What can attach
| Trigger | Possible obligation | First question |
|---|---|---|
| EU or UK personal data | GDPR / UK GDPR | What data, purpose, lawful basis, processor, deletion path? |
| Card payments | PCI DSS scope | Which payment integration carries the card boundary? |
| Users under 13 | COPPA | Can the product avoid becoming a child-directed service? |
| Enterprise buyers | SOC 2 as a commercial gate | What evidence will a buyer require, and when? |
| Health or regulated decisions | Sector rules and product liability | What does the output decide, and what record must survive? |
Pre-launch gate
Tenant isolation has a cross-tenant denial test.
Secrets stay server-side and secret scanning runs in CI.
Backups run and a restore has been tested.
Rate limits cover auth, signup, password reset, mail, and paid calls.
Customers can export their data.
Privacy and terms describe the product as it actually works.
Someone else could keep the lights on for two weeks.
This is not legal advice.
Requirements depend on facts, jurisdictions, data, contracts, and product behaviour. The page is a decision map for the questions to ask.
Synthesized from the supplied failure-modes-and-compliance research. Volatile legal claims require current primary-source review before publication.