Architecture

Executive Summary

Conformly.ai is an AI-powered automotive compliance analysis platform that automates the review of engineering work products against industry standards (ISO 26262, ASPICE, ISO/SAE 21434). The platform leverages LLM-based workflows, multimodal document processing, and real-time collaboration to reduce manual review effort by up to 70%.

System Architecture Overview

The architecture is organized into seven logical layers, each with clear responsibilities:

Layer	Components	Purpose
Presentation	React Web App, Marketing Site	User interface and experience
API Gateway	FastAPI, Supabase Auth	REST API, authentication, authorization
Subscription & Payments	Stripe, Profile sync, ProtectedRoute	Plan management, checkout, access gating
Workflow Orchestration	Celery, Redis, Celery Beat	Async task execution, job queuing, scheduled tasks
AI/ML Engine	LangGraph, OpenAI, Gemini, LandingAI, FAISS	Document understanding, compliance evaluation, recommendations
Analysis Engines	Gap, Completeness, Traceability, Checklist	Domain-specific compliance analysis logic
Data Layer	Supabase Postgres, Supabase Storage, Realtime	Persistence, file storage, real-time updates

Component Details

1. Presentation Layer

Component	Technology	Purpose
Web Application (`conformly-frontend`)	React 18 + TypeScript + Vite	Full-featured compliance dashboard with V-Model workflow, analysis results, traceability matrix, and export capabilities. Runs on port 8080 locally, deployed at `beta.conformly.ai`
Marketing Site (`conformly-web`)	React + Vite + Framer Motion	Product portfolio showcasing features, pricing, and trial signup. Runs on port 5173 locally, deployed at `www.conformly.ai`

Key Frontend Capabilities:

4 Review Engines accessible via V-Model workflow selector
Real-time progress tracking via WebSocket
PDF/HTML/CSV export for audit-ready reports
Shadcn/ui + Radix components with dark/light theme support
ProtectedRoute component for auth + subscription gating
Cross-project URL linking via environment variables (VITE_APP_URL, VITE_WEB_URL)

2. API Gateway

Component	Technology	Purpose
FastAPI Backend (`conformly-core`)	Python 3.11+	High-performance async REST API with automatic OpenAPI documentation. Runs on port 8000, deployed at `beta-api.conformly.ai`
Authentication	Supabase JWT	Secure token-based auth with user profiles and subscription management
Authorization	PostgreSQL RLS	Multi-tenant row-level security ensuring workspace isolation

API Endpoint Groups:

/auth/* — User profile, sync, and JWT refresh
/payments/* — Stripe Checkout session creation, webhook handling
/analysis/* — Trigger and monitor compliance analyses
/compliance/* — Completeness checks, checklist validation
/standards/* — CRUD for compliance standards
/work-products/* — Document upload and management
/traceability/* — Artifact and link management
/export/* — HTML/CSV/JSON report generation
/reports/* — Persisted reports with download

2.5. Subscription & Payments

Component	Technology	Purpose
Stripe Checkout	Stripe API	Hosted payment flow for Pro/Consultant plans
Payment Webhook	FastAPI + Stripe SDK	Processes `checkout.session.completed` and `customer.subscription.deleted` events
Profile Sync	`POST /auth/sync`	Auto-activates free plan or migrates pending paid subscriptions on login
ProtectedRoute	React component	Frontend gate that checks `subscription_status` before rendering app content

Subscription Flow: Profile Fields:

subscription_status — active or inactive
subscription_plan — free, pro, consultant, or null
Stored in the profiles table alongside user data

3. Workflow Orchestration (Pub/Sub)

Component	Technology	Purpose
Celery Workers	Celery + Redis	Distributed task execution for long-running AI analyses (25-30 min max)
Celery Beat	Scheduled Tasks	Cleanup, maintenance, and periodic reporting
Redis	Message Broker	Job queue and result backend for task state management

Task Flow:

Frontend dispatches analysis request → API creates job record
API enqueues task to Redis → Celery worker picks up
Worker executes LangGraph workflow with progress callbacks
Results persisted to Supabase → Realtime pushes status to UI

Real-time Events:

Analysis progress (0-100%)
Status transitions (pending → processing → completed)
New gap/recommendation alerts via Supabase Realtime WebSocket

4. AI/ML Engine

Component	Technology	Purpose
LangGraph	LangChain Orchestration	Stateful multi-step AI workflows with conditional logic
OpenAI GPT-4o	LLM	Requirement extraction, compliance evaluation, recommendation generation
Google Gemini	Multimodal LLM	Document understanding with vision capabilities
LandingAI ADE	Vision AI	PDF parsing with visual grounding and bounding-box evidence
Tavily	Web Agent	Standards research and reference lookup
FAISS	Vector Store	Semantic search for requirement matching and similarity

AI Workflow Stages:

Document Parsing — LandingAI extracts structured content from PDFs
Embedding Generation — FAISS indexes requirements for semantic search
Standards Matching — LLM compares work products against standard clauses
Gap Detection — Identifies missing, partial, or non-compliant content
Recommendation Generation — Produces actionable remediation steps

5. Analysis Engines (4 Core Review Actions)

Engine	Purpose	Key Outputs
Gap Analysis	Detects missing content vs. standards	Gaps by severity (critical/high/medium/low), recommendations
Completeness Check	Verifies required document sections exist	Section status (complete/partial/missing/placeholder), completeness score
Traceability Check	Enforces V-Model requirement flow	Orphan detection, broken chain alerts, ASIL inconsistencies
Checklist Validation	Applies internal review checklists (ASPICE/FuSa/Cybersecurity)	Pass/Fail/Missing/NA per item, pass rate

V-Model Traceability Chain:

Safety Goals (SG) → Functional Safety Req (FSR) → Technical Safety Req (TSR) → Design → Test → Evidence

Gap Types Detected by Traceability Engine:

orphan_upstream — Artifact has no parent/source link
orphan_downstream — Artifact has no child/implementation link
missing_verification — Requirement has no test coverage
missing_evidence — Test has no evidence/documentation
broken_chain — Gap in the V-Model chain
asil_inconsistency — ASIL level mismatch in linked artifacts

6. Data Layer

Component	Technology	Purpose
Supabase Postgres	Managed PostgreSQL	Workspaces, standards, work products, analyses, gaps, recommendations
Supabase Storage	S3-compatible	PDF uploads, generated reports, visualization images
Supabase Realtime	WebSocket	Pushes analysis progress and status updates to UI without polling
FAISS Vector Store	Local/External	Requirement embeddings for semantic similarity search

Core Data Model:

profiles — User profiles with subscription_status, subscription_plan, and role (created automatically by handle_new_user() trigger)
pending_subscriptions — Pre-signup Stripe payments awaiting user claim
workspaces — Multi-tenant project containers
standards — Uploaded compliance standards with parsed content
work_products — Engineering documents (SyRS, TSR, SSR, etc.)
compliance_analyses — Analysis runs with results JSON
compliance_gaps — Detected gaps with severity and status
recommendations — AI-generated remediation suggestions
traceability_artifacts — Extracted requirements, safety goals, tests
traceability_links — Relationships between artifacts

Supported Standards

Standard	Domain	Typical Work Products
ISO 26262	Functional Safety	Safety Plan, HARA, Safety Goals, FSC, TSC
ASPICE	Process Improvement	SyRS, SRS, SAD, SDD, Test Plans
ISO/SAE 21434	Cybersecurity	TARA, Cybersecurity Goals, Threat Scenarios

Processing & Pub/Sub Summary

Job dispatch: Celery + Redis handles long‑running analysis tasks; backend creates jobs and enqueues processing
Realtime updates: Supabase Realtime publishes progress/status for compliance_analyses and engine result tables (e.g., completeness_results, checklist_results), enabling UI progress bars without polling
Evidence visualization: Analysis persists image overlays (bounding boxes) in Storage; served via streaming endpoints

Key Design Decisions

Backend

FastAPI: High performance, async support, automatic OpenAPI docs
Celery + Redis: Background task processing for long-running analyses (up to 30 min timeout)
Supabase: Managed PostgreSQL with RLS and built-in authentication
LangGraph: Stateful AI workflows with conditional logic for compliance analysis
Structured Exports: Engine outputs persisted to dedicated tables for deterministic HTML/CSV/JSON exports

Frontend

React + TypeScript: Type-safe, component-based UI
Vite: Fast build tooling with hot module replacement
TanStack Query: Server state management with caching
Shadcn/ui + Radix: Modern, accessible UI components
Recharts: Data visualization for compliance dashboards

AI/ML

LangGraph: Orchestrate multi-step AI workflows with state persistence
OpenAI GPT-4o: LLM evaluation for extraction, compliance checks, and recommendations
Google Gemini: Multimodal document understanding with vision capabilities
FAISS: Vector similarity search for requirement matching
Tavily: Web research agent for standards lookup
LandingAI ADE: Vision-based document parsing with visual grounding and bounding-box evidence

Scalability

Component	Scaling Strategy
API	Horizontal scaling behind load balancer
Celery Workers	Independent worker scaling for analysis throughput
Redis	Redis Cluster for high availability
Database	Connection pooling and read replicas
Vector Store	Externalized FAISS index path for independent scaling
Caching	Redis for frequently accessed data and session state

Security Architecture

Layer	Control
Authentication	Supabase JWT with refresh tokens
Authorization	PostgreSQL Row-Level Security (RLS) per workspace
Subscription Gating	`check_active_subscription` FastAPI dependency; `ProtectedRoute` frontend guard
Transport	TLS 1.3 encryption in transit
Storage	Encryption at rest (Supabase managed)
API Security	Rate limiting, CORS (`ALLOWED_ORIGINS`), input validation (Pydantic)
Payments	Stripe webhook signature verification (`STRIPE_WEBHOOK_SECRET`)
Multi-tenancy	Workspace isolation via RLS policies

Infrastructure & Deployment

Component	Dev Configuration	Production Configuration
Backend (`conformly-core`)	Docker Compose with `--reload` on port 8000	EC2 Docker (no `--reload`) behind nginx at `beta-api.conformly.ai`
Platform App (`conformly-frontend`)	Vite dev server on port 8080	Vercel at `beta.conformly.ai`
Marketing Site (`conformly-web`)	Vite dev server on port 5173	Vercel at `www.conformly.ai`
Data Layer	Supabase cloud (shared)	Supabase cloud (production project)
Payments	Stripe test mode (`sk_test_`)	Stripe live mode (`sk_live_`)
Vector Indexes	FAISS on disk (configurable path via `FAISS_INDEX_PATH`)	Same
External AI	OpenAI and Google GenAI APIs; LandingAI ADE for multimodal parsing	Same

Deployment Options:

Development: Docker Compose (backend) + Vite dev servers (frontends)
Production: Dockerized backend on EC2 + Vercel frontends + Supabase cloud
Enterprise: Kubernetes with horizontal worker scaling

Key Differentiators

Multi-Standard Support — ISO 26262, ASPICE, ISO 21434 in one platform
4 Integrated Review Engines — Gap, Completeness, Traceability, Checklist
V-Model Native — Traceability analysis follows automotive development lifecycle
Visual Evidence — LandingAI provides bounding-box grounding for audit trails
Real-time Collaboration — WebSocket-based progress and status updates
Export-Ready — HTML/CSV/JSON reports for OEM/supplier audits

Implementation References

Backend Services (conformly-core/app/services/):

AI Services: ai_services.py
Completeness Analysis: completeness_analysis.py
Checklist Validation: checklist_validation.py
Traceability Analysis: traceability_analysis.py
Artifact Extraction: artifact_extraction.py
Job Service: job_service.py (Celery/Redis task management)

Backend API Endpoints (conformly-core/app/api/v1/):

Auth & Sync: auth.py — /auth/me, /auth/sync, /auth/refresh
Payments: payments.py — Stripe Checkout, webhooks
Analysis: analysis.py — Gap analysis, evidence mapping
Compliance: compliance.py — Completeness, checklist
Traceability: traceability.py — V-Model chain, matrix
Export: export.py — HTML/CSV/JSON

Backend Core (conformly-core/app/core/):

Auth: auth.py — JWT verification, SupabaseAuth, UserProfile hydration
Config: config.py — Environment variable loading (CORS, Stripe, etc.)

Backend Models (conformly-core/app/models/):

User: user.py — UserProfile, UserProfileResponse (includes subscription_status, subscription_plan)

Platform Frontend (conformly-frontend/src/):

Protected Route: components/ProtectedRoute.tsx — Auth + subscription gating
Signup: pages/Signup.tsx — User registration
Subscribe: pages/Subscribe.tsx — Subscription required page
Compliance Workflow: pages/ComplianceWorkflow.tsx — V-Model workflow
Dashboard: pages/Dashboard.tsx
API Types: api/types.ts — UserProfile interface

Marketing Site (conformly-web/src/):

Navigation: components/Navigation.tsx — Links to platform via VITE_APP_URL
Hero: components/Hero.tsx — CTA buttons linking to platform

Database (conformly-core/schema.sql):

profiles table with handle_new_user() trigger
Role CHECK constraint (admin, engineer, manager, viewer)

Email Templates (conformly-core/email-templates/):

confirm-email.html — Branded email confirmation
reset-password.html — Branded password reset

Backend Overview

Learn more about the backend API architecture

Review Actions

Deep dive into the 4 core analysis engines

Getting Started

Backend API

Guides

Executive Summary

System Architecture Overview

Component Details

1. Presentation Layer

2. API Gateway

2.5. Subscription & Payments

3. Workflow Orchestration (Pub/Sub)

4. AI/ML Engine

5. Analysis Engines (4 Core Review Actions)

6. Data Layer

Supported Standards

Processing & Pub/Sub Summary

Key Design Decisions

Backend

Frontend

AI/ML

Scalability

Security Architecture

Infrastructure & Deployment

Key Differentiators

Implementation References

Backend Overview

Review Actions

Getting Started

Backend API

Guides

​Executive Summary

​System Architecture Overview

​Component Details

​1. Presentation Layer

​2. API Gateway

​2.5. Subscription & Payments

​3. Workflow Orchestration (Pub/Sub)

​4. AI/ML Engine

​5. Analysis Engines (4 Core Review Actions)

​6. Data Layer

​Supported Standards

​Processing & Pub/Sub Summary

​Key Design Decisions

​Backend

​Frontend

​AI/ML

​Scalability

​Security Architecture

​Infrastructure & Deployment

​Key Differentiators

​Implementation References

Backend Overview

Review Actions

Executive Summary

System Architecture Overview

Component Details

1. Presentation Layer

2. API Gateway

2.5. Subscription & Payments

3. Workflow Orchestration (Pub/Sub)

4. AI/ML Engine

5. Analysis Engines (4 Core Review Actions)

6. Data Layer

Supported Standards

Processing & Pub/Sub Summary

Key Design Decisions

Backend

Frontend

AI/ML

Scalability

Security Architecture

Infrastructure & Deployment

Key Differentiators

Implementation References