Compliance Automation Architecture¶

The Studio Platform implements a background automation system to ensure compliance tasks and project deadlines are never missed. This system integrates AI extraction, persistent background monitoring, and real-time notification delivery.

🧱 Component Overview¶

1. AI Extraction Engine (AnalysisService)¶

When evidence is uploaded, the AI service performs "Super Extraction": - Date Identification: Extracts dates like "Last Pentest Date" or "Policy Approval Date". - Period Detection: Identifies required frequencies (e.g., Annual, Quarterly). - Task Generation: Automatically creates ComplianceTask records in the database with calculated dueDate based on the extraction.

2. Deadline Checker Worker¶

A standalone background process (DeadlineChecker) runs every hour: - Scan: Iterates through all OPEN projects and compliance tasks. - Calculate: Determines if a task is within the 7-day warning window or the 1-day urgent window. - Deduplicate: Checks the notifications table to ensure a user hasn't already received an alert for this specific task in the last 23 hours.

3. Notification Delivery (NotificationService)¶

Handles the multi-channel push of alerts: - Database: Stores the alert for persistence in the UI. - WebSockets: Emits a new_notification event to the user's personal room for immediate UI updates. - Push Notifications: Sends a PWA push notification to the user's registered devices.

🔄 Workflow Diagram¶

sequenceDiagram
    participant User
    participant AI as AI Analysis Service
    participant DB as Database
    participant DC as Deadline Checker (Worker)
    participant NS as Notification Service
    participant UI as Frontend Dashboard

    User->>UI: Upload Evidence (e.g. Pentest)
    UI->>AI: Analyze Document
    AI->>DB: Create ComplianceTask (Due +365 days)

    Note over DC: Runs Hourly
    DC->>DB: Query Upcoming Tasks (7 days left)
    DC->>NS: Trigger Alert for Customer/Auditor
    NS->>DB: Save Notification
    NS->>UI: WebSocket: 'new_notification'
    UI->>User: Display Toast + Bell Icon Update

⚙️ Configuration¶

👥 Role-Based Delivery Logic¶

The system strictly routes notifications to ensure relevance: - Customers: Receive implementation alerts (e.g., "Complete your Access Review"). - Auditors: Receive oversight alerts (e.g., "Assigned Project deadline approaching"). - Admins: Specifically excluded from deadline alerts to focus on system-wide orchestration.