Phase 1 Launch Readiness

Forgot password → email link → reset password pages

/forgot-password and /reset-password routes implemented with Supabase auth

Post-signup email verification screen and flow

/verify-email page implemented with resend verification link support

TOTP-based 2FA with QR code and backup codes

TwoFactorSettings component in /settings with TOTP setup, QR code, backup codes, and /api/auth/2fa/setup + /verify routes

Protected routes redirect unauthenticated users to login

src/middleware.ts enforces auth on all protected routes

Floating GPT-4 chat panel on all screens

Route implemented with tier gating + rate limiting. OPENAI_API_KEY is configured.

Auto-generates risk assessments from use case descriptions

Route implemented, tier gating + audit logging active. OPENAI_API_KEY configured.

Generates governance policy documents (Professional+)

Route implemented, tier_1 blocked with 403. OPENAI_API_KEY configured.

Classifies AI systems by risk tier and EU AI Act category

Route implemented with tier gating + audit logging. OPENAI_API_KEY configured.

Checks documents against compliance frameworks (Enterprise only)

Route implemented, tier_1 + tier_2 blocked with 403. OPENAI_API_KEY configured.

PostgreSQL database with RLS policies and auth

NEXT_PUBLIC_SUPABASE_URL and keys configured. Migrations applied.

Subscription billing and payment processing

Publishable key configured. STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET are placeholders — billing will not process payments until set.

Transactional email for invitations and notifications

RESEND_API_KEY is a placeholder. All email sends will silently fail until configured.

User behavior and funnel tracking

G-69ZS4E6559 configured. GA only fires in production (NODE_ENV=production) and respects cookie consent.

Query result caching for performance

REDIS_URL is a placeholder. App works without it — caching is disabled. Skipped in development mode.

Production error monitoring and alerting

NEXT_PUBLIC_SENTRY_DSN is a placeholder. Error tracking disabled until configured.

All 28+ core tables deployed via migrations

Run /api/health to verify — requires organizations, profiles, ai_use_cases, risk_assessments, controls_library, certifications, audit_logs, and 21+ more tables

Row-level security enabled on all tables (min 3 per table)

Run /api/health to verify — minimum 84 policies required (28 tables × 3: SELECT/INSERT/UPDATE)

ISO 42001, EU AI Act, GDPR, NIST controls seeded

Run /api/health to verify — controls_library must have ISO 42001, EU AI Act, GDPR, and NIST framework controls

Basic, Professional, Enterprise tiers configured

Run /api/health to verify — organizations table must have Basic/Professional/Enterprise tier data

calculate_certification_audit_readiness, calculate_cmri_score

Run /api/health to verify — both PostgreSQL functions must exist for CMRI scoring and certification readiness

Query performance indexes created from migrations

Run /api/health to verify — minimum 45 indexes required for production query performance