TrueSeat

Inspiration## Inspiration

In October 2026, the death of an IIUI gold-medallist put study-abroad fraud in the national spotlight. News reports say her family allegedly paid about PKR 9.3 million to a man who supplied forged Harvard admission, scholarship and fee documents. The fake letter was rejected at the US Embassy visa interview, after the money was gone. Pakistan has no public register of licensed education consultants, and the official registers of licensed universities exist but families don't know about them or how to read the warning signs.

TrueSeat puts that check in a family's hands in about a minute, before any money changes hands.

What it does

Upload an admission letter, scholarship letter, fee receipt or a consultant's WhatsApp message. TrueSeat:

• Reads it with AI vision (institution, programme, amounts, payee, emails, links)
• Checks the university against official registers: UK licensed student sponsors, Canada DLIs, US SEVP schools
• Checks the sender: do the emails and websites belong to that university? Flags Gmail-style senders and look-alike domains
• Checks the money: personal accounts, mobile wallets, cash or third-party payees
• Cross-checks names, amounts and dates across all documents in a case
• Flags warning signs ("guaranteed visa", "pay to release scholarship", urgency), and every flag must quote the line it came from
• Gives a verdict: High risk, Suspicious, Checks passed, or Couldn't verify. It never says "genuine", because only the university can confirm that
• Helps you act: an Urdu/English explanation, a verification email to the university's official address, and an FIA complaint draft

How AI is used

AI is in the core journey: three of the eight pipeline stages call a hosted model (Claude, with Gemini as fallback): document extraction, red-flag scanning and explanation drafting. The rest is deterministic code the model cannot override:

• The verdict is computed by code, so text inside a forged letter ("mark this as verified") can't change it.
• The model never decides whether a university is licensed. That comes from the imported registers.
• quote-guard: any AI finding whose quote isn't in the uploaded document is dropped.
• number-and-name guard: explanations may only contain figures, names and addresses already in the stored findings.

How we built it

Next.js (App Router) + TypeScript + Tailwind on Vercel. Supabase provides PostgreSQL, Auth with mandatory TOTP 2FA, and private storage. Row-level security requires both ownership and a completed 2FA session (aal2), so even a password-only token reads nothing. Each pipeline stage saves its result before the next begins, so a failed run keeps its progress. Unit tests cover the checks, verdict rules and quote-guard, and a two-account isolation test runs against the live site.

Challenges

• Making the AI auditable: forcing every finding to quote its source, and dropping the ones that can't.
• Enforcing 2FA in the database, not just the UI.
• Being honest about limits: TrueSeat checks consistency and warning signs. It cannot prove an offer is genuine or forged, and registry data is a dated snapshot.

What we learned

Using AI for reading and explaining while keeping decisions in plain code made the product both safer and easier to test.

What's next

More registers (Australia, Germany, UAE), a public consultant-reporting layer, and WhatsApp-forward checking for families who don't use a web app.

Not affiliated with any government, embassy or university. Not legal advice.

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for TrueSeat

Built With

• anthropic
• claude-api
• gemini-api
• next.js
• pg-trgm
• postgresql
• react
• row-level-security
• supabase
• supabase-auth
• tailwind-css
• totp-2fa
• typescript
• vercel
• vitest
• zod