CheckByAI is an AI-powered UK immigration compliance monitoring and document verification platform. Built in London.
| Persona | Problem | How CheckByAI Helps |
|---|---|---|
| 🧑💼 Visa Holders | Sponsor revoked without warning - you lose your visa | Real-time alerts before it's too late |
| 🏢 HR Teams | Accidentally hiring from revoked sponsors = illegal | Instant licence status verification |
| 📋 Immigration Advisers | Manual checks are slow and unreliable | Automated daily monitoring + forensic CoS checks |
| 🤝 Recruiters | Placing candidates at non-compliant employers | Pre-screen sponsors before any placement |
| Feature | What It Does |
|---|---|
| 🔍 Sponsor Licence Monitor | Daily scans of the UK Home Office Register of Licensed Sponsors. Alerts on removals, downgrades, new routes, and status changes. |
| 🔎 CoS Check — PDF Forensics | Forensic analysis of Certificate of Sponsorship PDFs to detect tampering, fabricated metadata, suspicious modification dates, and invalid certificate generation. |
| ⚡ Scheduled Digest Alerts | Email, WhatsApp, and SMS digests on licence changes (Starter same-day 18:00 UTC; Pro twice-daily 07:00 & 19:00 UTC). |
| 📊 124,000+ Sponsors Tracked | Full coverage of the UK Home Office Register of Licensed Sponsors. |
1. Upload a CoS PDF → 2. AI scans 6 data points → 3. Get a risk score in seconds
1. Enter a sponsor name → 2. CheckByAI checks the register → 3. Get instant listing status + scheduled digest alerts
| Feature | Free | Starter | Pro | Unlimited | Enterprise |
|---|---|---|---|---|---|
| Sponsor Watches | 1 | 2 | 5 | Unlimited | Unlimited |
| Notifications | Daily digest | Email + WhatsApp, same-day 18:00 UTC | All channels, twice-daily 07:00 & 19:00 UTC | All channels, twice-daily 07:00 & 19:00 UTC | All + Webhooks |
| CoS Check MIS | — | — | ✅ | ✅ | ✅ |
| API Access ¹ | — | — | — | Planned | Planned |
¹ No public or partner API is available yet — see the roadmap. Listed here as planned scope for these tiers, not a shipped feature.
- Node.js 22+ (see
.nvmrc; Docker/CI pin 22) - PostgreSQL 14+ (16 in
docker-compose.yml) - Redis — optional for local dev, required in production (job queue, rate limiting, and shared cache degrade to per-process fallbacks without it)
- Firecrawl API Key (optional)
- Python 3.11 + uv (optional — Python sidecar;
pinned by
.python-version, see docs/PYTHON_SIDECAR.md) - A POSIX shell (macOS/Linux, WSL, or Git Bash on Windows) — see Windows below
git clone https://github.com/Sam-Aitech/Checkbyai.net.git
cd Checkbyai.net
npm install
cp .env.example .env
# Fill in .env — DATABASE_URL, SESSION_SECRET, PHONE_ENCRYPTION_KEY, IP_HASH_SALT,
# CHECKOUT_HMAC_SECRET, DIGEST_SIGNING_KEY and STRIPE_WEBHOOK_SECRET are required
# in production or the server exits on boot. See docs/ENV_REFERENCE.md.
npm run setup:binaries # installs qsv + csvdiff into ./bin (required — see below)
npm run db:migrate # fresh DB: applies 0000 + 0024–0031 (see migrations/README.md)
npm run devApp serves frontend and API together on http://localhost:5000.
setup:binariesis not optional. The sponsor monitor pipeline shells out tocsvdiff(Go) andqsv(Rust). Withoutcsvdiffthe nightly job aborts at Phase 2; withoutqsvit runs but skips CSV row-count validation. Verify withnpm run check:binaries.
npm run setup:binaries invokes bash, and the dev/start scripts use POSIX inline env
syntax (NODE_ENV=development tsx ...), which native cmd.exe and PowerShell do not
support. Run the commands above from Git Bash or WSL.
A PowerShell equivalent of the binary installer is available if you prefer it:
powershell -ExecutionPolicy Bypass -File scripts/setup-binaries.ps1You will still need Git Bash or WSL for npm run dev / npm run start, or set NODE_ENV
in your shell beforehand and invoke tsx server/index.ts directly.
npm run lint # ESLint + CSS validation
npm run check # TypeScript type check
npx vitest run # unit/integration suite (or npm run test:run)
# Python sidecar (optional; requires Python 3.11 + uv)
uv sync
uv run --with pytest pytestCI runs all of the above on every PR (.github/workflows/ci.yml), including
the sidecar tests and audit-ci for high/critical advisories.
| Layer | Technology | Purpose |
|---|---|---|
| Frontend | React 18, TypeScript, TailwindCSS, Radix UI, Three.js | Modern reactive UI |
| Backend | Node.js, Express, Drizzle ORM, PostgreSQL (Neon) | REST API + ORM |
| Queue | BullMQ, Redis | Background job processing |
| Auth | Passport.js | Secure authentication |
| Payments | Stripe | Subscription billing |
| Infrastructure | Cloudflare (Turnstile/CDN) | Security + CDN |
| Resend (primary) / SendGrid (fallback) | Transactional emails | |
| SMS | Brevo | SMS notifications |
| Twilio | WhatsApp messaging |
Checkbyai.net/
├── backend/ # Python FastAPI sidecar (CoS verification, enrichment, scraping)
├── client/ # React frontend
├── server/ # Node.js/Express API server (main application)
├── shared/ # Shared types and utilities
├── migrations/ # Database migrations
├── scripts/ # Utility scripts
├── tests/ # Playwright E2E + unit tests
├── docs/ # Documentation
├── data/ # Seed data and archives
└── .github/ # CI/CD workflows
Start at docs/INDEX.md — the full documentation index.
| Doc | Description |
|---|---|
| DEVELOPMENT.md | Local setup, architecture, running tests |
| DEPLOYMENT.md | Production deployment and scaling guide |
| docs/ENV_REFERENCE.md | Every environment variable, required vs optional |
| docs/API_REFERENCE.md | API endpoints, schemas, and examples |
| docs/SYSTEM_DESIGN.md | Architecture and component design |
| docs/ARCHITECTURE_DECISIONS.md | ADRs — why the architecture looks this way |
| docs/RUNBOOK.md | Ops runbooks (nightly ETL, queues, incidents) |
| CONTRIBUTING.md | Branching, PR checklist, style |
| SECURITY.md | Vulnerability reporting policy |
- AES-256-GCM encryption for phone numbers
- Email OTP authentication
- SQL injection prevention via Drizzle ORM
- File upload isolation with immediate deletion
| Quarter | Milestone | Status |
|---|---|---|
| Q3 2026 | CoS PDF forensic engine v2 | ✅ Done |
| Q3 2026 | WhatsApp + SMS alert system | ✅ Done |
| Q4 2026 | API for enterprise partners | 🔄 In Progress |
| Q4 2026 | Mobile app (iOS/Android) | 📋 Planned |
| Q4 2026 | Multi-language support | 📋 Planned |
- Security: Email
security@checkbyai.netwith description, reproduction steps, and impact. - Bugs: Open a GitHub Issue with expected vs. actual behaviour and logs/screenshots.
Built in London 🇬🇧
Made with ❤️ by Sam-Aitech
If CheckByAI has helped you - please ⭐ star this repo to help others find it.