Dashboard sorted by job
Dashboard sorted by status
An example of a flagged request
An example of a flagged request
An example of a request missing data
Example checklist output
Example secondary validation requirement
Security vulnerability guarantee
Upload Portal
Example manual file upload
Request Logs
Raspberry Pi Manual Request Approval
Mobile UI

Inspiration

A family friend complained that software for general contractors costs too much and saves too little. After Procore's price tripled, it cost more than it saved, and his crew spent more time entering data than building. Then we heard about a \$1.5 million near-miss: a scammer posing as a subcontractor emailed from a fake domain with a capital I in place of a lowercase l. We wanted to give contractors their time back without giving scammers an opening.

What it does

Every month, each subcontractor on a construction job sends the general contractor (GC) a bill for the work they've done, along with paperwork like lien releases and insurance certificates. Someone has to check all of it by hand before paying, and one mistake can mean paying for unfinished work, paying twice, or paying a scammer.

Draw is an AI clerk that does that checking. Subs email their paperwork and site videos to an inbox. Draw reads everything and sorts each bill into one of three outcomes:

Ready: everything checks out, so Draw pays it.
Needs your OK: it looks fine but is large (over \$25K by default) or the AI isn't sure about it, so the GC's owner approves it by pressing a physical button.
On hold: something is wrong. Draw explains what in plain English and suggests the next step.

Why GCs want it:

Time back. About 63% of an honest month pays out automatically, and the owner approves fewer than two payments per job per month.
Catches what people miss. Lookalike email domains, resubmitted bills, billing for work the site video doesn't show, missing lien releases.
Nothing new for subs. They keep emailing their paperwork as usual.

Why not just use AI?

A general AI agent can be talked into paying a scammer, misread a number, or sound sure when it's guessing. Draw is built so the AI can be wrong without the money going wrong:

AI advises, code decides. Claude reads the documents and Jev (from TypeSafe) scores the risk, but 15 fixed rules make the call, and all money math is done in code.
Proven, not just tested. Z3 mathematically proves that, for the bill sizes we modeled, no bill passing our payment rules can overpay the contract or the site video. It also exposed two double-payment bugs our tests missed.
Knows when it's unsure. Jev's confidence is calibrated, so doubtful payments, and any over \$25K, need a button press on a Raspberry Pi key on the owner's desk.
Checks the real world. Draw asks the bank (Capital One's Nessie) whether a bill was already paid and whether the owner's money arrived, and verifies each new sub's identity with TransUnion through CRS.
Accountable. Every decision goes into a log that can't be edited.

How we built it

A Python (FastAPI) backend and a Next.js dashboard on Vercel, with Neon Postgres for the log. Emails arrive through Postmark. Draw reads PDFs with code wherever it can and uses Claude for scans, site video, and spotting suspicious emails. To test it, we built an attacker: a fuzzer that automatically turns honest bills into attacks, plus 61 attacks written separately by Google Gemini so we weren't only grading ourselves.

Challenges we ran into

Jev can't read images or video, so we route site video to Claude instead.
Our own attacker kept finding holes. Early on, the rules stopped only 43% of attacks, and the attacks we wrote by hand kept knocking the number back down until we fixed the rules.
At one point the owner could approve \$1.00 and the system would pay \$105,564.60. That's now impossible, and a test makes sure it stays that way.

Accomplishments that we're proud of

We threw 1,634 attacks at Draw:

Metric	Result
Attacks stopped	99.6%
Honest bills wrongly blocked	0 of 427
Money protected	\$86.8M (on test data)

The 6 attacks that slipped through were all small edge cases from the Gemini set, each under \$25K. And the owner barely has to lift a finger: about 1.8 button presses per job per month.