Vasuistcase study / Vasuist
A private AI workspace for compliance documentation
A private, human-reviewed AI workspace on AWS where Vasuist's experts draft gap analyses, policies and evidence packs for ISO 27001, SOC 2, DPDP and other frameworks, with every client's evidence kept strictly separate.
- Client
- Vasuist
- Industry
- Governance, risk & compliance
- Service
- Gen AI · Security & Compliance
About the client
Vasuist is a compliance consultancy that gets startups audit-ready for frameworks including ISO 27001, SOC 2, India's DPDP Act, SEBI and GDPR. AI handles the research and documentation; a senior expert reviews and owns every deliverable.
vasuist.com (opens in a new tab)The challenge
Vasuist's model depends on AI doing the heavy lifting on research and documentation, without an unreviewed document ever reaching a client and without one client's evidence touching another's. Compliance evidence is some of the most sensitive data a startup has (access reviews, architecture diagrams, incident logs), so the platform holding it had to meet the same bar Vasuist prepares its clients to meet.
What we built
- Per-client evidence storage in Amazon S3, each client encrypted with its own KMS key and locked down with least-privilege IAM
- Amazon Bedrock Knowledge Bases over framework requirements and Vasuist's control library, with retrieval filtered to one client's evidence at a time
- Drafting workflows on Amazon Bedrock for gap analyses, policies and control narratives, written against the client's actual setup rather than a template
- An AWS Step Functions review gate: every AI draft waits for an expert to approve or edit it before it can be exported to a client
- A Cognito-secured web app for Vasuist's team, served through API Gateway and Lambda, with draft and review history in DynamoDB
- CloudTrail and CloudWatch logging of every document access, generation and approval
Architecture
AWS services used
| AWS service | Role in the solution |
|---|---|
| Amazon S3 + AWS KMS | Holds each client's evidence separately, encrypted with a key per client. |
| Amazon Bedrock Knowledge Bases | Retrieves relevant framework clauses and client evidence, filtered to one client per request. |
| Amazon Bedrock | Drafts gap analyses, policies and control narratives grounded in the retrieved context. |
| AWS Step Functions | Enforces expert review: no draft can be exported until it is approved. |
| Amazon Cognito + API Gateway + Lambda | Secures and serves the workspace for Vasuist's team. |
| Amazon DynamoDB | Stores drafts, versions and the review history for each deliverable. |
| AWS CloudTrail + Amazon CloudWatch | Audit trail of every access, generation and approval, plus monitoring and alerts. |
Outcomes
- No AI-generated document reaches a client without an expert's sign-off
- Each client's evidence isolated and encrypted with its own key
- Drafts grounded in the client's own evidence and the framework text, not a generic template
- A full audit trail of who accessed, generated and approved every document
More case studies
next step
Ready to scale smarter?
Book a free 30-minute call with one of our engineers. Bring your architecture, your bill or your AI idea, and leave with a plan for what to fix first.