Why we build this
Move fast.
Respect people anyway.
The received wisdom is that these pull against each other: that European rules are a tax on building, and that moving quickly means cutting corners on the rights the rules exist to protect. Founders are told to pick one.
We think that framing is the actual problem. It produces companies that ship slowly because they are afraid, and companies that ship quickly because they never looked. Neither is good for the people whose data is in the system.
What is missing is not more regulation or less of it. It is infrastructure: something that holds the regulatory surface for you, continuously, so that respecting people costs a founder attention rather than months. That is the whole reason this exists.
The bet
Compliance as infrastructure, not as a brake.
Nobody rebuilds TLS to ship a web app. It is handled, it is shared, and the work happens on top of it. The regulatory surface should sit in the same place: solved once, in the open, and maintained by everyone who depends on it.
That is why the whole engine is public under AGPL-3.0 rather than sold as a black box. A moat around compliance plumbing would slow down exactly the companies we want moving faster.
Responsible AI
The standard we measure you against, applied to us.
These are the widely agreed principles for responsible AI. Each one here is paired with the mechanism behind it, because a principle with nothing enforcing it is a poster. Every mechanism named is in the repository and you can go and check it.
- Fairness
- Systems should treat people equitably and work to reduce bias rather than encode it.
- Findings are derived from the regulation and your own answers, never from inferred characteristics of the people in your records. The detectors are deterministic SQL you can read.
- Reliability and safety
- Technology should perform dependably across its lifecycle without causing harm.
- An LLM drafts each finding and a deterministic critic rejects it if the proposed action is vague or non-imperative, regenerating until it passes. Nothing reaches you unchecked.
- Privacy and security
- Personal data should be protected by governance and engineering, not by promises.
- Tenant isolation is enforced in the database by row-level security, not only in application code. You can also self-host the whole thing, so your records never leave your infrastructure.
- Transparency and explainability
- People should understand when they are interacting with AI and how a decision was reached.
- Every finding cites the specific article it rests on and links the source text. The prompts, the critic rules and the detectors are all in a public repository under AGPL-3.0.
- Inclusiveness
- Tools should widen access rather than concentrate it among those who can already afford help.
- Making the whole system readable and self-hostable means a two-person team gets the same engine as a company with a legal department, and neither is locked into us to keep it.
- Accountability
- Humans remain responsible for the outcomes and governance of an AI system.
- The Executor never acts on its own. Every irreversible step waits on an explicit human approval and writes an immutable audit row with a timestamp and an actor.
