Architecture

Six layers, clean separation

Each layer has one job, from ingesting regulations to governing every AI decision. The hybrid retrieval and adaptive intelligence layer is what makes answers precise, not only plausible.

Architectural layers

Data ingestion

Regulations, SOPs, EHR/EDC metadata, SIEM logs and regulator feeds (FDA, EMA, HHS, EDPB, MeitY) through scheduled pipelines, with OCR for scanned guidance.

Graph RAG engine

The compliance knowledge graph in Neo4j: multi-hop traversal across obligations, controls, evidence and risks.

Hybrid RAG & adaptive intelligence

Dense + sparse retrieval with HyDE expansion, RRF fusion, cross-encoder reranking and the adaptive instruction codebook.

Agentic orchestration

A planning orchestrator routes work to specialist agents for gaps, constraints, cross-references, risk, audit and remediation.

Enterprise outputs

Dashboards, gap reports, inspection-ready audit bundles, alerts, regulatory change watch, remediation board.

Cross-cutting

RBAC, explainability, hallucination guards, data residency, MLOps/CI and human approval gates.

Technology stack

"Live demo" marks what this site runs today; the rest is the production design.

Component	Technology	Live demo
Graph database	Neo4j (AuraDB)	Yes
Vector store	Pinecone, integrated embedding + hosted reranker	Yes
Sparse search	Elasticsearch BM25 (production) · Postgres full-text (demo)	Postgres FTS
LLM backbone	Claude (Anthropic API)	Yes
Relational store & auth	PostgreSQL + Supabase Auth	Yes
Backend API	Python FastAPI	Yes
Frontend	HTML5, CSS, JavaScript (Vite)	Yes
Hosting	Vercel (static + serverless Python)	Yes
Agent framework	LangGraph	Plain Python steps
Event streaming & queues	Kafka, Celery + Redis, Airflow	Not in demo
Monitoring	Datadog, Prometheus, Grafana	Not in demo
Document OCR	AWS Textract	Not in demo

Retrieval pipeline

From a question to a cited, validated answer

1 · HyDEClaude drafts a hypothetical policy passage, which is embedded instead of the bare question.

2 · Dense + sparsePinecone top-20 (semantic) and full-text top-20 (exact terms, article numbers) run in parallel.

3 · RRF (k = 60)Reciprocal Rank Fusion merges both lists: score = Σ 1 / (60 + rank).

4 · RerankA cross-encoder scores the top-20 against the question and keeps the best 10.

5 · Graph traversalChunk node IDs seed Neo4j expansion to controls, evidence, risks and MAPS_TO peers.

6 · Context assemblyThe subgraph is serialised with node IDs, relationships and deterministic findings.

7 · GuardEvery cited ID must exist in the subgraph; uncited claims are flagged before output.

Why hybrid

Semantic recall plus exact terms

Regulations turn on precise strings such as "§11.10(e)", "72 hours" and "7 calendar days", which semantic search alone blurs. Internal SOPs paraphrase the same ideas in their own words, which keyword search alone misses. Each method covers the other's blind spot.

Design-target benchmarks from the ECRIP v2.0 specification. The demo runs the same pipeline on a small fictional corpus and does not reproduce these measurements.

Retrieval quality by configuration

Configuration	Precision@10	Recall@10	Latency
Dense only (Pinecone)	74%	69%	~120 ms
Sparse only (BM25)	61%	58%	~80 ms
Hybrid (RRF, no rerank)	84%	79%	~200 ms
Hybrid + rerank	91%	86%	~380 ms