GuardianAI

Autonomous compliance auditor powered by Gemini 3.7 Flash & Google ADK that scans architecture specs and database schemas for GDPR risks and auto-generates remediation tasks.

Comment

Inspiration

Enterprise cloud architectures face escalating multi-jurisdictional regulatory scrutiny across GDPR, HIPAA, PCI-DSS, CCPA, and regional frameworks like the Hong Kong PDPO. Manual compliance audits of database schemas, API contracts, and storage pipelines are slow, expensive, and prone to human oversight. We built GuardianAI to provide engineering teams, Data Protection Officers (DPOs), and security architects with an autonomous, real-time compliance auditor that rigorously inspects architectural specifications and generates actionable engineering remediation tickets in seconds.

What it does

GuardianAI autonomously analyzes raw database schemas and infrastructure specs against global privacy and security standards (GDPR, HIPAA, PCI-DSS, CCPA, HK-PDPO). Operating through a defense-in-depth hybrid architecture, it first deploys Gemma 4 as an upstream edge scrubber to strip credentials, live cardholder data, and sensitive identifiers. The sanitized payload is then audited by Gemini 3.7 Flash via autonomous parallel tool executions (scan_data_schema, search_regulatory_clauses, generate_remediation_task). GuardianAI returns real-time risk scores, statutory citations, and production-ready remediation code tickets with sub-second repeat latency.

How we built it

  • Edge Sanitization Layer (Gemma 4): Employs gemma-4-31b-it (with bounded 3-second failover to deterministic local regex masking) to scrub credentials, secret keys, and raw identifiers before passing payloads to cloud models.
  • Autonomous Agent Engine (Gemini 3.7 Flash): Powered by Gemini 3.7 Flash utilizing the Google GenAI SDK with zero-thinking budgeting (thinkingBudget: 0) and parallel tool dispatching for ultra-fast, stall-free reasoning and tool orchestration.
  • Instant SHA-256 LRU Cache: Features an in-memory SHA-256 hashing layer that delivers sub-5ms instant responses for unchanged re-audits with a transparent cache verification trace.
  • Frontend & Visualization: Built with React, TypeScript, and Tailwind CSS, providing a real-time tool execution timeline, interactive remediation task boards, and dynamic cross-framework compliance score gauges.
  • Backend & Cloud Infrastructure: Express API service containerized and deployed live on Google Cloud Run with Tier 1 paid API key binding verification.

Challenges we ran into

Balancing multi-standard statutory rigor with high execution speed and predictability. We solved upstream model latency variances by enforcing a 3-second deadline on Gemma 4 scrubbing, a 12-second abort timeout per Gemini agent roundtrip, zero-thinking budget caps, and a deterministic SHA-256 caching layer to eliminate redundant re-runs while guaranteeing 100% uptime and sub-15-second cold execution.

Accomplishments that we're proud of

  • Engineering a zero-trust hybrid architecture bridging open-weight edge sanitization (Gemma 4) with cloud frontier agents (Gemini 3.7 Flash).
  • Expanding from single-statute audits into a comprehensive multi-framework regulatory suite supporting GDPR, HIPAA, PCI-DSS, CCPA, and HK-PDPO.
  • Achieving deterministic, ultra-low latency execution: under 15 seconds on cold audits and under 5 milliseconds on cached re-runs.
  • Designing an interactive UI that maps identified vulnerabilities directly to actionable code remediation snippets, Jira/GitHub exportable tasks, and statutory articles.

What we learned

Building enterprise-grade privacy AI requires strict edge data minimization (GDPR Article 5) combined with bounded execution deadlines, parallel tool dispatching, and deterministic fallbacks to guarantee predictable performance under heavy enterprise workloads.

What's next for GuardianAI

  • Expanding out-of-the-box CI/CD GitHub Actions and GitLab CI integrations for automated pull-request schema scanning.
  • Adding direct bi-directional synchronization with Jira, Linear, and ServiceNow for automated remediation ticket tracking.
  • Implementing automated synthetic schema generation to stress-test data pipelines against emerging AI governance frameworks (EU AI Act, NIST AI RMF).

Built With

  • ccpa
  • compliance
  • cybersecurity
  • data-privacy
  • edge-ai
  • express.js
  • function-calling
  • gdpr
  • gemini-3.7-flash
  • gemma-4-31b-it
  • google-cloud-run
  • google-genai-sdk
  • hipaa
  • multi-agent
  • node.js
  • pci-dss
  • react
  • rest-api
  • sha-256
  • tailwind-css
  • typescript
  • vite
Share this project:

Updates

Submission history