High-Level Architecture
Relevant source files
The following files were used as context for generating this wiki page:
Comply-Quick is a specialized compliance-as-a-service platform designed to automate the generation of legal and technical safeguards for web developers and merchants. The architecture is centered around a "Code Mapping Matrix" that translates technical stack configurations (frameworks, tracking pixels, and regions) into specific protective legal clauses, privacy disclosures, and operational checklists.
The system is structured as a Next.js application utilizing a centralized logic engine (ClauseEngine) to maintain a deterministic mapping between technical inputs and legal outputs. It features a tiered service model (Pro, Agency, Enterprise) that unlocks advanced modules such as HIPAA or PCI-DSS compliance and programmatic API access.
Sources: src/app/page.tsx, src/components/ClauseEngine.tsx:1-15, src/app/dashboard/DashboardWizard.tsx:88-100
Core Generation Engine: ClauseEngine
The ClauseEngine serves as the primary business logic layer of the application. It accepts a ComplianceInput object and executes a multi-stage transformation process to produce a CompliancePackage. This engine is designed to be deterministic and dependency-free to allow for consistent execution across both client-side wizards and server-side API routes.
Generation Logic Flow
The following diagram illustrates the internal processing flow within the ClauseEngine when generating a new compliance package:
The ClauseEngine utilizes several internal data structures to map technical parameters to legal text:
- LIABILITY_SHIFT_PREAMBLES: Context-aware introductory text based on whether the user is a
developerormerchant. - FRAMEWORK_LIABILITY_CLAUSES: Specific clauses for 9 supported platforms including Shopify, Next.js, and WordPress.
- PIXEL_SCRIPT_DECLARATIONS: Technical disclosures for 6 major tracking pixels (Meta, Google, TikTok, etc.).
- REGIONAL_DISCLOSURES: Jurisdiction-specific legal notices for US, GDPR, CCPA, PIPEDA, LGPD, and Australia.
Sources: src/components/ClauseEngine.tsx:55-75, src/components/ClauseEngine.tsx:85-300, src/components/ClauseEngine.tsx:470-510
Technical Stack Mapping Matrix
The architecture relies on a strict set of supported technical entities. This ensures that the generated documentation remains technically accurate and legally relevant to the specific implementation.
| Entity Type | Supported Options |
|---|---|
| Frameworks | Shopify, Next.js, WordPress, Wix, Squarespace, GoDaddy, Webflow, WooCommerce, BigCommerce |
| Tracking Pixels | Meta, Google, TikTok, LinkedIn, Pinterest, Snapchat |
| Regions | US General, California (CCPA), EU (GDPR), Canada (PIPEDA), Brazil (LGPD), Australia |
| Enterprise Modules | HIPAA, PCI-DSS, ADA/WCAG, SOC 2 |
Sources: src/components/ClauseEngine.tsx:19-35, src/components/EnterpriseModules.tsx:10-15
System Modules and Pipelines
Comply-Quick implements several specialized pipelines to handle automated compliance monitoring and scanning beyond manual wizard generation.
Autopilot and Scanner Pipelines
The system includes proactive pipelines for maintaining compliance status:
- Autopilot Pipeline: Monitors regulatory changes and builds regeneration proposals for existing projects. It uses an AI client to generate plain-language summaries of differences between stored and updated versions.
- Compliance Scanner: A pipeline that crawls a target URL, analyzes HTML for third-party tools, and calculates a compliance score based on detected risks.
Enterprise Module System
The Enterprise system extends the core engine with high-stakes compliance requirements. Unlike the core engine, which focuses on general data privacy, the Enterprise modules provide deep technical controls for regulated industries.
- HIPAA: Focuses on BAA requirements, PHI encryption (AES-256), and breach notification protocols.
- PCI-DSS: Manages Cardholder Data Environment (CDE) scope and payment tokenization standards.
- SOC 2: Defines logical/physical access controls and system availability principles.
- ADA/WCAG: Maps requirements for WCAG 2.2 Level AA conformance.
Sources: src/components/EnterpriseModules.tsx:24-150
User Interfaces and Data Flow
The application provides three primary interaction surfaces that interface with the underlying architecture.
Dashboard Wizard
The DashboardWizard is the primary entry point for manual generation. It implements a multi-step state machine that collects user inputs and invokes the ClauseEngine client-side for immediate feedback (free preview) before requiring premium activation for full document access.
Command Center
The CommandCenterView serves as the management hub for paid tiers. It aggregates compliance scores across all active projects and displays proactive "Regulatory Alerts" and "Intelligence" panels. It manages project lifecycle actions including deleteProjectAction and saveProjectAction.
Developer API
The API allows for programmatic integration. It uses metered billing tracked via a usage summary system and supports authentication via cq_live_ prefixed bearer tokens.
| Endpoint | Method | Description |
|---|---|---|
/api/v1/compliance | POST | Generates a compliance package programmatically. |
/api/v1/templates | POST | Handles marketplace template uploads. |
/api/v1/usage | GET | Returns current month's metered usage. |
Sources: src/app/dashboard/DashboardWizard.tsx:40-150, src/app/dashboard/home/CommandCenterView.tsx:120-180, src/app/dashboard/api/ApiView.tsx:220-245
Data Security and Legal Safeguards
The architecture incorporates "Inward Contract Shielding" as a core architectural principle. This logic is designed to explicitly move the legal burden of ongoing compliance from the developer to the merchant upon project handoff. This is implemented through the LIABILITY_SHIFT_PREAMBLES and mandatory report disclaimers defined in the central legal library.
// src/lib/legal.ts:12-21
export const REPORT_DISCLAIMER = "This package is informational only. Consult a legal professional before deployment.";
export const DISCLAIMER_LONG =
"Comply-Quick provides automated operational templates based on technical configuration inputs. " +
"Comply-Quick is not a law firm, does not provide formal legal counsel, and the outputs generated do not constitute legal advice.";
Sources: src/lib/legal.ts:10-21, src/components/ClauseEngine.tsx:78-83
Conclusion
The Comply-Quick architecture is a modular, matrix-driven system that bridges the gap between technical implementation and legal compliance. By centralizing logic in the ClauseEngine and extending it through specialized pipelines (Autopilot, Scanner) and high-tier modules (Enterprise), the system provides a scalable framework for automating complex regulatory requirements across diverse web frameworks and jurisdictions.