AI Contract Analysis & Risk Detection
Faster document review with traceable evidence — upload a contract and get risk findings with source-verified citations.
Built by naman · AI Developer Intern
The system, up close
Real captures from the running system — the demo, screenshots and architecture come first, then the deep dive.
Demo
A walkthrough of the reviewer dashboard: contract upload, automatic analysis and evidence inspection.
Demo shows the landing page, contract upload, risk findings and source-passage inspection.
Screenshots
Architecture
Why this needed to be built
Contract review is one of the most time-consuming and repetitive tasks in legal practice. Reviewers must manually read dense legal documents to identify unfavorable or one-sided terms, missing critical protections, ambiguous liability or IP clauses, unfavourable governing law or jurisdiction terms, and payment and termination risks.
An AI-assisted system can accelerate this process by automatically extracting key information, identifying common risk patterns, and providing evidence-backed findings — all while maintaining traceability to the original source document.
What we built, and how it changes the workflow
We built a full-stack document-intelligence system — FastAPI backend with a React reviewer dashboard — that turns a raw contract PDF into a structured, evidence-backed analysis.
A reviewer uploads a PDF. The system validates the file, extracts page-preserving text, normalizes and chunks the document, identifies clauses and sections, indexes it into a vector store, detects up to 12 predefined risk categories, and verifies every finding against the source.
A built-in retrieval-based Q&A lets reviewers ask questions about the contract and get evidence-grounded answers that cite the exact page, section and chunk. Every risk finding carries its evidence quote, page number, section and confidence score, so the human makes the final call.
What it can do
A focused set of capabilities that define the system — no marketable filler, only what actually runs.
PDF upload with validation
Drag-and-drop upload with type, size and MIME checks, filename sanitization and safe temporary storage.
Page-preserving extraction
Text extraction via pdfplumber with a PyPDF2 fallback, keeping page boundaries intact.
Normalization & chunking
Clause-aware text normalization and chunking (size 500 / overlap 100) for reliable retrieval.
Vector retrieval
ChromaDB vector store with sentence-transformers (all-MiniLM-L6-v2) embeddings for semantic search.
Retrieval-based Q&A
Evidence-grounded question answering over the contract via an OpenRouter LLM, with source references.
12 risk categories
Termination, automatic renewal, indemnification, liability, IP, confidentiality, governing law, payment, notice and data privacy risks with severity levels.
Evidence tracing
Every finding links back to its source with page, section and chunk references for full traceability.
Security hardening
Path-traversal prevention, safe temp storage, prompt-injection defence and environment-only secrets.
The end-to-end workflow
The system processing path, in order.
- 1
Upload
Reviewer uploads a PDF contract through the dashboard.
- 2
Document validation
Type, size and MIME are checked before anything is processed.
- 3
Text extraction
Page numbers and document structure are preserved during extraction.
- 4
Normalization & chunking
Text is cleaned and split into clause-aware chunks.
- 5
Clause identification
Sections and standard contract clauses are detected.
- 6
Vector indexing
Chunks are embedded and stored in ChromaDB for retrieval.
- 7
Risk detection
12 predefined risk categories are checked against retrieved evidence.
- 8
Evidence verification
Each finding is verified against the source passage before output.
- 9
Structured analysis
A Pydantic-validated summary, severity breakdown and findings are rendered for the reviewer.
Stack & tech choices
- Language
- Python 3.11+
- Backend
- FastAPI, Uvicorn
- Document processing
- pdfplumber, PyPDF2
- Embeddings
- sentence-transformers (all-MiniLM-L6-v2)
- Vector database
- ChromaDB
- LLM provider
- OpenRouter API
- Validation
- Pydantic v2
- Frontend
- React 18, TypeScript, Vite, Tailwind CSS, Axios, React Router v6
- Testing
- pytest, pytest-asyncio, httpx
- Deployment
- Docker, Docker Compose
Tested, verified and honestly scoped
Validation & tests
A reproducible test suite (32 tests) covers unit, integration, security and edge-case scenarios across the full pipeline.
- Unit — text normalization, chunking, document validation, clause detection and hallucination checks
- Integration — health check, upload validation, analysis pipeline and question answering
- Security — path traversal, malicious filenames, unsupported extensions, oversized uploads, prompt injection and sensitive-data leakage
- Edge cases — valid / empty / corrupted PDFs and missing document handling
- Severity model — HIGH / MEDIUM / LOW findings based on financial and legal exposure
Security & hardening
- File validation: type, size and MIME before processing
- Safe storage: random, non-guessable names in temporary directories
- Path traversal prevention and strict filename sanitization
- Prompt-injection defence with clear separation of instructions, content and questions
- Secrets stored in environment variables only — never in version control
- Structured logging with sensitive data excluded
- All API endpoints validated via Pydantic schemas
Honest limitations
AI Contract Analysis & Risk Detection is an internally developed engineering prototype. We state limitations rather than overclaim production readiness.
- Provides contract analysis assistance — not legal advice
- Analysis is limited to the uploaded document(s)
- Risk detection covers the 12 predefined categories only
- LLM-based analysis should be verified by a human reviewer
- PDF is the only supported format in the current MVP
Where this can go next
Realistic next steps we've scoped — not aspirational marketing copy.
- Multi-contract search and comparison
- Contract version diffing
- Clause rewrite suggestions
- Export analysis as PDF and JSON
- Additional risk categories and severity tuning
- Multi-language support
- OCR for scanned PDFs, multi-user collaboration and CLM platform integration (stretch)
Have a similar workflow?
Zenera Labs can build a custom version for your business.
This is one of naman's internally developed systems. Tell us about your requirement and we'll scope a tailored build around it.
Other systems we've built internally
SentinelAI — Security Log Anomaly Detection
Risk-scored alerts from security events — a full-stack Mini-SIEM with ML detection, attack-chain correlation and explainable alerts.
pragna · Engineering Portfolio
View case study
AI Data Analyst & Business Intelligence Agent
Evidence-grounded business intelligence from spreadsheets — upload CSV/XLSX, get analysis, visualizations and explained answers.
priyanka · Engineering Portfolio
View case study
Natural Language → SQL Analytics Assistant
Ask business data questions in plain English — get safe, validated SQL with grounded explanations.
naman · Engineering Portfolio
View case study