Comp AI - Repository Analysis: Executive Summary

What Is This?

Comp AI is an open-source, AI-powered Governance, Risk, and Compliance (GRC) platform that helps organizations achieve and maintain compliance with security frameworks like SOC 2, ISO 27001, HIPAA, GDPR, and others.

The Problem It Solves

Compliance is traditionally a manual, document-heavy, expensive process. Organizations must:

• Write and maintain dozens of security policies
• Track hundreds of controls and evidence items
• Answer lengthy security questionnaires from customers
• Monitor cloud infrastructure for misconfigurations
• Train employees on security awareness
• Manage vendor risk assessments
• Prepare for and respond to audits

Comp AI automates the majority of this work using LLMs, browser automation, cloud API scanning, and a structured workflow engine.

Target Users

Key Capabilities

+------------------------------------------------------------------+
|                          Comp AI Platform                         |
+------------------------------------------------------------------+
|                                                                    |
|  [Policy Engine]     AI-generates and maintains security policies  |
|  [Control Tracking]  Maps controls to frameworks with evidence     |
|  [Risk Management]   Assess, score, and treat organizational risks |
|  [Cloud Security]    Scan AWS/GCP/Azure + AI-powered remediation   |
|  [Questionnaires]    RAG-powered auto-answering of security Q&A    |
|  [Vendor Management] AI risk assessment with web research          |
|  [Trust Portal]      Public compliance documentation portal        |
|  [Device Compliance] Electron agent for endpoint compliance        |
|  [Audit Workflow]    Findings, evidence, SOA management            |
|  [Integrations]      30+ cloud/SaaS service connectors             |
|  [Browser Automation] Stagehand-powered automated evidence tasks   |
|                                                                    |
+------------------------------------------------------------------+

Tech Stack At a Glance

Architecture Overview

                    +-----------+
                    |  Browser  |
                    +-----+-----+
                          |
          +---------------+---------------+
          |               |               |
    +-----v-----+  +-----v-----+  +------v------+
    |  Main App |  |  Portal   |  | Trust Portal|
    | Next.js   |  | Next.js   |  | (public)    |
    | :3000     |  | :3002     |  |             |
    +-----+-----+  +-----+-----+  +------+------+
          |               |               |
          +-------+-------+-------+-------+
                  |                        
           +------v------+                
           |  NestJS API |  <-- Single source of truth
           |  :3001      |      for auth, RBAC, business logic
           +------+------+                
                  |                        
     +------------+------------+           
     |            |            |           
+----v----+ +----v----+ +-----v-----+    
|Postgres | |Trigger  | |  S3/AWS   |    
|+pgvector| |  .dev   | |  Services |    
+---------+ +---------+ +-----------+    

What Makes This Interesting

1. Multi-model AI strategy: Uses 6+ LLM models, each chosen for specific cost/capability tradeoffs
2. RAG for compliance: Vector embeddings of policies and knowledge base power questionnaire auto-answering
3. AI cloud remediation: Claude Opus generates executable AWS/GCP/Azure fix commands from security findings
4. Integration DSL: Declarative JSON-based check definitions alongside code-based checks
5. Session-based auth only: No JWTs - cross-subdomain cookies with Better Auth
6. Flat RBAC model: Simple resource:action permissions with 5 built-in + custom roles
7. Full audit trail: Every mutation is automatically logged with before/after diffs

Document Index