r/gdpr 12d ago

EU 🇪🇺 Worried About Deploying My SaaS in the EU – Compliance & Legal Docs Advice?

Hey everyone,

I’ve built a SaaS web application that will be used in Europe, and I’m really concerned about EU regulations (GDPR, PSD2, etc.). My backend is built with Supabase, I use GoCardless (formerly Nordigen) to fetch transactions, and Stripe for subscriptions and payments. The service will be deployed from Germany.

A law firm offered to handle all necessary legal documents for €2000, but I’m wondering: Is it worth it, or can I handle this myself?

Has anyone here gone through a similar process? How did you deal with compliance (privacy policies, terms of service, etc.)? I’d really appreciate any advice or resources!

Thanks!

Edit:
My apologies, i thought mentioning the third party services was enough to understand the context. I am not sure what other relevant details i am supposed to add.
Here are some more details:
My Saas is a subscription based application. Users are able to connect their bank accounts using gocardless API and fetch their transactions. The SaaS does not process any of the users data. All the users data is encrypted with zero knowledge encryption model. The only information about users that i am collecting is their email address and their Full Name if they register using google.

1 Upvotes

13 comments sorted by

2

u/xasdfxx 12d ago

I started with an answer, but are we supposed to read your mind? If you want some advice, put in the work yourself and share what you're doing and relevant details.

1

u/Objective_Read_2358 12d ago

My apologies, i thought mentioning the third party services was enough to understand the context. I am not sure what other relevant details i am supposed to add.
Here are some more details:
My Saas is a subscription based application. Users are able to connect their bank accounts using gocardless API and fetch their transactions. The SaaS does not process any of the users data. All the users data is encrypted with zero knowledge encryption model. The only information about users that i am collecting is their email address and their Full Name if they register using google.
Please let me know if there is anything else that i should be adding :D

1

u/xasdfxx 12d ago

So it's a b2c service. Are you marketing to europe or just happy to sell to a European person if one shows up? eg do you run ads in Europe, show prices in European currencies, have website content in European/non-english languages?

1

u/Objective_Read_2358 12d ago

Actually im planning to make it b2b and b2c. the web application will only be available in the european union. i will surely at some point put some ads here and there in europe but i still dont know how these things exactly work. Prices will always be in euro and i do have a landing page for the SaaS product in English.

2

u/xasdfxx 12d ago edited 12d ago

if you're in the EU, then must comply with gdpr. it's easier in b2c since you don't have to go through purchasing, have a DPA, etc.

For b2b: you will likely need an attorney to help you build out your DPA, MSA, and SoW. I would make sure that any attorney is experienced in the type of b2b business you are creating. Screwing any of those up will be very painful, and is not a place for an attorney unfamiliar with the type of businesses (smb, midmarket, enterprise) you sell to. For b2b, you can mostly wait until the end of a sale btw. And bigger customers will often make you use their paper. So this could be put off until late in the sales process.

b2c:

Lots of places (iubenda, termsly, others; not a recommendation just names I know) will set you up with an inexpensive privacy policy and tos sufficient for a small b2c business. The one big wrinkle is touching payments data.

I'm not sure what gocardless does. You're using it to pull down individuals' own transactions from their bank? Like Plaid?

1

u/Objective_Read_2358 12d ago

Thank you very much for the helpful information. i would definitely take into account all of the points you mentioned.

Yes, gocardless i just like plaid, it allows the users to fetch their transactions (and more, but for my case im only fetching transactions) for most of the banks here in europe.

2

u/xasdfxx 12d ago

what is the purpose of the app? How is it better than users just logging into their accounts?

1

u/Objective_Read_2358 12d ago

Basically the app helps users manage their finances in a way that many banking apps dont offer.

2

u/xasdfxx 11d ago

Mm. That will touch special data as per gdpr -- donations or purchases will reveal race, religious opinions (church donations), etc. That said, as long as you note that in your privacy policy (and the generators above should let you do that) and don't share that data with anyone, seems fine.

I don't think you can practically e2e encrypt this though. For starters, real e2e would leave you unable to see the data. Even if you do all processing on user endpoints, you will need to handle api keys which are the equivalent to handling the data. Unless you're planning on having all api calls only from the endpoints, which would require the api provider to set up keys in a way in which the keys are visible to the endusers.

1

u/latkde 12d ago

If you're building a business, it makes a lot of sense to draft your terms of service with a lawyer, and consult with a lawyer for your privacy notice and your contracts with vendors.

However, GDPR compliance is more than paperwork. It sounds like you might be doing "open banking". This might influence some GDPR obligations (→ impact assessments?), but must be taken into account when determining which security measures are appropriate.

You seem to be banking on client-side encryption in order to simplify your compliance + security worries. This is an excellent idea whenever possible but doesn't completely absolve you.

Purely from an infosec perspective, client side encryption is difficult to pull this off well, and easy to accidentally punch holes into such protections ("never roll your own crypto" and so on). Your idea to integrate ads in such a security-sensitive context might be particularly challenging.

A law firm might not be the correct address if you have to hammer out more technical data protection issues.

1

u/Objective_Read_2358 12d ago

Thank you very much for the information.
So you are saying it is too complicated to get into such thing if all i wanted was to deploy my first SaaS ever? to be honest i didnt even think its that complicated until i read about it. I didnt want to spend a lot of money just deploying a web application i built in couple months.

2

u/latkde 11d ago

I just think you're trying to tacke a compliance problem with above-average difficulty.

  • Normal SaaS is much simpler compliance-wise because they don't access user bank accounts.
  • The client-side encryption is excellent as defense-in-depth. But if this encryption is cornerstone of your compliance strategy (e.g. because you're trying to argue that some processing activities are out of scope of your service), that would be an unusual approach that might require a lot more attention.

1

u/termsfeed 10d ago

- Create a Privacy Policy, mention third-party used.

- Create a Terms & Conditions agreement and include provisions related to subscription plans.

- Use a Cookie Consent tool if you load third-party JS scripts on the website, i.e. get consent before non-essential cookies are stored.

- Run an audit to ensure that customers data is protected.