Legal & Compliance Governance
Relevant source files
The following files were used as context for generating this wiki page:
Legal & Compliance Governance represents the autonomous authority within NeXify AI responsible for maintaining legal framework adherence, specifically regarding GDPR/DSGVO, German law, and EU regulations. The system automates routine compliance, flags critical risks, and generates mandatory legal documentation through specialized AI agents and governance gates.
This module ensures all platform operations remain audit-safe and transparent for customers while strictly isolating tenant data. Key components include the Legal Expert agent, a multi-stage Quality Auditor, and a centralized configuration layer for legal taxonomy and data residency.
Sources: services/api/agents/brain_agents/legal-expert.md:1-10, packages/config/legal.yaml:5-10
Autonomous Legal Expert
The legal-expert agent functions as the platform's autonomous legal authority. It interacts directly with the system's "Brain" (nexifyai_brain) to query past audits and identify compliance gaps. The agent maintains legal documentation currency and escalates P0 (Blocker) issues to the CEO.
Core Capabilities
- Compliance Audits: Detects gaps in Impressum, GDPR, and AGB requirements.
- Document Generation: Produces legal templates for Privacy Policies, Terms and Conditions (AGB), and Data Processing Agreements (AVV).
- Regulatory Monitoring: Tracks updates from EUR-Lex, EDPS, and BfDI.
Sources: services/api/agents/brain_agents/legal-expert.md:12-25, services/api/agents/brain_agents/legal-expert.md:75-82
Compliance Audit Workflow
The following diagram illustrates the "Brain-First" mandate that the Legal Expert follows for every audit cycle.
The diagram shows the sequential steps taken by the Legal Expert agent, prioritizing Brain queries before execution and ensuring results are stored back for persistence.
Sources: services/api/agents/brain_agents/legal-expert.md:21-30
Quality Gates and Auditing
The senior-quality-auditor enforces strict Quality Gates that act as the final barrier before code or configurations reach production. This system follows the "Founder Mandate" where deployment is blocked if specific legal or security criteria are unmet.
The Seven Quality Gates
| Gate | Focus Area | Mandatory Requirements |
|---|---|---|
| Gate 1 | Documentation | Architecture spec, API docs, SOP reference |
| Gate 2 | Testing | Unit tests ≥80%, Security scan, Integration tests |
| Gate 3 | Security | Secret vaulting, Zero Trust, RBAC, Audit logs |
| Gate 4 | Architecture | 12-System model alignment, scaling plan |
| Gate 5 | Performance | <200ms API latency, <5s Agent response |
| Gate 6 | Workflow | Brain context enrichment, Expert matching |
| Gate 7 | Agent Quality | Brain-First enabled, escalation path defined |
| Sources: services/api/agents/brain_agents/senior-quality-auditor.md:17-68 |
Audit Scoring and Escalation
The auditor assigns a score to each gate (1.0 for PASS, 0.5 for WARN, 0.0 for FAIL).
- Score ≥ 0.85: Approved for production.
- Score 0.50 - 0.69: Rejected; re-audit required after fixes.
- Score < 0.50: Blocked; triggers P0 alert and CEO notification.
Sources: services/api/agents/brain_agents/senior-quality-auditor.md:88-95
Legal Configuration and Taxonomy
The platform's legal behavior is governed by packages/config/legal.yaml, which defines the taxonomy for cookies, AI disclosure rules, and data residency.
Data Residency and Sub-processors
The system enforces a primary data region in the EU to ensure compliance with DSGVO.
- Primary Region: EU (Hostinger VPS, Supabase Self-Hosted).
- Restricted Regions: RU, CN.
- Sub-processors: Listed entities must have signed DPAs (Data Processing Agreements). Currently, OpenRouter (US) is used with a Zero Data Retention policy.
Sources: packages/config/legal.yaml:93-107, packages/config/legal.yaml:52-70
Cookie Governance
NeXify AI uses a strict opt-in mechanism for non-essential cookies.
cookies:
taxonomy:
essential:
description: "Technisch notwendig — kein Consent erforderlich"
examples: ["session_id", "csrf_token", "cookie_consent"]
analytics:
description: "Nutzungsanalyse — Opt-in erforderlich"
examples: ["_ga", "_plausible"]
consent_mechanism:
type: "opt_in"
consent_log:
enabled: true
storage: "supabase"
Sources: packages/config/legal.yaml:13-35
Technical Implementation of Legal Pages
The platform serves legal documents through a multi-language React wrapper. The LegalPage component maps URL slugs to specific legal content (e.g., Impressum, Privacy Policy) and enforces language fallbacks.
Content Mapping Logic
The system uses a SLUG_MAP to resolve different localized terms to a single internal key for content rendering.
const SLUG_MAP = {
impressum: 'impressum',
imprint: 'impressum',
datenschutz: 'datenschutz',
privacy: 'datenschutz',
agb: 'agb',
terms: 'agb',
avv: 'avv',
dpa: 'avv'
};
Sources: knowledge/emergent/source/src/pages/LegalPages.js:847-855
Security Standards
The platform implements multiple security headers and encryption standards to protect legal and user data:
- Encryption: TLS 1.2+ in transit and AES-256 at rest (MongoDB Atlas).
- Authentication: JWT tokens with 24-hour expiration and Argon2id hashing for passwords.
- Security Headers: CSP, X-Frame-Options: DENY, and HSTS.
Sources: knowledge/emergent/source/src/pages/LegalPages.js:255-268, SECURITY.md:50-60
Conclusion
Legal & Compliance Governance in NeXify AI is an automated, Brain-integrated system that enforces high-level quality and legal standards across all deployments. By utilizing autonomous agents for document generation and rigid quality gates for deployment approval, the platform maintains a continuous state of audit-readiness and regional compliance for the D/A/CH economic area.
Sources: services/api/agents/brain_agents/legal-expert.md:98-103, services/api/agents/brain_agents/senior-quality-auditor.md:7-15