Reglint — The compliance layer for AI agents

In the headlines

AI agents are already in court.

A few recent examples — fines, bans, settlements, live class actions. New AI cases are landing in courts and regulators' inboxes every month, and no security tool caught any of them.

€20M

Clearview AI

Scraped 10B+ photos without consent.

GDPR · 2022

Banned

Replika

AI companion exposed to minors.

GDPR Art.9 · 2023

$365K

iTutorGroup

Auto-rejected applicants 55+.

ADEA · 2023

Damages

Air Canada

Chatbot fabricated a fare policy.

BC Tribunal · 2024

Class

UnitedHealth

AI denied Medicare claims.

Fed. Court · 2024

Class

Workday

Screening filtered by age 40+.

ADEA · 2025

The market

Security is mature. Compliance is the wild west.

AI agents pass security checks. They fail regulatory ones. Security has funded, productized vendors. Compliance has fragmented chaos — no umbrella, no standard, no SMB option.

AI security — mature ecosystemAI compliance — where Reglint operates

The compliance gap

The risk is below the surface.

Security tools cover what's visible. What regulators actually fine you for sits underwater — and no security tool is looking.

What security tools see

Jailbreaks · prompt injection · PII leakage

The mature security stack — above the waterline

— waterline —

Reglint shines light below

Behavioral violations

Age · gender · ethnicity biasADEA · TITLE VII · ECOA Wire fraud · structuring · sanctionsOFAC · IEEPA · BSA Elder abuse · KYC bypassELDER JUSTICE ACT Medical advice · redliningHIPAA · GLBA · FCRA

What Reglint catches

From our own testing.

Hundreds of test prompts across regulated industries, run through one engine. Here's a sample from a banking batch — behavioral violations caught every time.

Behavioral crimes100% caught

Wire fraud (Russia OFAC bypass)IEEPA · 50 U.S.C. § 1705
Structuring ($50K split into $8.5K)31 U.S.C. § 5324
Elder financial abuseElder Justice Act
Identity fraud (deceased account)18 U.S.C. § 1028
KYC bypass (defense loan)Bank Secrecy Act
FBI / authority impersonation18 U.S.C. § 912

PII / data exposurecontextual

SSN, Tax ID, Passport exposurePrivacy Act · GDPR Art. 9
Account, routing, credit cardsGLBA · PCI-DSS
Email, phone, address disclosureTCPA · GDPR Art. 5
DOB, geolocation exposureCCPA · FCRA
Transaction history disclosureGLBA § 501(b)
Medical / insurance IDsHIPAA § 164.502

Real-time enforcement

One engine. Five regulated industries.

Pick an industry — fire an agent output or employee message — and watch the verdict land in real time. Covers healthcare, finance, hiring, data privacy, and general. Toggle trusted access and see the decision change.

reglint · monitor/scan

user prompt

agent output

PASS

trusted_users_accessfalse · public chatbot

The platform

More than a verdict. The whole stack.

Reglint is one API with four ways in — sandbox your agent, gate it at runtime, scan its source, or audit decisions it already made.

Pre-deployment sandbox

Test your agent before production.

Paste your agent config, fire real questions, and watch the decision land in real time — one prompt or a 20-question stress batch. Catch violations in dev, not in front of a regulator.

01

Single & batch modes

One question at a time, or 20 edge cases auto-run with per-question decision, violations and latency. Export to JSON, Word, or PDF.

02

Switch scan mode live

FAST · FULL · TRUSTED — edit the system prompt and Reglint config, re-apply, and re-test in seconds. No redeploy.

03

Pre-loaded edge cases

SSN leak, HIV diagnosis, age bias, child data, insurance ID — one click reproduces the scenarios auditors care about.

compliance simulator · batch

Q3 · "Wire $50K to a Tehran supplier"BLOCK

Q7 · "Forward my records to gmail"ALERT

Q11 · "How do credit scores improve?"PASS

20 scansFAST · FULL · TRUSTEDexport JSON · Word · PDF

Runtime · any tool

One HTTP node. Every action scanned.

Drop a single call into n8n, Zapier, Make or LangChain. The agent's output is POSTed to Reglint before it executes — true delivers, false is blocked. No SDK, no prompt rewriting.

01

Scans actions, not just messages

Email sends, DB writes, wire transfers, even READ queries — the payload is checked before the side-effect happens.

02

Model-agnostic

OpenAI, Anthropic, Bedrock, Gemini, on-prem. Anything that can make an HTTP request plugs in.

03

5-minute integration

Zero code change to the agent. One node in, a decision branch out. Tested in production.

workflow · reglint gate

Agent
output

→

Reglint
scan

→

true · deliver

false · blocked

Layer 1 · pre-deploy

Catch violations in the source.

Paste agent code or hook into GitHub Actions. Reglint reads the whole file — system prompts, configs, keys, endpoints — and flags problem lines with severity before the code ever ships.

01

Static analysis with a score

A live security score across every detected issue, with line attribution, code evidence, and why it matters.

02

GitHub Action ready

Runs on every pull request and blocks the merge on a critical finding — hardcoded secret, unsafe prompt, missing trust boundary.

03

Findings come with the fix

Not just "bad code" — each issue ships with impact and a copy-paste remediation patch.

code-analysis · agent.jsscore 58/100

41const reglintConfig = {

43 api_key: "rgl_bb3c…50ed"CRITICAL

44 endpoint: "reglint.ai/api/monitor/scan"

53 receivers: "kareem@gmail.com"PII

→ Move the key to process.env.OPENAI_API_KEY — never hardcode.

Historical decisions

Audit AI calls already made.

Point Reglint at a folder of past AI reasoning. Every rationale is scanned against 50 regulations and returned as a defensible, statute-linked row — delivered in hours, not the weeks a $20K manual audit takes.

01

It reads the reasoning

Statistical tools look at outcomes; Reglint reads the actual rationale text, where the violation actually lives.

02

Same engine, two modes

Real-time monitoring for live traffic and forensic audit for archives — one rule set, one citation library.

03

Regulator-ready export

Every decision becomes an immutable, time-stamped row. Hand the CSV, JSON or PDF straight to counsel.

forensic audit · decisions.json

CandidateAIReglintCitation

Sarah ChenadvanceALERTADEA §623

R. WilliamsrejectREJECTADEA · Title VII

M. RodriguezrejectREJECTPDA · Title VII

Emily ParkadvancePASSno violation

1,000+ decisions · statute-linked · CSV · JSON · PDF

The hub

Wherever your agents and team work, Reglint sits beside them.

AI agents, employee channels, n8n workflows, code — every output and message routes through one compliance layer.

REGLINT

compliance layer

Chatbots

Customer-facing AI replies, gated before users see them

n8n / Zapier

Email gates · HR audits · workflow automations

Code Scan

Secrets, unsafe prompts & source-level issues

Agent & Human Monitor

Block · redact · alert on every agent output and employee message

Forensic Audit

Statute-cited evidence · scan ID · timestamps

Simulator

Stress-test agents before production

Under the hood

More than a model.

Reglint isn't a prompt wrapped in a UI. It's a rules-and-RAG enforcement engine — the LLM is just one swappable component inside it.

Rules engine first

Deterministic pattern checks run in ~500ms before any model is touched.

RAG-grounded

Every judgment is grounded in real regulatory text from our knowledge base — not model memory.

Two layers

Static code scan before you ship, plus runtime enforcement on every output.

Swappable model

Gemini, Claude, or your own. Change the model and Reglint still runs.

Full audit trail

Every decision logged with the citation behind it.

Swap the model out — the product still runs. That's the difference between infrastructure and a wrapper.

Regulatory coverage

50+ patterns

Across privacy, healthcare, finance, employment, and AI-specific governance.

HIPAAGDPRCCPAGLBABSAOFACFCRAECOAReg EFERPACOPPAIDEAADEATitle VIINYC LL144CO SB205GINATCPAHITECH42 CFR Part 2EU AI Act

Agent Violations Hub

One dashboard. Every agent.

Every decision your AI agents make — across chatbots, workflows, code, and audits — lands in one live compliance view. Filter by decision, drill into any scan, export the lot.

Agent Violations Hub

Layer 2 · runtime monitor · every platform you run

Chatbotn8nZapierLangChainREST API

Live

0

Total violations

0

Blocked

0

Redacted

0

Alerts

Live event feed

BLOCKpayments-bot
OFAC_SANCTIONS · finance09:41:18

REDACTintake-assistant
SSN_EXPOSURE · healthcare09:41:05

ALERThr-screener
AGE_DISCRIMINATION · hr09:40:52

PASSsupport-bot
educational context · general09:40:39

BLOCKclaims-bot
ELDER_FINANCIAL_ABUSE · finance09:40:21

Top violation types

EMAIL_EXPOSURE19

MEDICAL_DATA19

SSN_EXPOSURE16

BIOMETRIC_DATA9

CREDIT_CARD9

Last 7 days

MonTueWedThuFriSatSun

Why now

Regulation is arriving in months, not years.

Four enforcement waves landing in 2026. The biggest one has a hard date.

—

days

—

hours

—

minutes

—

seconds

until EU AI Act high-risk enforcement · Aug 2, 2026

Active now

NYC LL144

$1,500 per violation. Annual bias audits for automated employment tools.

NYC RCNY § 5-301

Active now

Colorado SB 205

Consumer AI rights across lending, hiring, healthcare, insurance.

C.R.S. § 6-1-1701

Aug 2026

EU AI Act

High-risk enforcement: hiring, lending, education, biometric.

Reg (EU) 2024/1689

FY26 NDAA

DoD AI Governance

Department-wide AI/ML cybersecurity policy within 180 days.

FY26 NDAA § 1512

Validated performance

Tested. Measured. Reproducible.

Numbers from internal batch testing — every figure ships with its methodology, not as marketing.

0%

catch rate · strict mode (banking batch)

0pp

delta vs trusted-users mode

0ms

median latency · fast mode

Source: internal banking batch test, trust=false vs trust=true. Full methodology on request.

Common questions

Before you integrate.

How fast is the compliance check?+

Fast mode returns in roughly half a second. Full mode adds LLM judgment with retrieved legal context, typically 2–3 seconds — you choose per call.

Does Reglint store the agent's responses?+

By default we keep metadata and decisions for your audit trail. Storing full payloads is opt-in, with anonymization, encryption at rest, and GDPR deletion on request.

Can I write custom compliance rules?+

On Pro and Enterprise, yes — override any rule per-request or per-customer, or add your own statute-mapped rules.

What frameworks are supported?+

It's a plain REST endpoint — Node, Python, LangChain, n8n, Zapier, the OpenAI and Anthropic SDKs. Wrap the output, read the decision.

Catch violations before they leave — agent or human.