Legal and Security

When building the product was the only thing that mattered, law and security were problems for later. Terms of service were copied from a similar service with the name swapped out, customer data piled up wherever it was easiest to build against, and internal permissions were handed out wide and trimmed only when someone complained. As long as nothing happened, that was the fastest way to work.

Two changes broke the arrangement. The first was software turning into something you rent over the internet instead of install. A customer used to run the program on their own server, which meant they also held whatever data collected inside it. Now another company's contracts and HR files sit in the vendor's database. The second was the law tightening around that data. Mishandle personal information and the penalty is calculated against revenue; leak it and a clock starts on reporting it and telling the people affected.

Fines were not the only change. Customers started asking first. When Pagedeck had its first large deal in sight, what Sofia brought back was not a contract but a questionnaire from the buyer's security team: 200 items on how permissions are managed, how quickly accounts are revoked when someone leaves, how long data is kept. Theo filled it in by guesswork until he reached an item asking him to attach the offboarding procedure document. A procedure existed. Nobody had written it down. That deal slipped two months.

Legal and security is what this work became once it moved from cleaning up after the event to designing before it.

The work under this name splits eight ways: who is accountable (roles), how information about people is handled (personal data), how good handling gets proven to outsiders (certification), how promises get written down (contracts), what rights attach to the things a company makes (intellectual property), what has to be registered and obeyed to operate at all (regulation), how security runs as a daily procedure (security operations), and what AI adds on top (AI).

Roles divide the people. There are four seats, separated by what each one answers for and by whether the company or the law is the party demanding the seat exist.

1. In-house counsel reads and rewrites contracts and represents the company when a dispute starts. The reason to keep inside a job an outside firm could do is speed: one clause that sales needs answered today takes three days to come back from a law firm.
2. A data protection officer (DPO) owns where the company's personal data goes and what it is used for, and answers for notification when something leaks. Past a certain size the law requires this role to be named, with the name published in the privacy policy.
3. A chief information security officer (CISO) is the executive who owns security across systems and the organization. Where the data protection officer looks at what the information is, this seat looks at the systems holding it and the people who touch them. In a small company one person holds both.
4. A compliance manager checks whether the rules are actually followed. If the three seats above set rules, this one confirms they run on the ground: pull the access list every quarter, find the permissions nobody needs, and chase each agreed fix until it is done.

Personal data is the branch that collects the rules for handling information about people. Personal data protection puts conditions on every step of collecting, using, storing, and deleting anything that identifies someone — a name, a phone number, a login record. Two questions cover most of it: why was this collected, and why is it still here now that the purpose is over. If a signup form asks for a date of birth and no feature in the product ever reads that value, the field should go. Deletion looks like loss rather than a feature to the people building, so retention limits never get set unless they are set while the product is designed.

Certification is the branch that gets good handling confirmed from outside. Security compliance is the arrangement where an external auditor checks a company against a fixed checklist and issues a certificate. It is the structure behind a hygiene grade posted on a restaurant door, since the diner cannot inspect the kitchen. An enterprise buyer cannot audit every tool it uses one by one, and the seller cannot answer a different questionnaire for every buyer, so the two sides settled on a shared standard. What gets felt first is speed rather than safety: without a certificate, each 200-item questionnaire costs two or three months of filling, clarifying, and answering again.

Contracts are the branch that fixes a promise in sentences. Contracting practice covers the clauses that go into terms of service and individual agreements — how much gets paid out when the service stops, when and how either side can walk away. It is a document nobody reads until the day the relationship sours. A contract with no cap on damages can cost several times a year of that customer's fees over a single outage, and an auto-renewal clause nobody checked buys another year of a tool nobody uses.

Intellectual property is the branch that covers rights in what a company makes. Intellectual property protects the product name and logo, the code and documents and designs, and technical inventions, each through a different mechanism. The split runs between stopping others from using what is yours and not misusing what belongs to others, and the accidents fall mostly on the second side. Take public code whose condition of use is that any product built on it must publish its own code too, and part of a service already being sold has to come out and be rebuilt. Names work the same way: learn that the trademark was registered first only after the logo and the domain exist, and changing it costs a hundred times what checking would have.

Regulation is the branch that covers law attached to the business itself. Business regulation sets what has to be registered before you operate and what has to appear on screen. Taking money online generally means registering as a seller, company identity and refund terms have to sit where a customer can find them, and work that touches finance or healthcare adds licenses required before starting at all. Small companies trip most often on billing and advertising. A free trial that rolls into a charge is a problem in itself unless the timing and the amount are disclosed in advance, and a line like "number one in the industry" fails advertising rules with no evidence behind it.

Security operations is the branch that runs security through people and procedure. Security governance writes down who can reach what, when that access is revoked, and who gets told within how many hours when something goes wrong, then checks that it runs that way. Being operations rather than technology is the character of this branch. What decides a real incident is not which safe was bought but how many keys were cut and how many of those sit with people who already left. The item that stopped Pagedeck's questionnaire was this one: an account belonging to someone who had left three months earlier was still live, because nobody owned the check that it had been revoked.

AI is the newest branch. AI governance takes the questions that follow AI into a product. Where does a customer's document go when the summarize feature reads it, does the outside company that built the model train on that content, and was the customer asked. Decisions made by a model instead of a person are the other half. Screen job applications or decide a loan automatically — judgments with weight on someone's life — and the law in several countries is moving toward requiring disclosure and an explanation of the result. Standards here are still settling, so the available move is writing down what the company has decided not to do and holding that line.

The eight branches sit on one line rather than running in parallel. Regulation draws the floor, contracts put customer promises on top of it, personal data and security operations build the procedures that keep those promises, certification shows outsiders they were kept, and roles name who answers at each step. Intellectual property stands alongside protecting what the company made, and AI throws the same questions at the other six from the start again.

"The buyer's security questionnaire came back. Apparently it drops to twenty items if we hold the certificate."

Sales asking for certification to go on this quarter's schedule.

"Turning this on needs one more consent item, and we have to collect it again from everyone who already signed up."

Data gathered for one purpose cannot ride on the original consent when the purpose changes.

"Our terms say we don't train on customer data."

The brakes: what the product wants to do contradicts a promise the company already published.

Pagedeck has no dedicated legal staff, so Grace carries this area herself with an outside firm on call. Last month's meeting had three items sitting side by side — two enterprise security questionnaires Sofia brought back, Theo's request for a week of engineering time to clean up permissions, and Mia's plan to wire an outside model into document summarization.

The three turned out to be one line. Turning on summarization sends customer documents outside, which changes the answer to the data-handling items on the questionnaire, and the changed answer no longer matched the sentence in the terms. Grace reordered them: permissions first, then the terms and the privacy policy rewritten and announced, then the summarization feature. The feature slipped a month and both deals survived.

The most common reading is that this field is a stamp collected once everything is built. Review requests really do pile up right before launch, and the answer that comes back is usually no, so the gatekeeper impression is understandable. But what gets collected, where it is kept, and who can see it are design decisions. Asked at that point, the answer is not yes or no but which of three approaches. Leave the order reversed and three days before launch you hear that the data cannot be collected that way, which leaves two options: drop the feature or move the date. A team that lives through that twice learns to stop asking, and unreviewed features start shipping quietly.

The second is treating a certificate as the end of security. It is a visible artifact and the preparation costs real money and time, so it feels like a stage cleared. What it confirms is that the checklist items were in place on the day of the audit, which is not a guarantee about tomorrow. Run it by tidying permissions and matching documents only in the month before the audit, and the company that passes on paper separates from the company that holds the line every day. Once something is breached, the certificate stops working as a shield and becomes the basis for the question of how this happened with a certification in hand.