How it works.

Each scan runs in two passes. The first pass is deterministic. We parse your code, read your dependency manifests, and check your product surfaces for specific patterns: a cookie banner that sets non-essential cookies before consent, a checkout button without the required wording, a missing cancellation flow. The output is a list of factual observations about what the code does.

The second pass uses a language model, but in a narrow way. For each structured requirement, we pass a small set of relevant code snippets and ask a single question with a fixed answer space (yes, no, or insufficient context). The model works against the testable form of the requirement and returns a finding only when it can cite the article and paragraph it relates to.

Every finding has a confidence score. High confidence comes from a deterministic match and goes straight to the board. Medium confidence is reviewed by an analyst on our team before delivery. Low confidence is held back and only released after a human upgrades or discards it.

Every regulation we track is listed here with a link to the primary source: EUR-Lex, the national gazette, or the official government publication. Not blog posts. Not LLM training data. Not secondary summaries.

This list is fully public. If you're evaluating us, copy it, send it to your counsel, and verify any entry directly at the source.

Daily. Automated polling of regulatory databases and gazettes for new publications, amendments, and implementing acts. Diffs are queued for analyst triage within the same day.

Weekly. Our team reviews every diff, classifies the change, updates affected structured requirements, and re-evaluates rules that depend on them.

Monthly. A deep review of upcoming regulations, trilogues, draft acts, and regulator guidance. This is what feeds the 12-month forward-looking horizon you see on the board.

When something changes, customers on monitoring plans get a notification with the specific impact on their product, not a generic "the regulation moved" email.

We decompose every regulation into machine-readable requirements with a clear pass/fail condition. That is what the scanner evaluates. Not the prose. Not a summary.

Here is what that looks like for one well-known example: the German Buttonlösung (§ 312j BGB), which requires that any button on a paid order page makes the payment obligation unambiguous to the user.

We are in early audits. The dataset is not yet big enough for a number we'd be comfortable publishing, and we'd rather say that than invent one. We will publish the aggregate false positive rate on this page the moment it becomes statistically meaningful.

Every disputed finding is reviewed by an analyst. If the dispute is right, the rule is refined, the structured requirement is updated, and the change ships into the next scan for every customer. The product gets sharper with every audit.

You can dispute a finding directly from the board. We respond within one business day with a verdict and, if we changed the rule, a diff of what changed and why.

We do not give legal opinions. We do not guarantee compliance. We do not replace your lawyer, your DPO, or your local counsel.

We surface engineering-actionable findings traceable to primary legal sources, so your team can ship a product that stands a fair chance of passing the audit your lawyer eventually runs.

For formal legal opinions, retain qualified counsel in the jurisdiction. We can recommend several we trust.