Veedor

Veedor is an AI-augmented compliance platform that helps organizations actually get certified.

Comment

Inspiration

I've spent years as an ISMS Manager, living through ISO version migrations and SOC 2 audits from the inside. Before that I was and auditor and consultant, I watched organization after organization fail at this not because they didn't care, but because nobody had ever taught them what certification actually requires, it isn't covered in any formal education or academic program anywhere. I know this problem from both sides, the practitioner grinding through an audit and the outsider trying to figure out where to even start. I wanted to build something that could close that gap for real, not another checklist tool, something that makes the same judgment call an auditor makes.

What it does

Veedor grades a company's compliance evidence against expert-authored rubrics for ISO 27001, 9001, 14001, 22301, 37001, 45001, and 13485. Upload a policy, a log, a screenshot, whatever the evidence is, and Gemini assesses each acceptance criterion independently: MET, NOT_MET, or INSUFFICIENT_EVIDENCE, with a specific failure mode and remediation guidance. The platform aggregates those into a clause verdict deterministically in code, by severity, and auto-opens a traceable non-conformity for anything that fails. On the other side, Auditor Mode gives real audit firms an AI copilot that drafts findings narratives, matches evidence to clauses, and flags recurring issues, so a firm can run more client engagements without scaling headcount.

How I built it

Next.js 16 (App Router, Turbopack, Server Actions) on Vercel, Supabase for Postgres, Auth, and Storage, with row-level security enforcing tenant isolation at the database level, not just in application code. Gemini 3.6 Flash via the Gemini API (Google AI Studio), orchestrated with Genkit in library mode, called directly from Server Actions with no separate inference service. The compliance content itself is a grading rubric, not the standard text, paraphrased intent, acceptance criteria, evidence hints, and severity-tagged failure modes per clause, stored as plain versioned JSON so every evaluation can be traced back to the exact rubric version that produced it. Tailwind CSS v4 and shadcn/ui for the frontend, Wompi for payments in the LATAM market I'm starting in.

Challenges I ran into

Getting the model to produce a defensible verdict, not a plausible-sounding one, meant giving up on asking it to just decide pass or fail. Instead I split the judgment into per-criterion calls against a structured rubric, and let deterministic code in my own stack roll those up into a verdict by severity. The AI makes the call on the evidence, the aggregation logic isn't a black box.

Real-world usage caught something demo testing never would. Days before this deadline, an auditor using Veedor live in the field on a phone told me the sidebar wasn't actually usable on mobile, it collapsed to an icon-only rail with no way to see labels or expand it. That was blocking onboarding for real, waiting clients. I rebuilt it as a proper mobile drawer and shipped the fix the same day, a good reminder that live feedback from someone actually using the product beats any amount of internal QA.

Accomplishments that I'm proud of

Eight compliance frameworks built out to real depth, over 620 acceptance criteria total, not a single demo framework. A real company has migrated its compliance workflow onto Veedor and is running live audits in it today. Every evaluation is immutable and tied to a specific model version and rubric version for audit defensibility, and finished reports are signed, RFC-3161 timestamped, and QR-verifiable, built to hold up to actual scrutiny, not just look finished in a demo.

What I learned

That grounding matters more than prompting. A good rubric with explicit failure modes gets you a defensible AI verdict, a clever prompt alone doesn't. And that shipping to one real user teaches you more in a week than shipping to nobody teaches you in a month, the mobile sidebar bug above only surfaced because someone was actually depending on the product to do their job.

What's next for Veedor

Converting the existing pipeline into paying tenants, adding more frameworks (each one is about three lines of code thanks to the rubric-as-data design, so content velocity isn't gated by engineering time), and growing Auditor Mode as the higher-retention side of the business, since firms transact repeatedly across many client engagements instead of once.

Built With

Share this project:

Updates