FRDownload CVEmail me

Omar El Hachimi / Projects / KASTOR.AI

Project 06 · KASTOR.AI · Jun 2025 – now

KASTOR.AI: compliance reports drafted with AI, approved by people

Omar El Hachimi founded KASTOR.AI and built it alone, from architecture to production: a SaaS that drafts GDPR, EU AI Act, NIS2 and ISO 27001 compliance reports from a company's own policies and procedures, with AI or human control for each section.

Role Founder and technical lead; built alone

KASTOR.AI, how it works: 1 Upload, 2 Find, 3 Draft, 4 Approve. 4 regulations covered; 2 model providers; 1 founder: product, AI, web app, infrastructure.
KASTOR.AI: how it works and key figures.
4regulations covered
2model providers
1founder: product, AI, web app, infrastructure

Context

Compliance reports take weeks, mostly spent finding evidence in a company's own policies and procedures.

The judgement must stay with a person, so the product had to make the evidence easy to check and let the client decide what the AI writes.

How it works

  1. UploadThe client adds its policies and procedures.
  2. FindThe system finds the evidence for each requirement.
  3. DraftAI drafts the sections the client chose.
  4. ApproveThe client edits and approves the report.

What I built

  • Retrieval. Semantic chunking, embeddings, hybrid search (HNSW vectors and BM25), HyDE query expansion and re-ranking across the client's documents.
  • Generation. Multi-model orchestration with LangChain and LangGraph, using Gemini on Vertex AI and Claude on Amazon Bedrock.
  • Templates. Dynamic report templates for each regulation, with AI or human control set section by section.
  • The product. An Angular 19 application with a visual template editor and a TipTap rich-text editor, shipped as a progressive web app.
  • The platform. FastAPI with asynchronous MongoDB and Redis Stack for cache and vector index; Google Cloud provisioned with Terraform, with budget alerts; Docker Compose; Firebase multi-provider authentication with role-based access.

Design choices

Decide what the AI should not do

Letting the client choose, section by section, between AI and human control made the product usable for documents a person must sign.

Stack

Python · FastAPI · LangChain · LangGraph · Vertex AI (Gemini) · Amazon Bedrock (Claude) · MongoDB · Redis Stack · Angular 19 · TipTap · Firebase · Keycloak · Google Cloud · Terraform · Docker

Questions

Can AI draft a GDPR or EU AI Act compliance report?

AI can find the evidence in a company's own documents and draft each section, but a person should keep control: in KASTOR.AI, built by Omar El Hachimi, the client decides section by section whether the AI drafts or a person writes, and approves the final report.