An internal tool built at PingPong to unblock the queue between marketing and compliance. Submit any public-facing asset, pick where it will run, and get a jurisdiction-matched audit that cites the rule and links its source. Compliance and legal maintain the policies themselves.
At PingPong, a B2B cross-border payments platform, every public-facing word goes through internal review. Marketing signs off quickly. Compliance has to sign off too, and that is where the timeline actually lived, because a marketing asset is rarely the most urgent thing on a compliance team's desk.
Compliance had written marketing guidance, and it varied by region. In practice the team applied it from memory and asked a person when unsure, over email, which is where requests get buried. The publishing calendar bent around a queue nobody owned.
This is a cross-department problem before it is a technology problem, and it is the kind I find worth solving: a small, specific operational failure that costs a team days every month.
Internal marketing review moves fast, because the people in it are the people who wanted the asset.
about an hourInto a shared inbox with no owner, alongside everything else that department is being asked for that week.
no queue, no SLAA marketing asset is rarely the most urgent item on a compliance desk, and there is no honest argument that it should be.
about a weekThe guidance existed and varied by region. Someone recalled it and replied, leaving no record for the next person to reuse.
asked again next monthThis is a common enough problem that products exist for it. None of them fit a marketing team sitting inside a regulated payments business.
Surveillance, archiving and attestation built for a regulated firm, with the audit trail regulators expect.
They model filings and surveillance, and they are priced and scoped for the compliance department, which leaves marketing unable to self-serve, which is the actual bottleneck.
RejectedAn instant read on any text, with no setup.
They cite nothing, so a compliance reviewer cannot verify a finding, and they know nothing about which jurisdiction the asset is shipping into.
RejectedA good answer on the day you paste it, for the cost of a subscription somebody already has.
The policy goes stale inside the prompt, nothing is logged, and the next person starts from an empty box.
RejectedAll three treat the verdict as the deliverable. What legal actually wanted was the artifact around it: a time-stamped record with the rule and the source attached, which they had been assembling by hand after the fact.
The first design constraint was the audience. If compliance and risk could not maintain the rules themselves, the tool would drift out of date and the team would go back to email within a month.
So compliance and legal own their own records: they upload the approved company policy, the compliance policy, and the regional variations, and edit them in place. Marketing submits an asset and picks where it will run. The tool matches the asset to the rules for that jurisdiction and channel, and anything needing a human decision raises a notification to the right reviewer rather than an email into a shared inbox.
Everything lands in one record, which turned out to matter as much as the checking: past approved copy became searchable, so the safest phrasing for a claim was reusable instead of rediscovered.
Submit ad copy, a one-pager or a deck, choose the destination jurisdiction, and get a risk score with the phrases that caused it.
The company's own overlays, each tagged to where it applies: absolute terms, fee disclosure, testimonial wording, capital-at-risk language.
Regulation per jurisdiction with its source, from FINRA 2210 and SEC 206(4)-1 to CCPA, NYDFS Part 500 and MiCA.
Every submission kept with its score, verdict and jurisdiction, so the review history is the record rather than a thread.
Findings cite the rule and link to its source, because a compliance reviewer has to be able to check the tool rather than trust it. The verdict is advisory throughout: it tells a human where to look and leaves the decision with them.
Submit a line like "Guaranteed 15% Returns" and the tool returns three things together: the rule it breaks, FINRA 2210, the reason in a sentence a marketer understands, and a rewrite that keeps the intent. In this case "Historically targeted 15% annual returns", which is the same claim with the promise taken out of it.
The score alongside it runs 0 to 100 on risk, so a piece of copy sorts into pass, needs review or fail without anyone arguing about severity. Getting the rewrite in the same response is what changed behaviour: a flag on its own sends the draft back into the queue, while a flag with a compliant alternative ends the round trip there.
FinGuard is early work. It was among the first things I web-coded, and the version here is a public demo of the internal tool rather than the tool itself.
The idea it proved, that a rulebook is more useful as structured data than as a document, is the one that carried forward. AdGuard applied it to platform advertising policy, and CreativeOS put both in front of the writing instead of after it, so the check happens while the copy is drafted.
Marketing stopped shipping drafts that were going to come back. Compliance stopped being the first reader of obvious problems and became the last reader of real ones. The queue that used to sit between them is now a notification with the flagged lines already attached.
It is a small tool, and that is the point. It solved one operational failure between two departments, it was designed for the non-technical team that had to live in it, and it paid for itself in calendar time.
ReactThe four surfaces compliance and marketing both work in.
TypeScriptTypes for the rule records and jurisdiction tags.
ViteBuild tooling.
TailwindThe design layer.
Gemini FlashMatches submitted copy against the rules for the selected jurisdiction and drafts the compliant rewrite.
VercelHosting and the audit endpoint.
There is no vector store and no retrieval layer here on purpose. The rulebook is small, bounded and changes rarely, so matching against records beats embedding them and hoping.
Nine systems shipped, compliance, reporting, intelligence, content.
