01
Text extraction
Independent of the starting format (PDF, DOCX, EML, TXT). The content is normalised into structured text the LLM model can read unambiguously.
AGENT · COMPLIANCE SCAN
Pre-screening contracts, before they leave.
Compliance Scan intercepts emails, contracts, and documents at the moment they are about to ship. It recognises personal data in cleartext, sensitive regulatory references, and parameters outside the threshold. It decides whether to pass, flag, or block; and leaves a trace of every decision.
The moment a document leaves is the least supervised in the legal-commercial process. Pre-screening either arrives too late, after the contract is already signed, or too early, with preventive reviews no one really runs. Compliance Scan lives in the in-between window: it activates when a document is about to leave, reads it, decides.
Decisions come in three kinds. Silent approval: the document is in order, the event lands in the registry, and the send continues without the person who clicked even noticing. Flag: something is off but not blocking; the sender receives a notice with the concrete correction to apply and decides whether to proceed anyway, leaving a reason. Block: the document falls outside company policy; the send stops and a structured escalation to compliance or legal kicks off.
Every decision is recorded in an immutable way and remains inspectable by the compliance team with a standard SQL client.
Four steps that work in seconds.
The flow is linear and consists of four steps that run in a few seconds. The diagram block below shows the path of a document from interception to final decision.
02
Document classification
Contract, commercial offer, NDA, customer communication, internal brief. The classification determines which rule set applies.
03
Application of the configured rules
The rules are declarative, written by the compliance team, versioned. Examples: presence of required clauses, amount thresholds, list of data that must not appear in cleartext.
04
Built-in controls step in
In parallel with the rules, four built-in controls work on the document: pii-detector, credential-detector, topic-guardrail, tool-domain-filter. Outcome summarised as pass / flag / block with reason.
The four controls are part of Polyant's ten built-in controls. The other six (prompt-injection, system-prompt-leakage, tool-rate-limit, message-length-limit, internet-access, tool-param-validator) operate on the agent in general, not on the per-document pre-screening logic.
The native channels on which the agent receives triggers are Telegram, Slack, WhatsApp, and OpenAI-compatible HTTP. Interception of corporate email, electronic signature flows, and document management systems happens via dedicated integration, built by the Exelab team during delivery on the customer's real systems.
Four business areas, one horizontal agent.
Compliance Scan has value for four business areas. Compliance gains proactive control over the contract flow, no longer reactive to complaints or audits. The DPO has an ally that identifies personal data in cleartext before it leaves the company, reducing accidental data breaches. Legal sees only the cases that require human judgement, because the first filter is automatic. Sales does not chase legal on every contract: the cases in order pass straight through, the others go back to the commercial team with the concrete correction to apply.
The agent is horizontal: any industry with regulatory constraints on contracts and customer communications finds a use case. Banking, insurance, healthcare, utility, public administration: the configured rules change, not the agent.
Compliance Scan works well on its own, but the most frequent use case is inside a squad of specialist agents: together with an intake agent, a document pre-screening agent, and a reconstructable-audit agent. Typical squads by industry (Claims insurance, Banking onboarding, Healthcare triage, Multi-channel compliance) live on the /industries and /agents pages.
A blocked proposal, a traced decision.
A commercial proposal for a regulated financial service is generated by the internal system and ready to be sent to the customer. The system intercepts the message before it leaves the company, extracts the text of the three attachments, classifies the document as "corporate offer to be submitted for legal review". The rules configured for that type apply; in parallel, the built-in controls do their job.
Two signals trigger. The pii-detector finds a third-party beneficiary fiscal code left in cleartext in the detailed quotation; the topic-guardrail flags a paragraph describing an automated scoring system without reference to the required disclosure. Outcome: block with structured reason, two textual alternatives ready to use, an option to anonymise the fiscal code.
The send stays on hold. The commercial person receives the notification, picks the alternative, applies the correction, re-reads, sends. The case, the rules triggered, the decisions of the controls, the handling time, and the final outcome land in the registry. The compliance lead will see the trace the next day, in the dashboard, without having to open a ticket.
Declarative rules, configurable thresholds, immutable registry.
The rules are declarative, written in a readable format, versioned in the customer's repository, and validated at agent startup. The compliance team writes a rule, tests it in a development environment, promotes it to production. Without writing code.
- Language
- TypeScript (Node.js)
- License
- AGPLv3
- LLM model
- customer's choice: Anthropic, OpenAI, Mistral, open source models hosted internally, AWS Bedrock for a private model
- Built-in controls
pii-detector,credential-detector,topic-guardrail,tool-domain-filter- Thresholds
- configurable per instance and per document type (zero / medium / high tolerance)
- Rules
- declarative, versioned in Git, validated at agent startup
- Native channels
- Telegram, Slack, WhatsApp, OpenAI-compatible HTTP
- Integrations
- email, electronic signature, DMS: delivered by the Exelab team in professional services projects
- Decision output
- silent approval / flag with correction / block with reason + alternatives
- Registry
- immutable, queryable with a standard SQL client
The built-in controls have thresholds configurable per instance: pii-detector can run zero-tolerance for external communications and medium-tolerance for internal channels; topic-guardrail loads different topic lists for each line of business.
Getting started with Compliance Scan.
30 MINUTES, NO SLIDES
Talk to the team
A 30-45 minute conversation to understand whether Compliance Scan solves a real customer case, and how it would be configured for the industry.
Book a call TECHNICAL DOCUMENTATIONOpen the documentation
Reproducible setup, declarative rule examples, hooks for email and electronic signature integrations.
Open the docsFive questions about the agent.
The rules are written by the customer's compliance team in declarative format, versioned in the repository and validated at agent startup. The agent runs what the rules say. The decisions of the built-in controls are inspectable in the registry, one by one, with rule triggered and reason.
The built-in controls have thresholds configurable per instance and per document type. The topic-guardrail topic lists are loaded per business line, the pii-detector tolerances change between external communications and internal channels. The declarative rules add required clauses, amount thresholds, regulated vocabulary for the industry.
Every decision is inspectable, and the outcome of each rule is traced separately. When a block is deemed excessive, the compliance team rereads the case, modifies the rule, promotes it to production. The rules' improvement stays inside the customer's team, it does not go through an external supplier.
The native channels are Telegram, Slack, WhatsApp, and OpenAI-compatible HTTP. Email interception, electronic signature flows, and document management systems are handled with dedicated integration, built by the Exelab team within delivery, on the customer's real systems. The agent integrates quickly with any system the customer already uses.
Yes. The registry is immutable, queryable with a standard SQL client, without going through a proprietary console. For the DPO this means that the check does not depend on the vendor: the logs stay inside the customer's infrastructure, in readable format, even months later.