NDAshield: How I Built a Privacy-First AI Legal Triage Tool on Cloudflare and Next.js

GregoryT — Tue, 09 Jun 2026 07:30:00 +0000

Building with AI is easy. Building with AI when handling highly confidential, legally binding legal documents is an absolute minefield.
When I set out to build NDAshield (an automated tool that scans NDAs, applies a 0-100 risk "Burn Score," and generates redlines), the biggest hurdle wasn't the AI wrapper—it was data privacy.
Here is a look under the hood at how I structured a solo-founder SaaS architecture to be fast, secure, and compliant with EU strict data privacy regulations.

1. The Architectural Blueprint

To minimize overhead and handle global traffic with zero cold starts, I bypassed traditional heavy server setups:

Framework: Next.js
Edge Infrastructure: Cloudflare
Auth & DB: Clerk + Supabase
AI Layer: Google Gemini (primary processing for massive context window and speed) with an automated fallback pipeline to OpenAI.

2. Achieving Zero-Footprint Processing (In-Memory)

To comply with GDPR and earn the user trust required for document analysis, I built a zero-storage pipeline.
When a user uploads a PDF or DOCX, the document is streamed and kept entirely in temporary memory. The text is parsed, chunked, passed to the secure API endpoint of our LLM providers (with data-sharing/training toggles strictly turned off), and the structured JSON output is sent back to the client. Once the session terminates or 90-day system logs clear, the footprints vanish. No local database stores the raw text of the contract.

3. Prompt Engineering for Law vs. Reality

Generic ChatGPT prompts give terrible contract summaries like: "This is a standard NDA protecting both parties."
That's dangerous. To make the output actionable, the backend enforces structural constraints:

Quantification: Every clause is mapped against an aggressive risk matrix to compute an aggregate 0-100 Burn Score.
Verification: The model is strictly forbidden from summarizing a problem unless it can output an exact, verbatim quote from the uploaded text to prove it.
Actionability: Instead of just pointing out a flaw, the system generates clean counter-proposals (redlines) and drafts a formal negotiation email.

Lessons Learned as a Solo Developer

Launching a legaltech micro-SaaS teaches you that tech is only 30% of the battle; trust and positioning make up the other 70%. By ensuring the app is fully EU-hosted (Poland) and entirely transparent about what happens to data, user hesitation drops drastically.
We just went live on Product Hunt today to gather initial usage feedback. If you're building in the AI or Edge space and want to chat about handling file processing at the edge or tuning structured JSON outputs, let's talk in the comments!
Check out the live build here: nda-shield.com

producthunt.com

DEV Community: GregoryT

NDAshield: How I Built a Privacy-First AI Legal Triage Tool on Cloudflare and Next.js

1. The Architectural Blueprint

2. Achieving Zero-Footprint Processing (In-Memory)

3. Prompt Engineering for Law vs. Reality

Lessons Learned as a Solo Developer