ComplianceRadar

The Problem

European teams are shipping AI features under growing regulatory pressure, but most do not have a simple way to understand whether they are compliant with the EU AI Act, GDPR, and ePrivacy. Traditional options are either expensive legal reviews or enterprise GRC platforms with long onboarding cycles. For startups and SMBs, that creates a dangerous gap: uncertainty now, penalties and business risk later.

The Solution

Users can scan a public website or submit a technical architecture PDF. The pipeline combines guarded input validation, Cheerio with a Playwright fallback, structured Gemini output, private reports, remediation status, dashboard history, weekly URL monitoring, and an explicitly published verification surface.

Architecture

URL or architecture PDF → validation and abuse controls → Cheerio/Playwright or document job → structured Gemini analysis → Prisma/PostgreSQL → private results → remediation status and dashboard; monitored domains add scheduled weekly re-scans and an optional public verification page.

Tech choices

• Next.js 16, App Router, and next-intl — localized product, results, dashboard, and verification routes.
• Cheerio + fetch + Playwright fallback — fast URL scanning with a rendering fallback and cookie/script observation for ePrivacy.
• Google Gemini through @google/genai — schema-bound structured output for categorized findings and recommendations.
• PostgreSQL + Prisma 7 — scans, users, document jobs, remediation state, and monitored domains.
• Upstash Redis + Cloudflare Turnstile — distributed rate limiting, abuse controls, and deduplication on public entry points.
• NextAuth, Stripe, and scheduled jobs — account history, configurable commercial access, and weekly monitoring; public beta access is controlled separately by feature flag.

Implementation highlights

• Dual inputs: live URL scans and validated architecture PDFs with asynchronous job progress.
• Remediation workflow: findings can be marked addressed manually, with progress preserved in the stored report.
• Monitoring: authenticated domains can be re-scanned on a schedule, with the latest report surfaced in the dashboard.
• Public verification is opt-in: only explicitly published monitored reports receive a public status page.
• Public-beta control: a fail-safe feature flag can open core reports for a limited period without removing commercial paths.
• Tests cover scan hardening, beta visibility, localization, report access, deduplication, and other critical flows.

Security and robustness

• SSRF controls: HTTP(S) only, DNS resolution, private/link-local target blocking, plus outbound size and timeout limits.
• Public endpoints use Turnstile, IP-based rate limiting, and reusable scan results to reduce bots and unnecessary model spend.
• Reports are private by default; anonymous results require time-limited access tokens and public verification requires explicit publication.
• PDFs are validated by type, signature, and size; raw files and extracted text are cleared after successful processing while structured results remain.

File layout

• app/[locale]/page.tsx — localized landing page with URL/PDF entry points and public-beta state.
• app/[locale]/results/[scanId] — private report, remediation status, beta/paid access, and PDF output.
• app/[locale]/verify/[scanId] — opt-in public monitoring and remediation record only.
• app/[locale]/dashboard — protected scan history and monitored domains.
• app/api/scan — URL validation, scraping, Gemini analysis, deduplication, and report persistence.
• app/api/document-* and app/api/cron/document-jobs — validated PDF uploads and asynchronous processing.
• app/api/cron/weekly-reports — scheduled re-scans for actively monitored domains.
• lib/publicBeta.ts plus rate-limit, report-access, and locale helpers — beta control and shared security boundaries.