Skip to content

Sovereign

A self-hosted platform that audits contracts against GDPR, HIPAA and SOC 2 and returns cited, severity-ranked risk reports — with inference running on the customer's own GPUs, so no document leaves their network.

Open sovereign-compliance.vercel.app

Architecture, retrieval pipeline and full-stack build

3

Frameworks audited: GDPR, HIPAA and SOC 2

Private

Inference on the customer's own AMD GPUs

Cited

Every finding points back to the clause it came from

What made it hard

A compliance team cannot paste a contract into a hosted model, because the document is the confidential thing. Sovereign had to do the work without the data leaving the building, and produce findings a lawyer would accept — which means no risk can be raised without the clause that supports it.

How it was built

  1. 01

    Retrieval over the regulation, not just the contract

    GDPR, HIPAA and SOC 2 chunked and indexed so a contract clause can be matched against the specific obligation it engages, rather than against a general summary of the law.

  2. 02

    Citations as a hard requirement

    The pipeline will not surface a finding it cannot attach to a source clause. That constraint is what makes the report usable as evidence instead of merely suggestive.

  3. 03

    Severity ranking

    Findings ordered by exposure, so a reviewer reads the three that matter before the thirty that do not. An unranked list of risks is a way of hiding the important ones.

  4. 04

    Private inference

    LLM orchestration against self-hosted inference on the customer's own AMD GPUs. The privacy guarantee is architectural rather than contractual — the documents never have anywhere else to go.

What it does

  • Contract ingestion
  • GDPR, HIPAA and SOC 2 audits
  • Retrieval-augmented analysis
  • Cited findings
  • Severity-ranked reports
  • Self-hosted deployment
More work

Other things we've shipped.

AI productivity platform

Montlify

One workspace holding 33+ AI tools for writing, research and chat, with the accounts, subscriptions and infrastructure needed to keep them all running.

  • React
  • LLM APIs
  • Streaming
  • Authentication

E-commerce platform

Agento Wear

A production storefront built from nothing: catalogue, guest checkout, payments, order processing, automated email and an admin dashboard the owner runs without an engineer on call.

  • Next.js
  • React
  • Supabase
  • Payments

Have something like this in mind?

A short call, then a written scope with a fixed price and a date. Scoping costs nothing and the document is yours either way.

Scope a project

Replies within one business day