, SUM(CASE WHEN t.DR_CR = 'C' THEN t.AMOUNT ELSE 0 END), ... COUNT(*) N FROM VS_CBS.TXN t JOIN VS_CBS.ACCOUNT a ON a.ACCOUNT_NO = t.ACCOUNT_NO WHERE a.ACCT_TYPE = 'CA' GROUP BY t.ACCOUNT_NO, a.OWNER_ID, TRUNC(t.TXN_DATE, 'MM')

Monthly totals per account come back. The ~850,000 transactions stay in Oracle, and the bank keeps one system of record.

Python UDFs fetch 3rd party data via API, 16 at a time.

A SET script groups the keys into 16 buckets by the first hex digit of an MD5 hash, and Exasol runs one UDF instance per bucket, in parallel.

One Lua call runs the whole analysis, step by logged step.

EXECUTE SCRIPT CREDORA.RUN_ANALYSIS('<run>') commits after every step, so the web app can watch the run as it happens.

Measured on the live deployment for 1,000 companies, on one r6i.xlarge node.

CREDORA.RUN_LOG

STEP STATUS ROWS_OUT MS

A failed step is logged with its error and stops the run. The last published run stays visible in the app.

The models are trained, stored and scored inside Exasol.

Past loans are read live from PostgreSQL. Two models train on the same loans and the same hold-out. Only the active one decides.

PREFERRING ranks on three goals at once, with no weights.

The skyline is every approved company that no other beats on return, risk and amount together. Peel it off, take the next skyline, until 50 are ranked.

UPDATE CREDORA.DECISIONS SET SKYLINE_LAYER = :l WHERE APP_ID IN ( SELECT APP_ID FROM CREDORA.DECISIONS WHERE DECISION = 'APPROVE' AND SKYLINE_LAYER IS NULL PREFERRING HIGH RAROC_OFFER PLUS LOW PD PLUS HIGH OFFER_AMOUNT)

On the measured run the layers held 83 companies by the time 50 were reached, in 0.02 s. The best 50 approved go to the relationship managers.

One certified definition serves the app, the analyst and the AI.

CREDORA_SEM.PORTFOLIO holds certified metrics. The SQL preprocessor compiles semantic queries per role, inside Exasol.

METRIC approval_rate AS approved_companies / NULLIF(companies_analysed, 0) ON ENTITY decision FORMAT 'percentage' DISPLAY 'Approval rate' SYNONYMS ('approval ratio', 'hit rate') RATIO PUBLIC CERTIFIED

Exasol, not the app, decides who sees what.

Four people, four Exasol users. A relationship manager reads only the V_RM_* views, which return the companies assigned to CURRENT_USER.

-- signed in to Exasol as CREDORA_RM (role R_RM)

CREDORA_RM> SELECT * FROM CREDORA.DECISIONS;

insufficient privileges

CREDORA_RM> SELECT * FROM CREDORA.V_RM_DECISIONS;

rows, the companies assigned to

CREDORA_RM, from published runs

CREATE VIEW CREDORA.V_RM_DECISIONS AS SELECT d.* FROM CREDORA.DECISIONS d JOIN CREDORA.RM_ASSIGNMENT a ON a.CIF_ID = d.CIF_ID AND a.EXA_USER = CURRENT_USER JOIN CREDORA.RUN_PUBLISH p ON p.RUN_ID = d.RUN_ID;

The view runs with its owner's rights, so R_RM needs no grant on the tables underneath. In production each RM gets an own Exasol user, and the same views work unchanged.

Ask Credora logs in as you, so the AI cannot read more than you.

Claude reaches Exasol only through the official Exasol MCP server (exasol/mcp-server), started for each question on the app host as the signed-in role's own Exasol user.

From a published run to a disbursed loan, in four roles.

Each hand-off is a row in Exasol or the CRM, so admin, data scientist and loan operations can track every company.

Started on the starter kit, deployed to AWS with one command.

Before AWS, on a laptopExasol Personal Local Starter Kit (exakit 0.2.3) with local Exasol, MCP setup, exapump, pyexasol

$ python deploy/credora.py deploy --env <name>

Exasol on EC2, launcher 2.3.0

RDS ×3, app host, S3, DNS (OpenTofu)

App, mocks, sites (Compose)

1,000 synthetic companies

SLC, adapters, UDFs, Lua, roles, semantics

First training and analysis

Realistic volumes for a mid-size corporate book.

The data is synthetic, but the volumes are not small. Rows per source on a log scale, and what one run costs.

1k10k100k1M

s

the full analysis of 1,000 companies, 13 steps, one Exasol call

AUC of the champion. The challenger scorecard reaches

16

UDF instances fetching 3rd party data via API in parallel

companies flagged by the Isolation Forest, and approvals became referrals

~75s

to regenerate all the synthetic data, with 1,000 companies, ~3,500 partners, every source rebuilt consistently. Semantic routing adds ~4 ms per statement.

Narrow doors, and failures that stay contained.

Network

Only 80 and 443 are public. Exasol's ports open to admin IPs only, and RDS sits in private subnets.

Database grants

A user per role. A refused query reaches the app as 403 Exasol denied access for your role.

AI in the same boundary

MCP writes off, a topic gate before any query, every SQL statement shown with the answer.

Secrets

Generated per deployment into Secrets Manager. API tokens live in CONNECTION objects. None in the repo.

Consent and retention

3rd party replies carry a purge time. PURGE_EXPIRED deletes them and keeps a SHA-256 proof.

If this fails	What happens	Recovery
A bank database	That step fails and is logged, and the last published run stays visible	Re-run when it is back
A 3rd party API	The fetch fails with the API's error, and nothing half-done is published	Re-run, the relays are stateless
A preprocessor module	The framework skips it (fail-open), and plain SQL keeps working	Fix or remove its rule
The Exasol node	The app shows the last results it can reach, and analysis and AI pause	Restart, and `deploy` recreates objects
The app host	The site is down, but Exasol and the databases are unaffected	`credora.py ship`
The MCP server	Ask Credora returns 503, and the rest of the app works	Ask again for a fresh process
A question outside grants	Exasol refuses, and Claude says the role cannot see it	None, this is access control working

Every screen in the demo proves an Exasol feature.

Explain mode shows it live, with an Exasol console showing the SQL behind each screen, an ⓘ glossary, and a control room.

Built with Exasol open source. Thank you.

Every project below runs in the live deployment, from both GitHub organisations, exasol and exasol-labs. Thank you to the Exasol team and the contributors.