Exetazo

A legal security scanner for the web. Exetazo reads the fine print, flags risky clauses, and shows you the exact sentence that triggered each finding.

Comment

Inspiration

Legal documents are everywhere, but most people have no practical way to understand the risks hidden inside them before they agree.

We were inspired by the way security tools analyze smart contracts: instead of asking whether a contract is simply "good" or "bad," they identify specific vulnerabilities, explain their severity, and show exactly where the problem exists.

We wanted to bring that same security mindset to legal documents.

That became Exetazo (greek: ἐξετάζω), Legal security before you agree.

What it does

Exetazo is a browser-based legal security scanner that analyzes the legal text on a webpage and identifies potentially risky clauses.

Instead of giving users a generic AI-generated summary, Exetazo produces a structured security report with:

  • A Legal Security Score
  • Severity levels
  • Clause-level findings
  • Plain-English explanations
  • Evidence from the original document
  • Links back to the relevant clause

It currently focuses on risks commonly found in Terms of Service, Terms & Conditions, Privacy Policies, and subscription/service agreements.

Examples include unilateral changes, mandatory arbitration, class-action waivers, automatic renewal, difficult cancellation, broad liability limitations, indemnification, data-sharing permissions, termination rights, jurisdiction requirements, hidden fees, broad content ownership, and contradictory clauses.

How we built it

Exetazo is an extension backed by a TypeScript analysis server.

The browser extension extracts legal text from the current webpage and sends it to the analysis pipeline. The backend detects relevant clauses, evaluates them against structured legal-risk rules, produces findings, calculates the security score, and uses AI where semantic analysis or plain-English explanation is useful.

A key design decision was separating AI analysis from the final score.

The AI can help understand messy legal language, but it does not get to arbitrarily decide whether a document receives a high or low score. Score-affecting findings pass through deterministic rules so the same document can produce a consistent security score.

Privacy (Privacy Track)

Stateless backend. No database, no cache, no analytics. The server logs one line at startup and nothing else; document text exists in memory for the duration of one request.

The hosted API runs rules-only, no third-party service ever receives content. Self-hosted semantic mode (operator opt-in) sends at most 80 paragraphs of 500 characters to the operator-configured provider.

The extension stores exactly one thing: the most recent report, structured findings, not page text, in session storage, which clears when the browser closes. No accounts, no sign-up, no tracking, no telemetry. The landing page makes exactly one third-party request (a webfont), disclosed in its privacy policy.

Secrets stay in server environment variables. The extension ships no credentials. Production builds narrow host_permissions to a single API origin, and the build fails on any non-HTTPS origin other than loopback. Page text is untrusted data: never executed, never rendered as markup, enforced and tested with hostile-string injections through extraction, highlighting, and rendering.

What we learned

The hardest part was not getting an LLM to identify suspicious text. The hard part was making the result useful and trustworthy.

Legal documents contain long sections, nested clauses, exceptions, definitions, cross-references, and language that can change meaning depending on context. A useful scanner therefore needs to connect an abstract finding back to the actual clause that caused it.

We also learned that AI should not be treated as the source of truth for everything. For a security-oriented product, reproducibility and traceability matter. That led us toward a hybrid architecture where deterministic rules control scoring while AI assists with semantic interpretation and explanations.

Challenges

The biggest challenges were:

  1. Extracting meaningful legal text from arbitrary webpages without treating the entire page as a document.
  2. Detecting risks when the same legal concept is written in many different ways.
  3. Preventing duplicate or noisy findings.
  4. Connecting findings back to the exact source clause.
  5. Keeping scoring deterministic while still benefiting from AI.
  6. Making the browser extension work against real public legal pages rather than a controlled demo.

Accomplishments

Everything is live: landing page, production API with a health route, and the Firefox add-on published on AMO at https://addons.mozilla.org/en-US/firefox/addon/exetazo/ with zero web-ext lint errors, warnings, or notices.

Landing page: https://www.exetazo.xyz (privacy policy: https://www.exetazo.xyz/privacy) Live API: https://api.exetazo.xyz/api/health

A score users can trust mechanically: identical inputs always produce identical scores — enforced in code, proven by tests, reproducible by anyone.

15 categories with evidence on every finding and click-to-highlight on the live page. Everything shipped from a phone.

What's next

We want Exetazo to expand beyond basic clause detection into deeper legal-security analysis, including stronger contradiction detection, better document structure understanding, jurisdiction-aware analysis, and broader coverage of legal risk patterns.

The goal is simple: make reading the fine print feel more like running a security scan than blindly clicking "I Agree."

Built With

Share this project:

Updates

Submission history