SmartFlow One

• 

Inspiration

Financial analysts and CFOs spend countless hours manually reviewing dense financial reports, extracting key metrics, and identifying operational risks. During hackathons and real-world finance workflows, we noticed a critical trade-off: while generative AI can accelerate document analysis, uploading unredacted financial reports to LLMs creates massive compliance risks under regulations like Malaysia's Personal Data Protection Act (PDPA).

Most existing solutions force finance teams to choose between speed and regulatory compliance. SmartFlow One was born to bridge this gap—a privacy-first financial document intelligence platform that scrubs personally identifiable information (PII) before any AI processing takes place.

What it does

SmartFlow One transforms raw financial documents into compliance-safe, executive-ready insights in seconds:

Automated PII Scrubbing: Detects and masks emails, phone numbers, NRIC numbers, credit cards, and IBANs before data leaves the client.

Financial Metric Extraction: Automatically pulls key metrics (Revenue, Operating Expenses, Net Profit, Cash Flow) with calculated period-over-period growth rates.

AI Executive Summaries & Risk Matrices: Synthesizes complex financial health into structured executive summaries and categorizes operational risks by severity (High/Medium/Low).

Prioritized CFO Recommendations: Generates actionable, prioritized recommendations complete with page-level source citations.

Voice Briefings: Native browser Web Speech API condenses key insights into a 30-second spoken summary for fast audio briefings.

How we built it

SmartFlow One is built as a modern Single Page Application leveraging a privacy-by-design pipeline:

Frontend: Built with Vite, React 19, and TypeScript, styled using Tailwind CSS.

Privacy Engine: Client-side regex engine with index tracking for ordered execution to prevent overlapping redactions.

AI Infrastructure: Powered by Google Gemini 2.5 Flash (with automatic fallback to Gemini 1.5 Flash) via @google/genai for structured JSON output generation.

Auth & Backend: Supabase (Auth + PostgreSQL) for secure session management and database storage (documents, extracted_metrics, risks, audit_trail).

Challenges we ran into

Handling PII Overlaps Without Breaking Context: Regex masking often produces nested or corrupted tokens when patterns overlap (e.g., an email address containing numbers matching an NRIC pattern). We engineered an index-aware masking pipeline to prevent double-redaction.LLM Rate Limits & Latency: Managing API rate limits during testing required implementing exponential backoff and a multi-model fallback chain (Gemini 2.5 Flash $\rightarrow$ 1.5 Flash $\rightarrow$ Graceful Demo State).Structured Outputs from Unstructured PDFs: Financial disclosures vary wildly in layout. Ensuring consistent JSON schema responses with accurate page-level citations demanded strict prompt engineering and response validation layers.

Accomplishments that we're proud of

Zero-Trust Privacy Architecture: Successfully masking PII before it reaches any external AI model without losing the semantic context required for financial analysis.

Page-Level Provenance: Every metric, risk, and recommendation cites its exact source document and page number, eliminating black-box AI responses.

Full Resilient Fallbacks: The platform remains functional even without API keys or database connections by falling back gracefully to mock data modes.

What we learned

Compliance by Design is Feasible: Pre-processing sensitive data at the edge adds negligible overhead while ensuring complete compliance with regional regulations like PDPA Malaysia.

Hybrid AI-Deterministic Models Build Trust: LLMs excel at unstructured narrative synthesis and risk categorization, but numeric computations must always be offloaded to deterministic code.

Graceful Degradation is Vital: Designing robust error boundaries and fallback states ensures a production-ready user experience under high traffic or rate limits.

What's next for SmartFlow One

Multi-Language PDPA Scrubbing: Extending the regex and NLP masking engine to support multilingual documents (Malay, English, Mandarin).

Cross-Document Trend Analytics: Allowing users to compare quarterly reports side-by-side over multi-year periods.

Exportable Audit Packages: One-click generation of PDF compliance audit logs for internal and external auditors.

Built With

• kiro
• postgresql
• react
• supabase
• tailwind
• typescript
• vite