Compliant because it was built that way
Compliance is not a page: it is decisions in the code, verified at every deployment. Here are the ones that matter.
- Purpose and legal basis per field
- A personal field with no stated purpose does not compile. The processing register (GDPR art. 30, Law 25) is its generated output.
- Portability in one call
- A member gets everything we hold, and the reason for every field, from their own account.
- Hosting stated plainly
- One single region, and here it is: AWS us-east-2, in Ohio, United States. The transfer clauses and the Law 25 assessment that go with it are documented.
- Sign-in journal
- Every member sees their devices and can sign them out remotely. Account security starts with visibility.