24markjr/ai-compliance-gateway

Purpose and Deployment Shape

This repository implements an AI privacy/compliance gateway: sensitive text is detected and masked before LLM inference, then selectively rehydrated for the caller while audit/history records are retained. The current tree contains both an original Node/Express application and a more extensive Python gateway implementation. Deployment and monitoring assets support containerized services and Prometheus/Grafana.

• docker-compose.yml

• render.yaml

• gateway/app/main.py

Client Application and Entry Points

The React/Vite client is the user-facing application. It provides login/registration, protected analysis, and history views; API service modules connect it to a backend/gateway. Browser startup is through Vite’s React entry point.

• frontend/src/main.jsx

• frontend/src/App.jsx

• frontend/src/pages/Analyze.jsx

Primary Gateway Runtime

The Python gateway is the architecture-rich service boundary for clients and LLM providers. Its FastAPI-style application assembly registers health, auth, chat, analysis, history, dashboard, and administrative routes; dependency wiring and middleware establish shared request behavior.

• gateway/app/main.py

• gateway/app/routers/chat.py

• gateway/app/routers/analyze.py

Compliance Processing Pipeline

Incoming text passes through policy-driven compliance scanning before provider dispatch. The engine coordinates detectors for regex, Presidio, secrets, and prompt injection; overlap resolution produces a consistent set of findings. The masker converts findings to safe replacements, and the vault supports reversible values needed for server-side restoration. Policies separate healthcare, HIPAA, PCI-DSS, GDPR, and DPDP rules from application logic.

• gateway/app/compliance/engine.py

• gateway/app/compliance/masker.py

• gateway/app/compliance/vault.py

LLM Provider Boundary

The gateway isolates model-specific API behavior behind a provider interface and router. Implementations include OpenAI, Gemini, Claude, DeepSeek, and Ollama, allowing routing changes without exposing raw sensitive content outside the compliance stage. Streaming support is modeled within the compliance layer, so masking behavior can remain applicable to streamed interactions.

• gateway/app/providers/base.py

• gateway/app/providers/router.py

• gateway/app/compliance/streaming.py

Identity, Persistence, and Auditability

Authentication middleware and security utilities protect gateway routes. Database modules manage users and request history, while audit models/logger/reader provide compliance records. History is additionally abstracted behind a sink. The original Node backend separately exposes analysis and log routes and uses Supabase, matching the README’s stated React → Express → Gemini → Supabase deployment; it appears to be a legacy or parallel implementation relative to the Python gateway.

• gateway/app/middleware/auth.py

• gateway/app/db/history.py

• gateway/app/audit/logger.py

• backend/server.js

• backend/config/supabase.js

Observability and Operations

Request context, logging, and metrics middleware instrument gateway traffic. Prometheus scrapes metrics and Grafana provisions a gateway dashboard. Runtime configuration, secrets, database/provider endpoints, and policies are externalized rather than embedded in request handlers.

• gateway/app/middleware/metrics.py

• gateway/app/observability/metrics.py

• prometheus/prometheus.yml

• grafana/dashboards/gateway.json