MASSI Master's thesis2026 – ongoingIn development · Academic MVP

ConformAI-BJ

Thesis project · APDP compliance and AI-supervised security pre-audit

1. The Identified Problem

In Benin, filings with the APDP (the personal data protection authority) are still assembled by hand: scattered documents, re-typing, omissions and long correction loops. And the platform that would centralise these files would itself become a sensitive target.

2. Solution Engineered

A platform that digitises the whole cycle: guided filing, detection of the applicable regime (declaration or authorisation), documents sealed with SHA-256, then a technical pre-audit of the data controller's website (OWASP ZAP, OSV) whose findings an AI correlates and explains. The AI suggests, a human decides: every finding awaits validation and the examiner alone makes the decision.

3. Results & Measurable Impact

Security foundation delivered and tested: access control by explicit permission, tenant isolation through PostgreSQL Row-Level Security, httpOnly cookie sessions with secret rotation, audit log. 271 automated tests pass; the pre-audit and examination workflow are in development.

Research framing: problem statement, hypotheses, experimental protocol and a 24-week plan.
Wrote the PRD and the STRIDE threat model (22 threats) before the first line of business code.
Architecture: layered FastAPI API, Next.js frontend, PostgreSQL with per-organisation Row-Level Security, MinIO storage.
Hardened custom authentication: JWT in an httpOnly cookie, Argon2id, single-use refresh tokens, secret rotation, rate limiting.
Quality: pre-commit hooks and CI (ruff, mypy, import-linter, pytest, ESLint, Vitest) that block any regression.