Functional prototype · private repository
TrustRespond.ai
Functional prototype for document-grounded vendor security questionnaires with RAG, review states, and Excel export.
The enterprise compliance bottleneck
Every B2B SaaS company closing enterprise deals faces vendor security questionnaires: huge Excel files from IT asking granular questions about data security, SOC 2, and policies. Manually mapping internal documents into those sheets takes weeks, formatting breaks, context is lost, and sales cycles slip.
The solution
The private prototype implements an end-to-end path: compliance documents are processed into pgvector, Excel questionnaires are detected, Gemini drafts answers from retrieved context, and results are written back into the workbook. Lower-confidence output is flagged for manual review.
TrustRespond is an actively developed technical foundation, not a claimed customer deployment. Tenant boundaries, server-side orchestration, parsers, review flows, tests, and Stripe-backed plan state exist in the repository; runtime, accuracy, and time-saved figures are not presented without a reproducible benchmark.
Architecture & data flow
Documents are chunked and embedded; an organization-scoped generation job retrieves relevant chunks, creates structured drafts, flags uncertain answers for review, and writes results into a new XLSX file. Signature-verified Stripe webhooks update plan state on the server.
Technical stack
- Framework: Next.js 16 in a monorepo with server-side API routes and a separate worker.
- Database & auth: Supabase (PostgreSQL) with authentication, Row Level Security (RLS), and durable app state.
- Vector search: pgvector for storing and querying document embeddings at scale.
- AI: Gemini-based retrieval and generation primitives with structured output, bounded concurrency, batching, retry, and fallback.
- Billing foundation: Stripe Checkout and signature-verified webhooks update organization plan state on the server.
- UI: Tailwind CSS with a custom enterprise look—glass surfaces, deep navy surfaces, emerald accents.
Verifiable engineering decisions
Bounded questionnaire generation
Issue: Large questionnaires can create many model calls, variable runtime, and partial failures.
Fix: The worker processes questions in bounded batches of 8–12, limits concurrent retrieval, retries failed batch generation, and falls back to per-question generation. Telemetry records duration and fallback counts.
Tenant isolation for privileged jobs
Issue: Background jobs need privileged storage and database access without reading or writing another organization's data.
Fix: The API derives the organization from the authenticated session; retrieval, questionnaire queries, storage keys, and updates are also scoped by org_id. RLS remains the outer database boundary.
Server-authoritative plan state
Issue: Client-side plan claims must not unlock quotas or product access.
Fix: The webhook reads the raw body, verifies the Stripe signature, and updates the organization plan only through the server-side service client.
User experience
The UI is intentionally premium: a dark-glass enterprise aesthetic, polished drag-and-drop upload zones, and analytics surfaces (including dry-run style mapping views) that feel like a high-end B2B tool—not a toy demo.
Result
The private codebase contains a functional upload, retrieval, generation, review, and XLSX-export path plus unit, build, and optional E2E checks. That verifies the architecture; it is not evidence of a particular runtime, accuracy rate, customer adoption, or time saving.