Ledger GRC — Tool Guide

Core Purpose

Cited-answer AI copilot for Saudi regulatory/compliance content (GRC domain)
Answers grounded strictly in ingested source documents — no hallucination, every claim traceable to a source excerpt

Personal/small-team prototype for a GRC professional
Extended to a closed test group of office colleagues (invite-only, no public signup)

Regulatory + Standards & Frameworks categories only — NCA, DGA, SDAIA/NDMO public regulatory documents and standards
No internal/proprietary organizational documents

Frontend: Next.js + Tailwind, deployed on Netlify
Database: Supabase (Postgres + pgvector), RLS enforced on all tables
AI: OpenAI (text-embedding-3-small for embeddings, GPT chat model for answers), provider-agnostic via env vars (base URL swappable, e.g. to OpenRouter)
Auth: Supabase Auth — admin-invite-only signup, email/password, forgot-password flow, TOTP MFA required for admin actions specifically
Roles: Admin (document ingestion, user invites) vs. User (chat only)

Chat: ask natural-language questions, get grounded answers with inline expandable citations
Citations: qualitative match label (Strong/Good/Possible Match) derived from cosine similarity, real document title + authority shown, source clause text on expand
Query typo-normalization: LLM pre-processes spelling before embedding/retrieval
Sources tab: read-only list of all ingested documents by category
Audit trail: real Q&A history log with citations
Chat sessions: persistent, sidebar history, auto-generated titles, user-renameable
Admin ingestion page: upload documents, auto-chunk (structure-aware, by control/clause boundaries), auto-embed, similarity-threshold filtering on retrieval (~32% floor)
PWA: installable to home screen (iOS/Android)
Branding: "Every Answer, Cited!" tagline, custom logo/icon, copyright footer

User:

Admin: