Building a stateless, low-latency engine to handle manual ISO 27001/SOC2 audit mapping

Hey everyone,

I’m building IsoFlow Systems (isoflowai.in) to solve a manual compliance headache: chasing down screenshots and copy-pasting to map text policies onto dense GRC control frameworks.

The utility functions statelessly—accepting multi-page policy PDFs, cross-referencing audit frameworks, and outputting clean Excel files in under 15 seconds without persistent logging or storing raw text documents in a database.

Architecturally, I went with Gemini 2.5 Flash for the trial tier due to its 1M context window (bypassing multi-hop RAG entirely) and low cost, running paid enterprise tiers over secure AWS instances.

I’m officially launching on Product Hunt next week (June 15), but I wanted to drop it here first to get raw engineering feedback.

Try it out directly with your own documents or the sample dataset on the homepage. What compliance gaps or security framework exports should I map next?