Audit IQ

AI agents that find money your vendors are quietly taking — and flag GDPR/KVKK/CCPA gaps. Upload 3 docs, get a full audit + ready-to-send letters in 30 seconds.

Comment

Inspiration

Every month, small businesses sign contracts and pay invoices — and nobody checks if the numbers actually match, or whether their privacy policy is even legally compliant. The people who suffer most are the ones who can least afford it: a lawyer to catch these issues costs thousands, and a single GDPR fine can reach millions. We wanted to give small businesses the one thing they never get — a CFO and a compliance officer, on demand, in 30 seconds.

What it does

AuditIQ audits a company's contracts, invoices, and privacy policies together and surfaces both financial and legal risk in a single report.

  • Compares invoices against contracts line by line to catch silent overcharges
  • Checks documents against GDPR, KVKK, and CCPA — auto-detected from the document content, no manual setup
  • Finds cross-risks: a single vendor that is both overcharging you and missing a required data agreement — a connection no single-document checker can see
  • Drafts ready-to-send objection letters citing the exact contract clause and invoice line
  • Produces a permanent, shareable report link for your CFO or legal team

In our demo, AuditIQ catches $944/month ($11,328/year) in overcharges, five GDPR gaps, and one cross-risk — in under 30 seconds.

How we built it

AuditIQ is a five-agent pipeline built on Google ADK, with each agent running on Gemini:

  1. PII Masking — strips IBANs, tax IDs, and phone numbers before any document reaches the model, so the AI never sees raw personal data
  2. Extractor — pulls structured data from all three documents
  3. Leak Auditor ∥ Compliance Guard — run in parallel; one compares invoice vs. contract, the other checks regulatory compliance
  4. Cross-Risk Synthesizer — correlates financial and legal findings to surface hidden combined risk
  5. Action Drafter — generates the objection letters

The frontend is Next.js + Tailwind on Vercel, streaming live agent progress over SSE. The backend is Python + FastAPI on Cloud Run, with Firestore for persistent, shareable reports. We used a feature-based architecture with centralized config and a strict per-file size limit to keep the multi-agent codebase maintainable.

Challenges we ran into

  • PII before the model, not after. Masking sensitive data before it ever reaches Gemini — rather than filtering the output — meant rethinking the pipeline order so the guarantee actually holds.
  • Parallel agents without race conditions. Running the Leak Auditor and Compliance Guard concurrently while keeping their outputs synchronized for the Synthesizer took careful state handling.
  • Streaming the pipeline honestly. Getting SSE to reflect real per-agent progress — not a fake progress bar — while five agents run took real work on both ends.
  • Cross-risk without false positives. Correlating financial and legal findings is only useful if the links are real. Tuning the Synthesizer to surface genuine cross-risks instead of noise was the hardest part.

Accomplishments that we're proud of

  • The Cross-Risk Synthesizer — reasoning across documents instead of auditing them in isolation is what makes AuditIQ more than a checklist.
  • A privacy-first design where the model provably never sees raw PII.
  • A full multi-agent system — five agents, parallel execution, live streaming, persistent reports — deployed end to end and working on real inputs.
  • Auto-detection of GDPR / KVKK / CCPA from document content, with no manual configuration.

What we learned

  • Multi-agent systems win when agents combine their findings, not just when there are more of them. The value was in the synthesis layer.
  • Privacy constraints are architectural decisions, not features you bolt on later.
  • Google ADK made orchestrating and reasoning across parallel Gemini agents far more tractable than wiring it by hand.

What's next for AuditIQ

  • More jurisdictions — the architecture is modular, so a new regulation is a new compliance module (HIPAA, SOC 2, PCI-DSS)
  • Direct integrations with accounting and contract-management tools to run audits automatically
  • Historical tracking so businesses can see risk trends over time
  • Team workspaces with role-based access for finance and legal

Built With

Share this project:

Updates