What it does
The database catalogs corporate and executive-level financial crime — fraud, market manipulation, tax evasion, state capture — against the actual enforcement outcome on record: criminal conviction, settlement, deferred prosecution, or litigation still in progress. Built the same way as the OSINT tracker: solo, in Google AI Studio, React and TypeScript on the frontend, Firebase/Firestore for persistence, Gemini for the analysis features.
Sourced by design, checked against the record
Every case carries one or more citations, each classified by a fixed document-type category — DOJ filing, SEC order, court judgment, CFPB enforcement, EPA record, ICIJ archive, investigative report, official statement — instead of a single unlabeled link. Spot-checking a handful of the seeded cases against the public record holds up: real settlement figures, real citations, the right order of magnitude for each penalty.
Each entry also converts its financial penalty into a worker-wage-equivalent figure — roughly how many years of an average salary the number represents — so a penalty in the billions turns into something with a felt sense of scale, alongside a companion dashboard that breaks the dataset down by sector and enforcement outcome, computed live from the actual case data rather than pre-baked.
The dashboard makes a specific point of visually separating genuinely computed figures from illustrative ones: two tiles pulled straight from the dataset get a solid border and a "From Dataset" label, and two comparison figures included purely to give a sense of scale — average household savings, average lifetime earnings — get a dashed border and an explicit "Illustrative" label instead. It's a small UI detail, but it's the actual mechanism behind "honest by design," not just a claim about it.
Two Gemini lenses, one real schema trick
An AI Fact-Finder modal takes a free-text question, sends the current case list into the prompt, and asks Gemini to answer "based on the provided dataset and verified public records" — returning both a written answer and a list of matching case IDs, which the interface cross-references to show clickable source cards rather than leaving the reader to trust unlinked prose.
An AI Patterns modal looks across the dataset for recurring sectors, common enforcement types, and systemic regulatory gaps, structured into an executive summary, several named patterns each with a supporting statistic, and a bulleted list of observed gaps. Both modals use Gemini's structured-output schema feature rather than asking for JSON in plain language and hoping the formatting holds — a real reliability choice, not just careful prompt wording.
A submission path that's honest about what it is
A case-submission form lets anyone paste a source document's text plus a URL, and Gemini extracts a structured record from it using the same schema-constrained approach as the two analysis modals. It publishes immediately — there's no moderation queue, and the interface doesn't imply one — tagged with a clearly visible "AI-generated, unreviewed" disclosure badge.
That badge's wording was chosen deliberately, not as a generic disclaimer: it specifically avoids implying that any human review took place, because the relevant EU AI Act provision's editorial-review exemption only applies where genuine, substantive human review actually happens — which this automated pipeline doesn't do. Saying less than that would have been the easier, and less accurate, choice.
A Firestore security fix, found the same way twice
This project shared the exact same class of vulnerability as its sibling OSINT tracker: Firestore rules that allowed open read and write access, with the frontend authenticating against Firestore directly using a necessarily-public client configuration instead of going through the backend for anything. Once that pattern had been found and fixed in the OSINT project, it got checked here deliberately, rather than assumed to be fine because nothing had gone wrong yet — and it was the same bug. Fixed the same way: migrated to the Firebase Admin SDK, closed the rules outright, and moved every real read and write behind the Express API instead of trusting the client.
Real, proactive legal compliance work sits alongside that fix, for the same underlying reason: an Impressum citing the specific Austrian Mediengesetz §25 disclosure that applies to a "große Website," and a privacy policy — both added because the project names real public figures and that carries real obligations, not because anyone asked or a regulator came calling.
What actually mattered
Getting Gemini to return a clean, schema-constrained structure is close to table stakes now. What actually took real effort was everything around that: keeping "computed from the dataset" visually distinct from "illustrative for scale" instead of letting the two blur together, labeling AI-generated content for what it honestly is instead of what would be more convenient to imply, and treating a security pattern found once as something to go check for deliberately elsewhere — not a one-off fire that got put out and forgotten.
None of that shows up as a feature you can screenshot. It's the difference between a database that looks trustworthy and one that's actually built to survive someone checking.