-
-
Architecture Diagram
-
Landing Page
-
Department Dashboard
-
Complaince Hub Chatbot
Inspiration
Every enterprise has the same onboarding bottleneck: someone uploads a blurry photo of their driver's license, an HR admin manually reads it, types the data somewhere, and three days later the new hire still can't log into SAP. We asked — why is a human doing this? Government IDs are structured documents. The data is already there. Compliance Hub was built to eliminate that gap entirely: scan a license, get a compliance decision, provision access automatically.
What it does
Compliance Hub is an enterprise identity verification layer that turns physical ID documents into structured, audit-ready data to drive SAP provisioning and compliance automation.
Scan any government ID — Employees upload a driver's license, passport, or national ID; AI extracts every field automatically.
Verify against government databases — Extracted data is cross-checked against DMV, Passport Authority, and National ID registries with name matching, DOB validation, and expiry checks.
Compute real-time compliance gaps — Each employee's verified documents are matched against their department's required document checklist, producing a live compliance score.
Gate access decisions — Employees with mandatory document gaps are flagged and blocked from provisioning until compliant.
Department-level dashboards — HR and compliance teams see every employee's status, what's fulfilled, what's missing, and who needs follow-up across all departments in one unified view.
How we built it
FastAPI backend orchestration — Manages the full pipeline: upload → AI extract → government verify → store → compliance recalculation.
Azure OpenAI GPT-4.1-mini for OCR — Handles vision-based extraction, reading raw ID images and returning structured JSON with name, DOB, document number, address, and document type.
Sanity Content Lake — Stores all structured data using a GROQ-powered reference graph: employee → department → requiredDocuments → verifiedDocuments. This enables real-time compliance gap queries in a single traversal.
Custom government verification engine — Simulates DMV and Passport Authority lookups with format validation, fuzzy name matching, DOB cross-reference, expiry checks, and returns a per-document confidence score with full audit trail.
Python + httpx with session management — Supports the multi-step human-review flow between extraction and storage while keeping the API itself stateless.
Challenges we ran into
Fuzzy name matching across government records — Names appear in wildly different formats (e.g., CONNOR M SAMPLE JR, Alice Johnson, PETROVA ELENA). We built a token-normalized overlap matcher handling suffixes, middle initials, and name reordering without producing false negatives that would wrongly block legitimate employees.
Designing the Sanity schema for compliance traversal — Modeling requiredDocuments as references (not embedded objects) was the key architectural decision. It allows requirements to be updated centrally and automatically recalculates compliance for every employee. Getting the nested GROQ projections correct across three reference levels required significant iteration.
Multi-step verification sessions — The upload → human review → government check → store flow is inherently stateful. We built an in-memory session layer to hold extracted fields, identity match results, and requirement mappings between steps.
Identity mismatch enforcement — The system must reject documents where the extracted name doesn’t match the employee on record, but cannot be so strict that minor OCR imperfections trigger false blocks. Tuning this threshold was a major challenge.
Accomplishments that we're proud of
A single GROQ query that traverses employee → department → requirements → verified documents and returns a complete compliance gap report: fulfilled requirements, missing requirements, mandatory gaps, percentage score, and linked document metadata.
Full audit trail per document — every verification decision includes checks passed, checks failed, confidence score, government reference ID, and timestamp, making it ready for regulatory review.
End-to-end pipeline in seconds — from image upload to updated compliance dashboard, including government verification, identity matching, and Sanity storage in a single request cycle.
What we learned
Sanity's reference model is the right fit for compliance data. Decoupling requirements from employees means a single schema change propagates automatically across the organization.
Vision models require strict output contracts. GPT-4.1-mini performs reliably only when the prompt enforces JSON-only output with no markdown, no explanation, and explicit fallback values. Prompt discipline matters more than model capability.
Simulating government APIs first was the correct architectural move. It allowed us to design the verification UX and data model fully before integrating with real external systems.
What's next for Compliance Hub
Live SAP provisioning gate — Directly block or grant SAP role assignments based on real-time compliance status via SAP Identity Management or SAP BTP integration.
Real government API integrations — Connect to AAMVA (DMV network) and identity verification providers like Persona or Stripe Identity.
Document expiry tracking — Automated alerts when documents approach expiration, preventing compliance lapses.
Immutable audit log — Append-only records of every access decision, verification result, and compliance state change to support SOC 2 and regulatory audits.
SSO and HRMS integration — Sync employee and department structure from Workday, BambooHR, or Azure AD to eliminate manual onboarding setup.
Log in or sign up for Devpost to join the conversation.