Inspiration

Modern smart cities are expanding at an unprecedented rate, deploying ubiquitous digital infrastructure designed to optimize urban life. Every single day, municipalities collect and process billions of high-sensitivity data points through public Wi-Fi tracking nodes, smart utility sensors, real-time traffic telemetry, and high-resolution AI-driven facial recognition camera grids. However, as urban surveillance scales exponentially, compliance with digital rights, GDPR frameworks, and municipal privacy laws remains entirely broken. Cities are currently flying blind—relying on manual, fragmented oversight models that cannot keep pace with automated data collection. This regulatory lag risks severe privacy infractions, unauthorized public profiling, data retention overreaches, and a profound erosion of public trust between citizens and civic leadership.

We engineered the Civic Surveillance Auditor to solve this exact systemic failure. Our mission is to provide an automated, real-time AI compliance engine that acts as an independent, rigorous digital rights watchdog for modern municipal infrastructure, ensuring technological progress never outpaces fundamental human rights.

What it does

The Civic Surveillance Auditor is a production-grade, full-stack compliance platform that dynamically evaluates live municipal data streams against vectorized legal privacy frameworks. Key features include:

50+ Municipal Data Streams: Administrators can select from over fifty diverse, granular municipal scenarios categorized systematically across public safety, mass transit, smart utilities, and digital telemetry.
Dynamic RAG Compliance Audits: Powered by advanced Google Gemini models, the platform instantly cross-references incoming sensor telemetry with a vectorized database of municipal legal codes and statutory guidelines.
Instant Risk & Severity Classification: Automatically analyses data retention periods, biometric collection practices, and anonymization protocols to flag high-risk violations and output structured legal justifications.
Immutable Audit Trail & Persistence: Every single audit verdict, timestamp, and metadata payload is immutably committed to a persistent SQLite backend database to ensure total legislative and public accountability.
Comprehensive Municipal Management Suite: Features global jurisdiction configurations, officer session tracking, automated breach alert subscriptions, and an integrated contact directory for chief privacy officers and incident response teams.

How we built it

The application utilizes a decoupled, modern architecture optimized for high-speed performance, absolute security, and modular scalability:

Frontend Dashboard: Developed using Next.js (App Router) and Tailwind CSS, featuring a responsive, high-contrast dark-mode interface with custom UI styling, interactive scenario dropdowns, and dynamic modals.
Backend Engine: Powered by a high-performance ** FastAPI ** Python server handling asynchronous requests, API routing, and database transactions cleanly.
AI & Retrieval-Augmented Generation (RAG) Architecture: Built utilizing LangChain and FAISS for fast semantic vector search over municipal legal texts. It integrates Google Gemini models—specifically gemini-3.6-flash for high-speed audit reasoning and text generation, and gemini-embedding-2-preview for high-precision semantic embedding retrieval.
Database & Environment Security: Utilizes SQLite for lightweight, persistent local and cloud audit logging, with strict environment variable management via python-dotenv and GitHub Push Protection protocols to secure all sensitive API credentials.

Challenges we ran into

Handling Complex Legal Vectors: Ensuring that the RAG model accurately mapped specific, highly nuanced municipal sensor inputs (such as SAF-201) to exact statutory constraints (such as Section 102 biometric retention caps) required rigorous prompt engineering and iterative testing of chunk sizes.
Security & Git Hygiene: Navigating early GitHub push rejections caused by hardcoded API credentials taught us the critical importance of secure environment configurations, proper .gitignore management, and clean repository history structuring.
Asynchronous State Synchronization: Keeping the Next.js frontend state cleanly synchronized with asynchronous FastAPI backend audit responses required robust error-handling wrappers and clean data schemas using Pydantic.

What we learned

The immense power of combining structured RAG retrieval with Gemini's high-speed reasoning for real-time regulatory compliance and automated auditing.
The critical importance of defensive coding, robust error handling, and clean repository management during high-pressure hackathon sprints.
How automated auditing can fundamentally reshape the future of ethical smart city governance, bridging the gap between smart city innovation and citizen privacy rights.

What's next for Civic Surveillance Auditor

Scaling the vector database to ingest full national and international privacy frameworks, including comprehensive GDPR and CCPA legislative libraries.
Implementing automated email and webhook notifications for municipal officers and oversight boards the moment high-risk surveillance violations are detected.
Deploying the full stack to production cloud infrastructure (Vercel for frontend hosting and Render for the FastAPI backend) for live public testing and municipal pilot programs.