CompliAgent AI — Explainer

Concept

CompliAgent AI is a B2B SaaS platform that automates compliance management for Fintech and Healthtech companies. It monitors regulatory changes from authoritative bodies (FINRA, SEC, HIPAA, GDPR, PCI-DSS…), compares them against uploaded internal policy documents via an LLM-powered gap analysis engine, and surfaces actionable work-items on a compliance dashboard.

Core value proposition: replace hundreds of manual legal-review hours with an AI agent that continuously watches the regulatory landscape and immediately tells compliance teams exactly what sections of their policies need updating — and why.

---

Architecture

┌─────────────────────────────────────────────────────────────────┐
│                        API Layer (REST)                         │
│  AuthController  PolicyDocController  GapAnalysisController     │
│  RegulatoryController                  DashboardController      │
└────────────────────────────┬────────────────────────────────────┘
                             │
┌────────────────────────────▼────────────────────────────────────┐
│                      Service Layer                              │
│  UserService   PolicyDocumentService   GapAnalysisService       │
│  RegulatoryMonitoringService           DashboardService         │
└───────┬────────────────────┬───────────────────────────────────┘
        │                    │
┌───────▼──────┐   ┌─────────▼──────────────────────────────────┐
│  LlmClient   │   │             Repository Layer                │
│  (OpenAI API │   │  Organization  User  PolicyDocument         │
│   via Feign) │   │  RegulatoryUpdate  ComplianceGap            │
└──────────────┘   └─────────────────────┬──────────────────────┘
                                         │
                              ┌──────────▼──────────┐
                              │     PostgreSQL DB    │
                              └─────────────────────┘

Multi-Tenancy

Every %%INLINE0%% entity is a fully isolated tenant. All JPA queries filter by %%INLINE1%%. The JWT carries an %%INLINE2%% claim; %%INLINE3%% propagates it through every request. Data from one tenant is never accessible to another.

Security

Spring Security 7 + JJWT 0.12.6. Stateless JWT sessions, BCrypt-12 password hashing, method-level @PreAuthorize for admin-only endpoints.

AI Gap Analysis Pipeline

1. User uploads policy document (PDF/DOCX/TXT) → text extracted and stored.
2. RegulatoryMonitoringService fetches updates every hour (configurable). In production, replace stub seeds with real HTTP clients for FINRA RSS, SEC EDGAR, HHS HIPAA portal, etc.
3. GapAnalysisService builds a structured prompt for the LLM comparing policy text against regulatory text.
4. LLM response parsed into ComplianceGap work-items (section, description, recommendation, severity).
5. Falls back to structured mock gaps when no API key is configured — safe for demos and CI.

Scheduled Tasks

Task	Default interval	Property
Regulatory fetch	1 hour	app.monitoring.fetch-interval-ms
Auto gap analysis	2 hours	app.monitoring.analysis-interval-ms

---

Domain Model

Entity	Description
Organization	Tenant root; owns all data
%%INLINE11%%	Platform user; scoped to one org; implements %%INLINE12%%
PolicyDocument	Uploaded internal policy; extracted text stored as TEXT
RegulatoryUpdate	Change fetched from regulatory source; global table
ComplianceGap	AI-detected gap between a policy doc and a regulation

---

REST Endpoints

Public (no auth)

Method	Path	Description
POST	/api/auth/register	Create new org + admin user, returns JWT
POST	/api/auth/login	Authenticate, returns JWT

Authenticated (Bearer JWT)

Method	Path	Description
POST	/api/documents	Upload policy document (multipart/form-data)
GET	/api/documents	List tenant's documents
GET	/api/documents/{id}	Get document details
DELETE	/api/documents/{id}	Delete document
GET	/api/regulatory	Regulatory updates for tenant's industry
GET	/api/regulatory/{id}	Regulatory update detail
POST	/api/regulatory/fetch	Manual fetch trigger (ADMIN only)
POST	/api/analysis/run	Run AI gap analysis
GET	/api/analysis/gaps	List tenant's compliance gaps
GET	/api/analysis/gaps/{id}	Get gap detail
PATCH	/api/analysis/gaps/{id}/status	Update gap status
GET	/api/dashboard	Compliance dashboard snapshot

---

Dashboard Metrics

Metric	Calculation
%%INLINE30%%	%%INLINE31%% — 100 if no gaps
%%INLINE32%%	%%INLINE33%% records with OPEN status
%%INLINE35%%	%%INLINE36%% severity + OPEN status
%%INLINE38%%	Documents in %%INLINE39%% or ANALYZING state
recentGaps	Last 5 detected gaps
recentUpdates	Last 5 regulatory updates for the org's industry

---

How to Run

Prerequisites

• Java 25
• Maven 3.9+
• PostgreSQL 15+ (running locally or via Docker)

1. Start PostgreSQL

docker run -d --name compliagent-db \
  -e POSTGRES_DB=compliagent \
  -e POSTGRES_USER=compliagent \
  -e POSTGRES_PASSWORD=compliagent \
  -p 5432:5432 postgres:15

2. Configure application.yml

Add these properties (or export as env vars):

spring:
  datasource:
    url: jdbc:postgresql://localhost:5432/compliagent
    username: compliagent
    password: compliagent
  jpa:
    hibernate:
      ddl-auto: create-drop   # use 'validate' in production
    show-sql: false

app:
  jwt:
    secret: "YourSecretKeyAtLeast32CharsLongForHS256!!"
    expiration: 86400000
  llm:
    api-url: https://api.openai.com
    api-key: "sk-..."          # leave blank for demo/mock mode
    model: gpt-4-turbo
  monitoring:
    fetch-interval-ms: 3600000
    analysis-interval-ms: 7200000

3. Build & Run

mvn clean package -DskipTests
java -jar target/compliagent-ai-0.0.1-SNAPSHOT.jar

Or in dev:

mvn spring-boot:run

4. Quick API walkthrough

# Register a new Fintech company
curl -X POST http://localhost:8080/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"organizationName":"AcmeBank","industry":"FINTECH","email":"cco@acmebank.com","password":"Secure123!"}'

# Login
TOKEN=$(curl -s -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"cco@acmebank.com","password":"Secure123!"}' | jq -r .token)

# Fetch regulatory updates (seeds demo data on first call)
curl http://localhost:8080/api/regulatory \
  -H "Authorization: Bearer $TOKEN"

# Upload a policy document
curl -X POST http://localhost:8080/api/documents \
  -H "Authorization: Bearer $TOKEN" \
  -F "file=@/path/to/my-policy.txt"

# Run gap analysis (replace UUIDs with real values)
curl -X POST http://localhost:8080/api/analysis/run \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"policyDocumentId":"<doc-id>","regulatoryUpdateId":"<reg-id>"}'

# View dashboard
curl http://localhost:8080/api/dashboard \
  -H "Authorization: Bearer $TOKEN"

---

Business Analysis

Market Opportunity

• Global compliance software market: USD 37B+ (2024), growing at ~12% CAGR.
• Fintech AML/KYC + Healthtech HIPAA compliance costs $3–8M/year for mid-size firms.
• Each regulatory breach in Fintech averages USD 5.9M in fines (IBM Cost of Compliance 2024).

Pricing Model (B2B SaaS)

Tier	Regulations monitored	Documents	Users	Price/mo
Starter	3	10	3	$299
Growth	10	50	15	$999
Enterprise	Unlimited	Unlimited	Unlimited	Custom

Competitive Moat

1. Domain specificity: trained prompts tuned for legal compliance language.
2. RAG layer (roadmap): vector DB with embeddings from regulatory corpora enables precise retrieval, not just string matching.
3. Audit trail: every gap, status change, and recommendation is persisted — critical for regulatory audits.
4. Time-to-value: onboard in minutes vs. months-long consulting engagements.

Roadmap

• [ ] Apache Tika integration for binary PDF/DOCX text extraction
• [ ] Vector DB (pgvector or Weaviate) for RAG-enhanced analysis
• [ ] Real-time webhook notifications for critical regulatory alerts
• [ ] SAML/SSO enterprise authentication
• [ ] Exportable compliance reports (PDF, XLSX)
• [ ] Multi-region data residency (EU / US data segregation)

---

References

• Best AI Agent SaaS Ideas — Fintech/Healthtech (buildmvpfast.com)
• FINRA Rules Guidance
• HHS HIPAA Security Rule
• SEC Cybersecurity Disclosure Rules
• EU AI Act
• Spring Boot 4.0 Reference
• Spring Security 7 Reference
• JJWT 0.12.x Documentation