PrivacyGuard Agent

An AI agent that scans documents, detects sensitive data and automatically generates compliance-ready remediation reports.

Comment

Inspiration

Data breaches and compliance violations (GDPR, CCPA, HIPAA) are costing companies millions. We realized that traditional, regex-based PII (Personally Identifiable Information) scanners are fundamentally broken. They can find a formatted social security number, but they completely miss contextual data—like a doctor writing, "The patient's mother also suffers from Type-2 diabetes." We wanted to build an intelligent, context-aware agent that doesn't just find data, but actually reasons about it and provides a full audit trail.

What it does

PrivacyGuard Agent is a multi-step AI workflow that acts as an automated data protection officer. You upload a document (like a medical record, contract, or email), and the agent:

  1. Pre-scans the document to understand its context and predict risk.
  2. Chunks the text and uses Gemini to detect explicit and hidden/contextual PII.
  3. Classifies the risk level (0-100) and maps violations to major compliance frameworks (GDPR, CCPA).
  4. Audits the results by saving a structured log directly to MongoDB Atlas.
  5. Embeds the document using Gemini's embedding models and stores it in MongoDB for semantic Similarity Search, allowing you to find previously scanned documents with similar risk profiles.

How we built it

We built the agent using Python and Streamlit for a reactive, multi-tab frontend interface. For the intelligence, we integrated Google's Gemini 3.5 Flash for lightning-fast entity extraction and reasoning, and Gemini-embedding-2 for generating high-quality vector embeddings. For the backend, we went all-in on MongoDB Atlas. We utilized the MongoDB Python driver to create separate collections for scans, entities, and audit_logs. Most importantly, we implemented MongoDB Vector Search combined with Atlas Search to provide both semantic and full-text querying across all historical audit logs.

Challenges we ran into

One major challenge was ensuring the Gemini agent didn't hallucinate PII or miss overlapping entities. We solved this by implementing a "chunking and deduplication" pipeline, where the document is split, analyzed individually, and then intelligently merged. Another challenge was dealing with model deprecations; we had to quickly adapt our codebase to utilize the latest gemini-3.5-flash models to ensure maximum speed and availability.

Accomplishments that we're proud of

We are incredibly proud of the seamless integration between Gemini's unstructured reasoning and MongoDB's highly structured Vector Search. Building a UI where a user can instantly see a Markdown-formatted risk report and then seamlessly pivot to finding similar past risks via vector similarity feels like a true enterprise-grade tool.

What we learned

We learned a tremendous amount about prompt engineering for structured JSON output, specifically how to force an LLM to act as a strict compliance parser. We also gained deep experience with MongoDB Atlas Vector Search indexing and how easily it pairs with Google's embedding models.

What's next for PrivacyGuard Agent

Next, we plan to implement automated redaction (exporting a clean PDF with blacked-out text), support for bulk cloud bucket scanning (e.g., scanning an entire AWS S3 bucket), and adding an integration to directly alert security teams via Slack or Jira when a "CRITICAL" risk document is found.

Built With

Share this project:

Updates