You vibe-coded it with Lovable, Cursor or Claude Code. It works. Is it legal where your customers are?
Launch fast. Don't pay for it in fines.
Successful startups get fined after successful launches: data in the wrong region, privacy notices that don't match what the app does, breaches nobody reported in time. Every jurisdiction asks for something different, and a vibe-coded app asked for none of it. We audit what you have, map it to the markets you sell in, and close the gaps turnkey.
You keep vibe-coding. We keep you inside the rules.
- $3,000 fixed
- 5 working days
- The report is yours
This is for you if
- You sell, or plan to sell, in the EU, the UK or the US, and you're not sure what each of them requires.
- An enterprise customer sent a security questionnaire and you don't know how to answer it.
- An investor asked about GDPR, SOC 2 or data residency.
- Your app stores personal data and you've never written down where, for how long, or why.
- You'd rather fix it now than after the letter arrives.
What we do not do
The fastest way to understand this offer is by what it refuses. Every item below is something the market sells and we do not.
We do not take over your codebase
It stays yours, in your repository, under your account. You keep shipping while we work.
We do not rewrite from scratch
A rewrite is the expensive answer, not the first one. Most of what we find is cheaper to fix than to replace.
We do not become the owner of your product
You stay the author and the developer. We are accountable for what is inside, not for what it becomes.
We do not lock you in
Specifications, tests and pipelines live in your repository and keep working the month you stop paying us.
We do not hand you a scanner report
A tool finds strings that look like secrets. An engineer finds the decision that let them get there.
What we check
Eight places where a vibe-coded app and a regulator disagree. Each gap comes with what it would cost you and what closing it costs.
Where personal data lives
Every store, every backup, every third-party service, and in which region. Most apps cannot answer this on day one.
What the privacy notice promises
Line by line against what the app actually collects, keeps and shares. The gap between the two is the usual finding.
Consent and lawful basis
Why you are allowed to process each kind of data, and whether the app asked the way the rules require.
Retention and deletion
How long data stays, whether deletion actually deletes, and what a customer gets when they ask for their data.
Who can see what, and whether you would know
Access control, access logs, and whether an engineer reading a customer record leaves a trace.
The breach path
How you would find out, who decides, who you tell, and whether all of it fits inside seventy-two hours.
Third parties and processors
The AI APIs, analytics and hosting you send data to, and whether an agreement covers each of them.
Enterprise questionnaire readiness
The SOC 2 style controls a larger customer will ask about, and which answers would currently be no.
What waiting costs
Every week you spend guessing what the regulator wants is a week you're not selling there.
The rules are knowable. We know them. We map your app to them in five days and close the gaps, so launching in a new market is a decision, not a gamble.
The review, day by day
Five working days of one senior engineer who has been through this with a regulator before. What each day is spent on, and what lands on your desk at the end.
- Day 1
Where the data lives
Every store, every backup, every third party, and in which region. The data map starts here, and most apps have never had one.
- Day 2
What you promised versus what the app does
Privacy notice, consent screens, retention. Line by line against the real behaviour of the code.
- Day 3
Who can see what, and whether you would know
Access control, access logs, the breach path and the seventy-two-hour clock.
- Day 4
The markets you sell in
GDPR, UK GDPR, CCPA/CPRA: what each one asks of your app specifically, not of apps in general.
- Day 5
The map and the plan
Every gap, what it would cost, what to close first, written down.
What you get
- A verdict on the first page, per market: sell, sell after these fixes, or not yet. Signed by the engineer who did the work.
- A data map: what personal data you hold, where, for how long, and why. The document every regulator and every enterprise customer asks for first.
- Every gap with the rule it breaks, what it would cost you, and what closing it costs.
- A plan in order, each step with a day estimate and who should do it.
- One hour with the engineer who wrote it, recorded, so you can watch it again.
- One re-check after you have closed the gaps, included in the price.
What compliance support looks like each month
Rules change, features change, and the gap between them is where fines come from. This is what keeps it closed.
Every new feature checked before it ships
Where the data goes, who sees it, what the notice has to say.
The data map kept current
What personal data you hold, where, for how long, and why. The document every regulator asks for first.
Security questionnaires answered with you
Enterprise customers send them. We fill them in from what is actually true.
A breach drill once a quarter
So the seventy-two-hour clock finds a team that has done this before.
A watch on the rules of your markets
When the requirements move, you hear it from us, not from the letter.
You can stop any month
The data map, the policies and the controls stay yours.
The part nobody lists
After the launch comes the letter.
The startups that get fined are the ones that launched well. Growth made them visible, and the app they grew on was never built with a regulator in mind. The review costs five working days. The fine costs more, and it arrives at the worst time.
Pricing
Fixed price on the review. Monthly on the support. No hourly billing on either.
There is no free audit here. The review is a senior engineer's week of work, and we price it as work rather than as a way to collect your email address.
Compliance Review
$3,000fixed
5 working days
Where your data lives, what your notices promise, what each market you sell in requires, and the gaps between them. A written map and a plan to close them.
- All eight areas, across the five days above
- Mapped to GDPR, UK GDPR and CCPA/CPRA
- Every gap with what it would cost you
- One hour with the engineer who wrote it, recorded
- One re-check after your fixes, included
Compliance Support
from $6,000per month
monthly, cancel any time
Every feature checked against the rules before it ships, the data map kept current, questionnaires answered with you.
- New features checked before release
- The data map kept current
- Security questionnaires answered with you
- A breach drill each quarter
- A channel answered the same day
Who does the work
ForEach Partners is a partnership of engineers, not a brokerage. The partners behind this each spent twenty years or more inside large enterprise programmes, as engineers, leads and CTOs, on systems where a mistake in data isolation was a regulatory event rather than a bug report. They still write code daily, with the same AI tools you use.
The method is not a secret and not a slide. It is published as spex, the specification-driven framework we build every project with. https://github.com/foreachpartners/main-spex
Questions people ask before booking
- Do you need access to my repository?
- Read access to the code and a way to run it. No production credentials, no access to your customers' data, ever.
- Will you sign an NDA?
- Yes, before we see anything. Send yours or use ours.
- Who owns the report?
- You do, including if you never speak to us again.
- What if you find nothing serious?
- Then that is the answer you paid for, in writing, with the evidence behind it. It is the cheapest outcome on offer.
- Is there a free version of the review?
- No. It is a senior engineer's week of work and it is priced as such. The thirty-minute call before it costs nothing and is where we tell you whether the review is worth buying at all.
- Do I have to stop vibe-coding?
- No. The whole point is that you keep going, with someone accountable for the result.
- How soon can you start?
- The review starts within a week of the call, and takes five working days once it starts.
- Can you certify us?
- No, and nobody honest can in five days. We get you to the point where an audit, a questionnaire or a regulator finds what it expects to find.
- Which markets do you cover?
- The EU and the UK (GDPR, UK GDPR), US state privacy laws starting with California, and SOC 2 style controls for enterprise customers. Other markets by agreement.
Find out before your users do.
Thirty minutes, no deck. Tell us what you built and what worries you, and you will leave the call knowing whether you need the review, the support, or neither.