Second line of defence · Luxembourg
About
I'm Matteo Capacci, a risk manager working in the second line of defence at a regulated fund administration firm (PFS) in Luxembourg. My day job covers outsourcing oversight under CSSF Circular 22/806, ISAE 3402 audit coordination, risk and controls testing, and enterprise risk management. Before that I worked in external audit at PwC, then internal audit and fund operations. About eight years now around regulated processes and the controls that keep them honest.
IddiLabs is my personal lab. I build the tools I kept wishing existed for the job.
Why these tools exist
Regulated firms have a procurement problem with software. A genuinely useful tool can die the moment it asks you to upload sensitive data to someone else's server. I've seen it happen from both sides of the vendor due diligence table.
So every tool here works differently: it runs entirely in your browser. No account, no backend, no analytics on your inputs. Close the tab and your data is gone. You can check this yourself: open any tool, switch to airplane mode, and keep working.
I'm not a developer
Every tool on this site was built with AI (Claude Code, Gemini, and a lot of iteration). I don't write the code by hand. I specify it, review it, and test it the way a second line risk manager reviews anything else: against requirements, edge cases, and the regulation it implements.
What IddiLabs is really testing is whether a domain expert who knows DORA, CSSF 22/806, and the EU AI Act can ship working software without becoming a developer. From what I've seen so far, yes.
AI beyond this site
I apply the same discipline at work, designing and deploying AI agents inside a regulated environment on AWS and Microsoft stacks, with the approval gates, logging, and human oversight a risk manager would insist on. None of that work appears here directly, but the same habits shape how I build these tools.
What this site is (and isn't)
IddiLabs is a personal learning space, not a company or a commercial service. The tools are free, provided as is, and not professional advice. Views are my own, not those of any employer. No employer or client data is used anywhere on this site.
Get in touch
The best place to find me is LinkedIn. Code lives on GitHub. Or use the contact form, I usually reply within a day or two.