Catch compliance risks before they ship
Scan merged PRs and tickets for legal exposure, score the risk, and flag policy drift.
Compliance review happens too late. Legal sees the feature after it ships — or never. The product adds a tracking pixel, starts storing a new category of personal data, or opens a new data flow to a subprocessor, and the Privacy Policy quietly stops being true. By the time anyone notices, the fix is a retroactive scramble instead of a one-line change in a PR. This workflow reads the merged PRs and tickets where that information already sits — with a legal eye.
What does this workflow do?
On a daily or weekly schedule, the agent reads the merged PRs and updated Linear tickets since the last run and asks one question of each: does this change what the company does with data, money, or users' rights? Most changes don't, and get logged as compliant. The ones that do get a risk score from 0 to 10 and land in a briefing with a plain-language explanation of what changed and which obligation it touches.
The agent also holds your live legal documents — Privacy Policy, Terms of Service, DPA — against what the product now actually does. When a shipped change contradicts a documented claim, that's a finding, with the exact clause and the exact change side by side.
How does it work?
- Connect your sources. Point the agent at your GitHub repos and Linear workspace, and at wherever your legal documents live. It builds an internal map of what your documents claim: what data you collect, who processes it, what users are promised.
- Scheduled sweep. Each run, the agent reviews merged PRs and new or updated tickets since the last sweep. Dependency bumps and refactors pass through silently. Changes touching personal data, payments, tracking, permissions, retention, or messaging get a closer read.
- Risk scoring. Every flagged change gets a 0-10 score in three bands: Informational (0-3), Review Recommended (4-6), Review Required (7-10). Each finding names the obligation at stake — GDPR article, ToS clause, DPA commitment — not just "this looks risky."
- Drift detection. Findings are checked against your legal documents. A PR that adds session recording while the Privacy Policy says nothing about it becomes a drift finding with a suggested amendment, ready for legal to accept or rewrite.
- Briefing and audit trail. Results go out as a briefing to Slack: what shipped, what's flagged, what drifted. Every finding, score, and decision is logged with a timestamp, so when an auditor or a customer's DPO asks "how do you catch this?", the answer is a link.
Why score instead of just flag?
Because a binary flag either cries wolf or stays silent. A cookie-banner copy tweak and a new subprocessor are both "compliance-relevant," but only one needs a lawyer today. The bands let Informational findings accumulate quietly in the log while Review Required goes straight to a named owner who must sign off — and the threshold is yours to move.
Why start from PRs and tickets?
Because that's where the truth is. The marketing site says what the company means to do; the codebase says what it does. Lawyers reviewing a spec see the plan. An agent reading the merged PR sees the tracking script that got added along the way. Tickets add the forward view: a planned feature with legal implications gets flagged while it's still cheap to change.
Works with
GitHub, Linear, Slack, Notion, Google Docs. Runs on a daily or weekly schedule; legal documents are re-read each run so edits are picked up.
Frequently asked questions
How does it know which PRs matter?
It reads the diff and the description, not just the title. Changes touching data models, third-party SDKs, analytics, auth, payments, or user-facing copy get a closer read. Everything else is logged as reviewed and passed.
Will it drown us in false positives?
The bands exist for exactly this. Informational findings accumulate quietly in the log; only Review Recommended and above appear in the briefing. When you dismiss a finding, the agent learns the pattern and stops raising it.
Does it replace legal review?
No. It replaces legal not knowing. The agent surfaces and scores; a human decides. Every Review Required finding routes to a named owner, and nothing is marked resolved without their sign-off.
What about changes it can't verify from code?
When a rule can't be checked from the connected tools — say, whether a manual offboarding step actually runs — the agent asks the responsible person directly and logs their confirmation.
Can it update the legal documents itself?
It drafts the amendment; it never publishes. Suggested changes to the Privacy Policy or ToS arrive as proposals with a redline, for legal to accept, edit, or reject.