Compliance Radar
AI-powered compliance evaluation — audit systems and processes against regulatory frameworks (GDPR, ISO 27001, HIPAA, PCI-DSS) using a two-phase gate-and-score pipeline.
Overview
Compliance Radar is TotalApp's AI-powered compliance audit screen inside the Security module. It evaluates systems, processes, or documents against established regulatory frameworks — GDPR, ISO 27001, HIPAA, PCI-DSS, or custom internal policies — and produces a scored, reasoned audit result with a clear Compliant / Non-Compliant verdict.
The screen is built on the MatrixEngine framework: a two-phase AI pipeline that first enforces hard mandatory controls (gates), then runs a nuanced weighted scoring analysis across defined compliance categories. Results are stored per compliance item and displayed in the main table with score badges, status labels, and a timestamp of the last analysis run.
Two-Phase AI Pipeline
Phase 1 is a strict Linter (Gatekeeper) — if a single Must-Have control is absent or unverifiable in the provided evidence, the score is immediately zeroed and the status is set to Non-Compliant. Phase 2 does not run. Phase 2 is a nuanced Critic that scores the evidence against weighted categories. This design ensures that a system with excellent logging scores but no encryption-at-rest can never be marked Compliant — the gate enforces that invariant regardless of how the weights are configured.
Quick Start
- Switch to Security mode in the header.
- Open Compliance Radar from the left sidebar (ShieldCheck icon).
- Click Add Item → enter a name (e.g. "Production Database — GDPR Audit"), select the regulation type, add any initial notes → Save.
- Configure the Evaluation Rules in the accordion at the top — set your threshold, adjust category weights, and add Must-Have controls relevant to the chosen regulation.
- Click the item row to open the Report Panel on the right.
- Paste audit evidence into the content sandbox — server configuration dumps, policy document text, security review notes, penetration test summaries, access control logs, or any other authoritative evidence.
- Click Analyze — the AI runs Phase 1 (gate check) then Phase 2 (weighted scoring).
- The item row updates immediately: score badge, Compliant / Non-Compliant status, and analysis timestamp.
Regulation Types
When adding a compliance item, you select its regulation type. This provides contextual calibration for the AI's interpretation of the evidence.
| Type | Typical use |
|---|---|
| GDPR | EU personal data processing systems — data subject rights, DPA appointment, lawful basis documentation, data transfers outside EEA. |
| ISO 27001 | Information security management systems — ISMS scope, risk assessment, control implementation, continual improvement evidence. |
| HIPAA | US healthcare data systems — PHI safeguards, access controls, audit controls, transmission security, business associate agreements. |
| PCI-DSS | Payment card data environments — cardholder data protection, network segmentation, vulnerability management, access control, logging. |
| Custom | Internal policy frameworks or mixed-regulation environments. Provides the AI with the least contextual calibration — compensate with detailed Must-Have gates. |
The regulation type is informational — it appears in the table column and is passed to the AI as context to calibrate its interpretation of the evidence. Your Must-Have tags remain the actual gate criteria regardless of the selected type.
Evaluation Pipeline
Phase 1 — Linter (Gatekeeper)
The AI strictly checks every Must-Have control against the raw content. If any single Must-Have is absent or cannot be verified from the evidence provided, the result is immediate: passed_gate = false, total_score = 0, status = Non-Compliant. Phase 2 does not run. The Missing Gates list in the Report Panel identifies exactly which controls triggered the failure.
Phase 2 — Critic (Scoring)
Only runs if Phase 1 passes. The AI scores the content against each weighted category from 0–100, providing reasoning text for each score explaining what evidence was found, what was absent, and how confident the assessment is.
Phase 3 — Math
The final score is calculated as: total_score = Σ (raw_score × weight / 100), capped at 100 and rounded to an integer. If total_score ≥ threshold, the status is Compliant; otherwise Non-Compliant.
Why Gating Before Scoring?
A system with excellent logging scores but missing encryption-at-rest cannot be Compliant under most regulatory frameworks. The gate enforces this invariant regardless of how the weights are configured — a 95/100 logging score does not compensate for absent encryption. This mirrors how real regulatory audits work: certain controls are binary pass/fail preconditions, not factors to be averaged away.
Evaluation Rules Panel
The accordion at the top of the screen controls all evaluation rules. Changes apply to the next analysis run only — existing results are not retroactively updated when rules change.
| Control | What it does |
|---|---|
| Threshold slider | Minimum score to mark the item Compliant. Default: 70. Regulatory contexts often warrant 80 or higher — adjust to match your organisation's compliance posture. |
| Weight inputs | Per-category percentage allocation. Must sum to 100 (a warning badge appears in the header if they do not). Adjust to emphasise the categories most relevant to your regulation type. |
| Must-Have tags | Hard gate controls — type a control description and press Enter to add. Each tag is strictly checked in Phase 1. Examples: "AES-256 encryption at rest confirmed", "MFA enforced for all admin accounts", "Audit logs retained ≥ 12 months". |
| Nice-to-Have tags | Soft best-practice hints passed to the AI as context. Not gating — a missing Nice-to-Have lowers the score but does not block Compliant status. Examples: "SOC 2 Type II report available", "Penetration test conducted within the last 12 months". |
Default Scoring Categories
| Category | Default weight | What the AI looks for |
|---|---|---|
| Veri Güvenliği | 50% | Encryption at rest and in transit, data classification policies, data loss prevention (DLP) controls, key management practices. |
| Erişim Kontrolleri | 30% | Role-based access control (RBAC), multi-factor authentication (MFA), least-privilege enforcement, access review records, privileged access management. |
| Loglama Altyapısı | 20% | Audit logging coverage, SIEM integration, log retention periods and policies, alerting on anomalous activity, log integrity controls. |
Score Colours & Status Labels
Emerald — Compliant
total_score ≥ threshold. All Must-Have gates passed and the weighted score met the minimum threshold. The system or process is assessed as compliant with the selected regulatory framework.
Amber — Borderline
total_score ≥ threshold × 0.6 but below threshold. Gates passed but the weighted score fell short. The system shows partial compliance — review the Breakdown Bars to identify the weakest categories.
Rose — Non-Compliant
total_score < threshold × 0.6 or a Must-Have gate failed. The system is not compliant. Check the Missing Gates list in the Report Panel for the specific controls that were absent or unverifiable.
| Status | Meaning |
|---|---|
| pending | Item added, not yet analyzed. No AI evaluation has been run. |
| compliant | Phase 1 gate passed and total_score ≥ threshold. Displayed in emerald. |
| non-compliant | Phase 1 gate failed, or total_score < threshold. Displayed in rose or amber depending on the score. |
Report Panel
Click any compliance item row to open the right-side Report Panel. It contains five sections:
Gate Banner
Green (Compliant) or red (Non-Compliant) banner displayed prominently at the top of the panel, alongside the total score. Gives an at-a-glance verdict before reading any detail.
Missing Gates
Shown only on gate failure. Lists exactly which Must-Have controls were absent or could not be verified from the provided content. Use this list as your remediation checklist — each item is a specific, actionable gap.
Executive Summary
One-paragraph AI verdict summarising the overall compliance posture, the most significant findings, and the primary gaps that prevent a higher score.
Breakdown Bars
Per-category raw score, weighted contribution to the total, and reasoning text explaining what evidence was found (or missing) for each compliance category.
Content Sandbox
Editable textarea pre-filled with the item's saved notes. Paste new or updated evidence, then click Analyze again. Each run overwrites the previous result — re-run after remediation to confirm improvement.
AI Engine
The analysis uses the Writer Engine setting from Settings → Doc View → Writer Engine:
| Setting | Model used |
|---|---|
| API mode (default) | Anthropic claude-sonnet-4-6 |
| API mode + Cohere | command-r7b-12-2024 |
| Local CLI | claude --print fallback (no API key required) |
Tips
- Be specific in Must-Have gates. "Encryption enabled" is too vague — use "AES-256 encryption at rest confirmed" or "TLS 1.2+ enforced on all API endpoints". The AI is a strict linter and will not infer intent from ambiguous phrasing.
- Paste the most authoritative evidence available. A configuration file export, a security review PDF pasted as text, or a penetration test summary produces far more accurate results than a brief internal note. The AI will not infer controls that are not explicitly stated in the content.
- Re-analyze after remediation. Update the content sandbox with new evidence (updated configuration, new audit report section, etc.) and click Analyze. The previous result is overwritten — run analysis again to confirm the remediation raised the score.
- Use the Missing Gates list as a remediation checklist. Each item in the list is the specific control the AI could not verify. Send it to the system owner or security team as a concrete list of what evidence needs to be provided or what controls need to be implemented.
- Raise the threshold for high-stakes regulatory contexts. The default threshold of 70 is a starting point. For production systems under GDPR or HIPAA, consider setting the threshold to 80 or 85 to ensure a more rigorous standard.
Content Limit
Raw content is truncated to 4,000 characters before being sent to the AI. For long policy documents or configuration files, paste only the most relevant sections — the access control chapter, the logging configuration block, the encryption settings section, etc. Do not paste entire multi-page documents, as the most critical evidence may be cut off.
Limitations
- The AI evaluates only what is explicitly present in the pasted content. It does not query live systems, scan network configurations, connect to external APIs, or verify controls against a real environment. Evidence must be provided in the content sandbox.
- Compliance Radar produces an AI-assisted assessment, not a certified regulatory audit. Results should be reviewed by a qualified compliance professional before being used for regulatory submissions, certification applications, or client-facing compliance reports.
- The Custom regulation type gives the AI the least contextual calibration. Compensate by providing detailed, explicit Must-Have gates and Nice-to-Have items that describe your internal policy requirements precisely.
- Results reflect the evidence provided at the time of analysis. A system's compliance posture can change after an analysis run — re-analyze periodically, especially after infrastructure changes, access control updates, or new audit findings.