Overview
aissurance is an EU AI Act compliance automation platform built as a modular monolith with FastAPI (Python) backend and React (TypeScript) frontend. The platform serves four distinct user roles with purpose-built dashboards and permissions.
Architecture
- Backend: FastAPI with async SQLAlchemy, PostgreSQL 16+
- Frontend: React + Vite + TypeScript
- Storage: Local POSIX filesystem (encrypted)
- Encryption: Hierarchical envelope encryption (Master Key → Tenant Key → Data Key)
- Authentication: JWT via FastAPI Users
- PDF Generation: LaTeX via pdflatex
- Key Management: Local encrypted keystore (MVP) → HashiCorp Vault (production)
User Roles
Compliance Admin
Full control dashboard with high-level risk posture, deadline tracking, and final sign-off authority for conformity declarations. Access to Admin panel and Key Management.
Technical Lead
Data entry focused access. Upload model metadata, training data schemas, and test results. Primary interface for technical documentation and evidence collection.
AI Deployer
Restricted view for organizations that use AI built by others. Verify provider compliance before deployment. Access to Dashboard, Systems, and Documents only.
Auditor
Read-only access to the entire chain of evidence, version history, and risk assessments. All evidence and document pages display read-only indicators.
Core Modules
AI Asset Inventory & Discovery
Two-tier discovery: Nomyo Router plugin for zero-config auto-discovery, and manual CSV import / Docker API scan as fallbacks.
Classification Engine
JSON-driven rules engine that evaluates AI systems against EU AI Act Annex III / Article 6. Supports risk levels: Unrestricted, Limited, High, Prohibited, GPAI, GPAI Systemic. Rules can be updated without code deploys.
Evidence Locker & QMS
Secure storage for compliance evidence supporting all 14 Annex IV elements. Features:
- File upload and text evidence submissions
- Discovery auto-fill for 9 elements
- Verification workflow (verified/pending/rejected)
- Version control with audit trails
Documentation Generator
Converts structured data into formal regulatory documents:
- Technical Documentation (Annex IV)
- EU Declaration of Conformity (Article 47)
- Instructions for Use
- Export formats: PDF and JSON
Post-Market Monitoring
Incident tracking (Article 73), automated compliance reminders, and 10-year retention management.
Key Management
Per-tenant encryption with hierarchical key management. Features:
- Tenant key provisioning on signup
- Automated key rotation with zero-downtime
- Crypto-shredding for GDPR erasure
- Full access audit logging
Getting Started
Prerequisites
- Python 3.12+
- PostgreSQL 16+
- pdflatex (for document generation)
Development Setup
# Create virtual environment
python3 -m venv ~/.venv/aissurance
source ~/.venv/aissurance/bin/activate
# Install dependencies
pip install -r backend/requirements.txt
# Configure
cp backend/.env.example backend/.env
# Initialize database
alembic upgrade head
# Start backend
uvicorn backend.main:app --reload --host 0.0.0.0 --port 8000
# Start frontend
cd frontend && npm install && npm run dev
Deployment
Production deployment uses systemd services on native metal:
- FastAPI application service
- PostgreSQL with Row-Level Security
- TLS termination at reverse proxy (Caddy or nginx)
- All services on localhost — no network exposure