Vertical AI SaaS for governed compliance evidence preparation.
EvidenceFlow AI replaces scattered spreadsheets and generic chatbots with a governed, traceable evidence-preparation workflow for regulated businesses — compliance teams, auditors, ESG analysts, and due-diligence professionals.
Every output shows its sources, gaps, version, review state, and permitted next actions.
| Layer | Technology |
|---|---|
| Frontend | React 19 + Vite + TypeScript + Tailwind CSS 4 |
| Backend | Bun server (port 3000) |
| Database | SQLite via bun:sqlite (mock mode; pgvector adapter ready) |
| Auth | Header-based mock (x-user-id); Clerk-ready |
| Testing | bun test |
| Build | Vite |
# Install dependencies
bun install
# Start development server
bun run dev
# Build for production
bun run build
# Publish (build + serve on port 3000)
bun run publishThe site serves at http://localhost:3000.
| Script | Description |
|---|---|
bun run dev |
Start Vite dev server on port 3000 |
bun run build |
Production build |
bun run publish |
Build and serve (bun server.ts) |
bun run db:seed |
Seed demo data |
bun test |
Run all tests |
bash scripts/quality-check.sh |
Full quality gate suite |
Copy .env.example to .env.local and configure:
# Required for production
DATABASE_URL= # PostgreSQL connection string
CLERK_SECRET_KEY= # Clerk auth secret
STRIPE_SECRET_KEY= # Stripe billing secret
# Mock mode (default: all mock adapters)
MOCK_MODE=true
In mock mode, all external services (auth, storage, email, AI, billing, marketplace) use in-process mock adapters that log with the MOCK: prefix.
src/
├── app/ # React frontend
│ ├── App.tsx # Route definitions + error boundary
│ ├── components/ # Shared UI components
│ └── pages/ # Page components
│ ├── app/ # Authenticated app pages
│ └── *.tsx # Public marketing pages
├── lib/
│ ├── agent/ # Task state machine + runtime
│ │ ├── state-machine.ts
│ │ ├── runtime.ts
│ │ └── tools/ # Agent tools (search_sources, etc.)
│ ├── api/
│ │ ├── router.ts # URL pattern → handler dispatch
│ │ ├── middleware.ts # Auth, correlation ID, error handling
│ │ └── routes/ # Per-resource route handlers
│ ├── auth/ # Default-deny authorization
│ ├── db/ # SQLite client + schema + seed
│ ├── entitlements/ # Feature access & usage limits
│ ├── retrieval/ # Tenant-filtered keyword search
│ ├── audit/ # Append-only audit event logger
│ ├── billing/ # Stripe mock adapter
│ ├── marketplace/ # Cloud marketplace adapter
│ ├── storage/ # Object storage mock
│ ├── email/ # Email mock
│ └── ai/ # AI model mock
├── types/ # TypeScript type definitions
└── __tests__/ # Test suites
├── api/ # E2E API tests
├── auth/ # Authorization unit tests
├── entitlements/ # Entitlement unit tests
├── retrieval/ # Search unit tests
└── security/ # Security gate tests
All API routes are under /api/v1/ with tenant-scoped paths:
POST /api/v1/orgs # Create org
GET /api/v1/orgs/:orgId # Get org
PATCH /api/v1/orgs/:orgId # Update org
DELETE /api/v1/orgs/:orgId # Delete org
GET /api/v1/orgs/:orgId/members # List members
POST /api/v1/orgs/:orgId/members # Invite member
GET /api/v1/orgs/:orgId/cases # List cases
POST /api/v1/orgs/:orgId/cases # Create case
GET /api/v1/orgs/:orgId/cases/:caseId # Get case
POST /api/v1/orgs/:orgId/cases/:caseId/messages # Add message
POST /api/v1/orgs/:orgId/sources/upload # Upload source
GET /api/v1/orgs/:orgId/sources # List sources
DELETE /api/v1/orgs/:orgId/sources/:sourceId # Delete source
POST /api/v1/orgs/:orgId/search # Search sources
POST /api/v1/orgs/:orgId/cases/:caseId/agent/run # Run AI agent
POST /api/v1/orgs/:orgId/cases/:caseId/agent/tasks/:taskId/cancel # Cancel task
GET /api/v1/orgs/:orgId/billing/subscription # Get subscription
GET /api/v1/orgs/:orgId/entitlements # List entitlements
GET /api/v1/orgs/:orgId/audit # List audit events
GET /api/v1/orgs/:orgId/notifications # List notifications
GET /api/v1/orgs/:orgId/support/cases # List support cases
Every error response follows the structured format:
{
"error": {
"code": "unauthorized",
"message": "Authentication required",
"correlationId": "corr_abc123"
}
}The agent uses a finite state machine with 11 states:
received → classified → context_ready → planning →
awaiting_tool → executing → validating → completed
Plus: awaiting_approval, failed, cancelled. Write tools (create_follow_up_ticket) require explicit human approval before execution.
See the business plan in the team workspace for full strategy, current focus (Release 1 MVP), out-of-scope items, and revision history.
The public status page is at /status.
Proprietary. All rights reserved.