compliance copilot

Inspiration

Professional documents (invoices, contracts, forms) must often be extracted, validated, and archived in regulated contexts. Automated extraction alone isn't trustworthy without traceability: you need to know which fields are reliable, which require human intervention, and be able to prove afterward that nothing was altered. A wave of new document-compliance mandates is landing right now, which made this the right moment to build a pipeline that treats trust as a first-class output, not an afterthought.

What it does

Compliance Copilot is a six-step pipeline that processes a document, automatically decides what can be validated without intervention, traces every human correction, consolidates a final document, then generates and verifies a cryptographic integrity proof.

1. Extraction (Nutrient DWS Data Extraction API) → extracted fields + confidence score per field
2. Confidence-based triage (threshold 0.90) → AUTO_VALIDATED if confidence ≥ 0.90, otherwise NEEDS_HUMAN_REVIEW
3. Human review (simulated for this demo) → traced decision for each low-confidence field
4. Final document consolidation → retained value per field + source (AUTO or HUMAN) + full traceability
5. Deterministic audit proof → SHA-256 of each artifact + reproducible chain hash
6. Independent proof verification → recomputes hashes, detects any tampering

Important distinction: VERIFIED in step 6 means the integrity of the referenced artifacts is confirmed — it does not mean all underlying data is real. Steps 3/4 (human review) run on an explicitly synthetic test case, clearly marked as such in the data (synthetic: true), separate from the real DWS extraction in steps 1/2.

How we built it

Each step is a standalone Node.js script with a single responsibility, orchestrated by a thin demo.js entry point that runs the full chain and prints a labeled summary (REAL / SYNTHETIC / INTEGRITY) — no business logic duplicated in the orchestrator itself.

Step 1 makes a real call to the Nutrient DWS Data Extraction API to read an invoice PDF and extract structured fields (invoice number, supplier, total amount, date) with a confidence score per field. This confidence score is the data point that directly drives step 2 — automatic validation vs. human review — the distinction wouldn't exist without it. DWS isn't an isolated peripheral call — it's the data source that structures the entire downstream decision chain.

Steps 5 and 6 use only native Node.js modules (fs, crypto) — no external dependency, no network call — to hash each artifact with SHA-256 and chain those hashes into a single reproducible integrity proof.

Challenges we ran into

• Keeping a clear boundary between real data (steps 1-2, live DWS calls) and the synthetic human-review scenario (steps 3-4), so the demo never implies a real human reviewed anything
• Making sure the integrity proof (steps 5-6) is understood for what it actually verifies — file integrity, not data authenticity — which required explicit wording throughout the code, the README, and the demo narration
• Building and testing the full pipeline entirely from a mobile phone terminal (SSH into a remote dev environment), with no desktop access at any point

Accomplishments that we're proud of

• A working, reproducible six-step pipeline with a real Nutrient DWS extraction at its core
• A deterministic, independently-verifiable audit proof (SHA-256 + chain hash) that was actually tested against deliberate tampering — confirmed to correctly detect mismatches (MISMATCH / FAILED) before restoring the true, verified result (VERIFIED)
• A single orchestrator script (demo.js) that runs the entire pipeline end-to-end without duplicating any of the existing business logic
• Clear, honest labeling of what's real vs. synthetic vs. cryptographic proof — both in the code and in the demo video

What we learned

That an audit trail is only as trustworthy as the distinctions it's willing to make explicit. It would have been easy to let a green "VERIFIED" status imply more than it actually proves — instead, the project treats that honesty as part of the deliverable, not an afterthought.

Note on narration language

The demo video narration is in French. Key points are summarized in English below — the pipeline logs themselves display in English throughout the demo.

RUN01–RUN02 [REAL]: real extraction via the Nutrient DWS Data Extraction API, followed by automatic confidence-based triage (threshold 0.90).

RUN03–RUN04 [SYNTHETIC]: a human review step, explicitly simulated on a synthetic test case (flagged "synthetic: true" in the data) — not a live human operator.

RUN05–RUN06 [INTEGRITY]: a deterministic cryptographic proof — SHA-256 hash of each artifact, combined into a chain hash, independently recomputed and verified.

Important: "VERIFIED" confirms the integrity of the four referenced artifacts — it does not mean all underlying data is real. RUN03/RUN04 remain explicitly synthetic, separate from the real DWS extraction in RUN01/RUN02.

Built With

• git
• javascript
• node.js
• nutrient-dws-api