Launch Compliance Checklist

Last updated: 2026-07-20

This checklist gates a public or wide early-access launch of Klugliv. It combines legal readiness, privacy transparency, and technical safety. It is an engineering operating document — not legal advice.

Use it before pointing real users at production builds or publishing marketing that implies full availability.

---

1. Legal & counsel review

Documents below must be reviewed by qualified legal counsel and placeholders completed before production release (each has a counsel-review banner in docs/legal/):

• Privacy Policy (privacy-policy.md)
• Terms of Use (terms-of-use.md)
• Impressum — complete legal entity, address, register data (impressum.md)
• Cookie Policy (cookie-policy.md)
• GDPR Compliance Review (gdpr-compliance.md)
• Data Retention Policy (data-retention-policy.md)
• User Rights & GDPR Request Procedures (user-rights.md)
• Incident Response — regulatory notification sections (incident-response.md)
• Vendor Register & Subprocessors (vendor-register.md, subprocessors.md)
• Accessibility Statement (accessibility-statement.md)

Engineering docs (no counsel banner required, but should be accurate):

• Trust Center published and links verified (2026-07-20 — klugliv.com)
• Security Overview & Whitepaper reflect current architecture
• Responsible AI page matches shipped capabilities
• Risk Register reviewed for launch-scoped risks

---

2. Website & transparency

• All Phase 1–3 legal routes render from docs/legal/{locale}/
• EN and DE content available (or fallback notice where translation pending)
• Footer / Trust Center links work (no 404s) — verified 2026-07-20
• Impressum reachable for German users (content still needs counsel completion)
• No false certification claims (ISO, SOC 2, “GDPR certified,” etc.)
• Contact email (hello@klugliv.com) monitored for privacy/security requests

---

3. Mobile app — trust UX

• Settings → Trust & privacy hub (trust-privacy.tsx)
• Website legal links open with ?lang= from app language
• Receipt delete works per receipt
• Data export: JSON self-service in Trust & privacy (export-account-data.ts)
• Account deletion: self-service in Trust & privacy (delete_own_account RPC deployed)
• Analytics (PostHog): opt-in prompt + toggle in Trust & privacy when key configured; documented in privacy copy
• No secrets in production builds (EXPO_PUBLIC_* only where appropriate)

---

4. Data processing accuracy

• Privacy Policy matches actual stack (Supabase auth today; AWS OCR slice; optional S3 dual-write)
• Vendor register lists Google Vision, Supabase, AWS, PostHog (when used)
• International transfer story for OCR documented and legally confirmed
• Retention periods in policy align with CloudWatch/Supabase operational reality

---

5. AWS & infrastructure (Phase 1 slice)

Reference: docs/devops-playbook/17-launch-checklist.md

• S3 buckets block public access
• Receipt bucket encrypted (SSE-KMS)
• OCR Lambda rejects missing/invalid session
• Secrets in Secrets Manager — not in git or mobile
• AWS Budgets and alert email configured
• CloudWatch log retention set (no indefinite PII logs)
• Terraform state remote + locked
• Smoke script passes: infrastructure/aws/scripts/smoke-phase1.sh (2026-07-20)
• Rollback documented (EXPO_PUBLIC_OCR_DRIVER=google_vision_edge)
• Projected AWS spend under stage cap (Dev < $30 / beta < $75) — verify monthly
• S3 delete on account deletion deployed (POST /v1/media/receipts/delete-account) — 2026-07-20

---

6. Security & incident readiness

• Incident Response runbook known to operator
• Security contact path published (hello@klugliv.com)
• MFA on AWS root / admin accounts
• No known critical vulnerabilities unpatched in dependencies (routine audit)

---

7. Accessibility & inclusion

• Accessibility statement published
• Critical app flows usable with screen reader / larger text where supported
• Known a11y gaps documented honestly (not hidden)

---

8. Launch decision

Do not launch if counsel-required documents remain placeholder-only or if receipt storage/OCR is publicly accessible without authentication.

---

Related documents

• Risk Register
• GDPR Compliance Review
• Incident Response
• Engineering: docs/devops-playbook/17-launch-checklist.md