ComplyCheck

Orientation only. Not legal advice. Verify with a qualified professional.

The checklist you run before paying a lawyer. Two ways in, one engine:

1. The website (also self-hostable on GitHub Pages, runs 100% in your browser): answer ~12 general questions, get a checklist of regulatory, tax, registration, privacy, and licensing items to verify — every item linked to an official government source.
2. The codebase scanner + agent framework: point it at your repo. It finds the compliance-relevant evidence (payment SDKs, analytics, auth, AI usage…), proposes answers with file:line receipts, and — with Claude Code or any LLM driving the step-by-step framework in agents/ — walks you from this file, this line to verify this regulation.

npx complycheck          # interactive questionnaire → compliance/checklist.md
npx complycheck scan     # scan this codebase → evidence-backed answer proposals
npx complycheck ui       # the website, served locally (127.0.0.1, offline)

## Before launch — Privacy & data  🔴 high
- [ ] **Review whether India's DPDP Act applies to you — and its phased deadlines**
      ↳ Sources: [MeitY — Data protection framework](https://www.meity.gov.in/data-protection-framework)
      ↳ Why you're seeing this: user regions = in; stores personal data = true

Why this exists

Founders' regulatory orientation today is: ask an LLM and hope, read five SEO blog posts by compliance vendors, or pay $400/hr for questions a checklist could have scoped. Everything in between is enterprise SaaS ($6k–80k/yr), single-purpose policy generators, or single-country government tools nobody can find.

ComplyCheck is the missing thing: open source, local-first, deterministic, multi-jurisdiction, cross-domain — and free.

How it works (and why you can trust it)

• Deterministic rules engine, no AI required. Your answers are matched against community-maintained YAML packs by a ~300-line condition evaluator. Same answers → byte-identical checklist. Every item shows why it triggered.
• Official sources only. Every item links to government/regulator domains (CI-enforced allowlist). ComplyCheck routes you to authorities; it doesn't paraphrase them from memory.
• Honest about its age. Every pack carries a last_reviewed date. Packs older than 12 months print a warning at runtime; older than 24 months, a loud one. An unmaintained ComplyCheck degrades honestly instead of rotting silently.
• Local-first, zero telemetry. No server, no accounts, no network calls at runtime. Your answers never leave your machine. (The privacy tool is trivially privacy-clean.)
• Verification language, mechanically enforced. Items say "Review… / Check… / Confirm…", never "You must…". CI rejects packs that instruct instead of orient.

What it will never do

Generate legal documents · file anything · give advice · run a server · collect data · charge money. See DISCLAIMER.md.

Coverage

| Pack | Coverage | |---|---| | 🇮🇳 India | deep — MCA/GST/income tax/DPDP/RBI flags | | 🇺🇸 United States | deep — federal + Delaware + California sub-packs | | 🇪🇺 European Union | basic — GDPR, cookies, AI Act, VAT OSS, consumer, DSA | | 🇬🇧 United Kingdom | basic — Companies House, HMRC/VAT, UK GDPR + ICO fee, PECR, consumer, employers, FCA, Online Safety Act | | 🇸🇬 Singapore | basic — ACRA, IRAS/GST + overseas-vendor, PDPA (DPO), consumer, CPF, MAS | | 🇦🇺 Australia | basic — ABN/ASIC + director ID, ATO/GST + remote sellers, Privacy Act/NDB, Spam Act, ACL, super, AUSTRAC | | 🇨🇦 Canada | basic — incorporation, GST/HST + remote sellers, PIPEDA, Quebec Law 25 + French, CASL, Competition Act, payroll, FINTRAC | | Industries | SaaS, e-commerce, marketplace, open-source, content, mobile, agency, AI, fintech*, healthtech*, education |

* deliberately shallow by policy: regulated sectors get "identify your regulator, get counsel early" — depth there would be irresponsible.

Add your country in an evening — packs are pure YAML, no code. See CONTRIBUTING.md.

Usage

npx complycheck                              # interactive
npx complycheck scan [path]                  # codebase → proposed answers + evidence
npx complycheck ui                           # local web UI
npx complycheck --answers compliance/answers.yaml   # non-interactive re-run
npx complycheck --out my-dir --mode checklist --json --explain

Answers persist to compliance/answers.yaml; re-runs preserve your checked boxes. Commit the compliance/ folder and treat the checklist as a living document.

Scan your codebase (the fast path)

npx complycheck scan walks the repo (read-only, offline, deterministic) and detects payment SDKs, analytics/tracking, auth code, AI SDKs, mailers, storefronts, mobile projects, and finance/health signals — across package.json, requirements.txt, pyproject.toml, go.mod, Gemfile, composer.json, .env.example files, and page source. It writes:

• compliance/scan-report.json — every signal with file:line evidence
• compliance/answers.draft.yaml — proposed answers, each annotated with its evidence; human-only facts (country, entity, revenue, regions, employees) left for you

Review the draft, fill in the human facts, save as answers.yaml, run the engine. The scanner never decides obligations, never proposes "no", and never reads real .env files.

For agents (Claude Code, Codex, Gemini, …)

The step-by-step framework in agents/ turns any coding agent into the reviewer: scan → verify each proposal against the code → sweep for what grep can't see (children's products, marketplace dynamics, sensitive data models) → confirm every fact with the user → run the engine → explain each item through its evidence chain. Ships as a Claude Code skill (agents/claude-skill/complycheck/) and a vendor-neutral prompt pack (agents/prompt-packs/generic.md). The agent proposes facts; only the engine produces obligations.

The website

The web UI is a static site — the engine bundled for the browser; answers never leave the machine. npm run build:site emits site/, and .github/workflows/pages.yml deploys it to GitHub Pages on every push to main (enable Pages → "GitHub Actions" in repo settings).

Development

npm install
npm run build      # compile packs → validate → bundle CLI/engine/UI
npm test           # unit + engine + snapshot tests
npm run dev        # run CLI from source
npm run linkcheck  # verify all source URLs still resolve (network; CI-monthly)

The engine is dependency-free TypeScript that also runs in the browser (the web UI is the same engine, bundled). Runtime dependencies: js-yaml, @clack/prompts. That's the whole supply chain.

License

Code: Apache-2.0 · Packs: CC-BY-4.0