Skip to content
Demo on requestCompliance AI

Compliance Review Copilot

Reviews contracts and policies against GDPR, SOC 2, ISO 27001 and HIPAA; every finding cites a verified span of the source.

Solo build · AI review pipeline, full stack, infra

  • Next.js 16
  • React 19
  • Tailwind 4
  • FastAPI
  • async SQLAlchemy
  • Postgres
  • WebSockets
  • Docker
  • AWS EC2
  • Terraform
  • Caddy
Request a demoCode (opens in new tab)

Problem

Compliance review means checking long documents against several frameworks, and a reviewer can't trust a finding they can't trace back to the text.

What I built

A review copilot that checks an uploaded contract or policy against versioned framework rule packs, streams findings live over WebSockets, and lets reviewers accept or reject each one.

Architecture

  1. Upload
  2. Ingest · FastAPI + worker
  3. Match · versioned rule pack
  4. Cite · span verified or discarded
  5. Stream · WebSocket
  6. Review · accept / reject in Postgres

Hard parts and decisions

  • Frameworks are versioned rule packs, not prompts.
  • Citation or discard: a finding without a mechanically verified source span never reaches the reviewer, including control-ID alias normalisation.
  • Reviewer accept and reject decisions persist.
  • An eval harness and pluggable model providers.
  • YAML schemas drive code generation across the monorepo.

Results

Verified end to end

Passed a 5-round QA on 18 Oct 2026. In the full flow, an uploaded policy produced 4 GDPR findings with highlighted citations, and reviewer decisions persisted.

What I'd do next

Deploy behind auth for pilot reviewers.