Ratify: Compliance Automation Platform
Personal project: a multi-tenant compliance engine I built and run in production, with real-time order gating and regulatory intelligence across all 51 US jurisdictions.
2026
- Wine DTC compliance extraction across all 51 US jurisdictions (50 states + DC), graded HIGH-confidence at extraction time
- 54 Postgres migrations, 1,273 automated tests
- 32 compliance rule keys, 52 golden eval fixtures gating regressions in CI
- 9 GitHub Actions workflows including nightly smoke tests, security scans, and Copilot rereview automation
System Architecture
The Problem
Selling beverage alcohol in the US means complying with 50+ state regulatory regimes, two distribution channels (DTC and three-tier wholesale), and constant rule changes. Existing compliance tools are enterprise-priced and split across many products; smaller producers fall back to spreadsheets and manual research.
Approach
Build the deterministic compliance and tax engine as a stand-alone rules system, with AI sitting next to it for the genuinely unstructured work: natural-language compliance questions, regulatory document extraction, expansion planning, and audit report synthesis. Use two-pass Anthropic Citations extraction so every AI-extracted rule carries a verbatim source citation back to the underlying document.
Architecture
FastAPI on Railway handles the compliance engine, background workers, and integrations (Commerce7, ShipStation, FedEx) without Vercel's 800-second function ceiling. Next.js 16 on Vercel runs the dashboard with Server Components. Supabase Postgres holds tenant data behind Row-Level Security; pgvector indexes the regulatory RAG corpus. LiteLLM proxies every LLM call with hard per-tenant and global budget caps and automatic fallback across providers. The jurisdiction-agnostic data model (jurisdiction_rules with type ENUM) supports states today, counties and territories tomorrow, international later, with zero schema changes.
Results
- Wine DTC compliance extraction across all 51 US jurisdictions (50 states + DC), graded HIGH-confidence at extraction time
- 54 Postgres migrations, 1,273 automated tests
- 32 compliance rule keys, 52 golden eval fixtures gating regressions in CI
- 9 GitHub Actions workflows including nightly smoke tests, security scans, and Copilot rereview automation
- Production deployed: API on Railway, web on Vercel, Supabase us-east-1
- Sentry observability with strict PII scrubbing
Lessons Learned
When the product needs to be 100% reliable and auditable, AI belongs next to the critical path, not inside it. Two-pass extraction with verbatim citations turns LLMs from a guessing tool into an auditable one. A jurisdiction-agnostic data model costs nothing on day one and saves a painful refactor later.