Technical description

Node 20+, zero dependencies. The questions, the classification and the controls are plain JavaScript (`assess.mjs`), evidence is read from a JSONL audit log (`evidence.mjs`), and the web layer (`server.mjs`, `form.mjs`, `report-html.mjs`) only renders the same result the CLI already produces.

How to run it

node src/cli.mjs serve                       # HTTP (PORT, default 8799)
node src/cli.mjs assess --file sample/answers.json --audit sample/audit.jsonl --out report.md
node src/cli.mjs init --out answers.json     # empty questionnaire
node _qa/desk.mjs                            # 5/5 checks

API

method	path	what it does
`GET`	`/watch`	the questionnaire (SR)
`GET`	`/watch/en`	the questionnaire (EN)
`GET`	`/watch/sample`	a filled example report
`POST`	`/assess`	runs the assessment and returns the report page
`GET`	`/report.md?d=`	the same report as Markdown (base64url answers)
`GET`	`/health`	liveness
`GET`	`/metrics`	how many assessments ran, by level

Data

sample/answers.json — example answers (fictional case: candidate screening)
sample/audit.jsonl — example audit log; evidence is computed from it (counts + sha256)
data/assessments.jsonl — counters only (time, level, gap count, sector); answers are not stored

Limits — what this demo does not do

Not a legal opinion and not a certificate; it does not replace a DPIA or a conformity assessment.
The classification is a checklist of triggers, not a legal reading of a specific case.
Without the client’s audit log there is no evidence — and the report says so.
The demo has no authentication; answers are not stored on the server.

How it is deployed

One Node process behind nginx, a systemd unit, Let’s Encrypt. Recipe: E:\poslovi\DEMO-REGISTAR.md.

The demo cannot spend money and does not keep anyone’s answers: the assessment is plain JavaScript, with no model and no network calls.