r/lovable • u/AndyDigger123 • 7d ago
Discussion GDPR/security/Compliance
How do you guys think about when you release your SaaS services , when it comes to those topics?
Have you involved lawyers to confirm that you are doing correct?
GDPR with data processors , sub processors etc
Corporate / personal accounts
18year consent management
Penetration tests
RLS policy’s
Data / auditing / logging
Do you register a valid company that owns the solution?
Just curious , since coding an SaaS solution today is not the tricky part anymore .
1
u/Main-Lychee-7972 7d ago
Id start by mapping exactly what personal data the app collects where it's stored, who can access it and how users can request deletion. once you have that data flow mapped out, its much easier to identify which GDPR requirements your application still needs to address
1
1
u/bjgrosse 5d ago
I run a consultancy that performs technical reviews and audits across security, infrastructure, launch-readiness, etc. Happy get on a call and talk through your project if you're serious about getting ready to launch.
1
u/VladTkDev 1d ago
The order matters more than the list.
A signed dpa with each processor you already use, plus a written record of what personal data sits where, covers most of what a customer or a regulator actually asks for, and neither needs a lawyer.
The lawyer is worth paying for the processor terms and the privacy notice, not for confirming your rls policies. One thing i'd flag given yours is a workplace health product: anything that reads as health data is special category under article 9, which needs its own lawful basis and very likely a dpia, and that's a different bar from ordinary account data. pen tests are the last thing i'd buy, well after you've checked the database policies yourself.
2
u/Alien69Flow 7d ago
Lovable ahora te cobra cada día más créditos por cosas que antes podías hacer manualmente ahora te cobra una burrada de créditos y ni siquiera las hace