How IQWorks Cut Compliance Reporting Effort by 70% and Reached Production in 6 Months with AI-Native Engineering

Client

IQWorks is an AI-powered data protection and compliance platform built for enterprises handling sensitive data at scale, including regulated sectors such as pharmaceuticals and healthcare. Its users are Data Protection Officers, compliance leads, and IT security teams who need to discover, classify, and continuously govern sensitive data while meeting overlapping regulatory frameworks. Ajackus has been IQWorks’ engineering partner since the platform’s inception, running a co-build pod that has taken the product from initial concept to a production system operating under 48 documented security controls. Since this engagement, the platform has grown into a nine-product suite — adding ConsentIQ, ProtectIQ, RetainIQ, and SearchIQ alongside the original six modules — and today counts enterprise clients including Deloitte, Citi, Cipla, and Gulf Oil (also an Ajackus client) among its users.

Challenge

Before IQWorks, Data Protection Officers and compliance leads at organisations handling sensitive data had no single source of truth for where that data lived or how it moved through their systems. Data flow diagrams were redrawn by hand and were out of date almost immediately, and audit preparation meant tracking down lineage information that no tool had ever recorded.

Manual, Stale Compliance Artefacts

Data flow diagrams and Records of Processing Activities were built and maintained by hand, so they were already outdated by the time they were reviewed or approved.

No System-Tracked Lineage

Compliance teams had no way to see where sensitive data lived or how it moved between systems, and relied on chasing engineers for information nothing captured automatically.

Slow, Expensive Audit Preparation

With organisational knowledge scattered across wikis, tickets, and tribal memory, preparing for a compliance audit consumed weeks of cross-functional effort.

Multi-Framework Complexity

Organisations increasingly needed to prove compliance against GDPR, the DPDP Act 2023, and CCPA simultaneously, with no configurable way to manage overlapping rule sets against one dataset.

Regulatory and Reputational Exposure

Every manual, spreadsheet-driven step introduced room for error, and a missed or outdated compliance record carried real regulatory risk — not just an operational inconvenience.

Goals

The engagement focused on replacing manual, spreadsheet-driven compliance work with a system-of-record platform that could scale across regulatory frameworks without adding engineering overhead.

Journey

Ajackus embedded a lean, four-to-five-engineer full-stack pod directly alongside IQWorks’ product and domain teams, operating as the engineering half of a co-build partnership rather than a traditional vendor. The Ajackus team ran an AI-native workflow from day one: Claude Code as the single AI development surface for the entire team, trunk-based development with short-lived feature branches, and GitHub Actions checks — typecheck, lint, build, security review — on every pull request. That Claude-first posture carries through to production: alongside the development workflow, IQWorks’ AI-driven modules run on a multi-model inference layer that includes Anthropic’s Claude models for select reasoning tasks, chosen per use case for accuracy and safety.

Building the Shared Foundation First

The Ajackus team began by standing up a shared component library — authentication, typed database clients, a shared AI client, UI primitives, monitoring, and security headers — largely with AI assistance. That foundation is what let a five-person pod ship six product modules and multiple AI assistants without each app reinventing its own plumbing; a fix to the shared layer benefits every consuming app automatically.

Discovery, Classification, and Compliance as Data

DiscoverIQ and ClassifyIQ handle detection first: a discovery layer stacks deterministic pattern matching, curated dictionaries, and named entity recognition to establish exactly what a piece of data is and where it came from, before classification — deterministic, not AI-driven — inherits that accuracy for free. On top of that, ComplyIQ treats compliance rules as data rather than code: compliance experts author and refine rules directly in an admin panel, and the engine evaluates the organisation’s state against every applicable framework continuously. The Ajackus team deliberately chose this rules-as-data model over hard-coding compliance logic, because the alternative would have turned every regulatory update into an engineering ticket.

AIQ: Engineering the Tokenisation Perimeter

AIQ was the most complex component to build. It required training and fine-tuning multiple detection and tokenisation models against a curated attribute dataset spanning jurisdictions, engineered so sensitive values never leave the enterprise network. Before any call reaches an external model, AIQ replaces values such as a patient name or trial ID with structure-preserving tokens — NAME_23SDS23, TRIAL_B7K4X1 — so ConsultIQ and ChatIQ can reason over the shape of an answer without ever seeing the underlying identity. AI-assisted development accelerated the surrounding scaffolding — data pipelines, evaluation harnesses, deployment infrastructure — but the security-perimeter design itself was a deliberately human effort, rejecting every shortcut that could have let data leak.

Review Discipline Built for AI-Generated Code

Because AI-assisted development increases the volume of code shipped, the Ajackus team built its review process around that reality rather than against it: AI runs a custom review playbook against every diff first, but a human engineer makes the judgment call on whether the change fits the codebase’s existing patterns. Anything touching authentication, PostgreSQL row-level security policies, the tokenisation boundary, or encryption-adjacent logic requires explicit human ratification before it ships. The team also tracks lines removed as deliberately as lines added — on IQWorks’ busier applications, lines deleted run well over half of lines added, a discipline that keeps AI-accelerated throughput from becoming AI-accelerated technical debt.

Results

IQWorks moved from manual, spreadsheet-driven compliance work to an always-current system of record, with measurable gains across operations, engineering throughput, and audit readiness.

What went well:

Operational Improvements

• Record of Processing Activities effort fell by roughly 70%, moving compliance teams from weeks of interviewing engineers and populating templates to reviewing a generated baseline in hours.
• Data lineage mapping and data flow diagram production dropped by close to 100% of the manual effort previously required — a finding independently validated through a Big Four consulting review.
• Security-focused pull request review time fell from 30–45 minutes of manual checklist work to around five minutes via a custom AI-driven review workflow.
• Scaffolding a new application with authentication, shared types, database integration, and a first working feature went from one to two weeks down to one to two days.

Technical Achievements

• The platform sustains 90+ commits per week across the codebase, with complete vertical slices — UI, API, database, and tests — landing in single sprints rather than coordinated multi-sprint efforts.
• 60–70% of committed code in a typical sprint is AI-assisted (generated, refactored, or scaffolded with human review), while architectural decisions and security-critical policy writing stay fully human.
• Defect rate held steady, slightly down, despite meaningfully higher throughput — the result of tight review discipline and a zero-trust architecture with row-level security enforced at the database layer.
• On the platform’s busier applications, lines deleted run over half of lines added, reflecting active refactoring discipline sustained at pace.

Compliance Achievements

• GDPR, the DPDP Act 2023, and CCPA now run simultaneously against the same dataset, with a configurable rule engine that lets compliance experts add a new framework by authoring rules rather than requesting new engineering.
• The platform operates under 48 documented security controls across infrastructure, product, organisational, access, and data-privacy domains, with annual third-party penetration testing.
• A SOC 2 Type II audit remains in progress today, alongside GDPR, DPDP Act 2023, and CCPA compliance that IQWorks maintains and publishes on its own public Trust Center.
• Every classification decision and compliance finding carries a full, auditor-ready evidence trail, so a compliance officer can trace exactly which rule fired and why.

Platform Growth Since Launch

• IQWorks has grown from the original six modules into a nine-product suite — adding ConsentIQ, ProtectIQ, RetainIQ, and SearchIQ — now positioned as a single platform spanning AI governance, consent, discovery, classification, compliance automation, protection, and data lifecycle management.
• The classification engine now operates across 50+ languages and the platform supports 50+ global privacy regulations, up from the three frameworks (GDPR, DPDP Act 2023, CCPA) live at the time of this engagement.
• IQWorks reports that its context-aware classification approach reduces false positives by up to 73% compared with pattern-matching alone.
• IQWorks today serves enterprise clients including Deloitte, Citi, Cipla, and Gulf Oil (also an Ajackus client, profiled in Ajackus’ GoSafe case study).