safelaunch
The method

From a link to a signed-off checklist in six stages.

Deterministic checks you can trust, AI where judgment helps, and a citation for every claim.
  1. 01

    Fetch

    For a URL we load the page, its response headers and up to eight pages on the same site: privacy, terms and cookie pages, plus sign-up, contact and checkout. For GitHub we download the public repository at an exact commit. A .zip is unpacked in your browser and only text source files are sent; for an iOS or Android app package (.ipa, .apk, .aab) we send only a summary of its permissions, privacy manifest and SDKs.

  2. 02

    Map the stack

    We fingerprint frameworks and over 30 third-party services: analytics, ad pixels, session replay, chat, payments, email, auth, maps and AI providers.

  3. 03

    Find personal data

    Every form field, upload, free-text box and date of birth is traced. Your questionnaire adds what code cannot show: who your users are, whether children use it, whether you handle health or financial data.

  4. 04

    Security check

    Hard-coded keys for AWS, Stripe, OpenAI, Anthropic, Google, GitHub and Supabase; database tables without row level security; missing security headers; HTTPS; unsafe HTML rendering and tokens in localStorage.

  5. 05

    Match the law

    Signals are matched to obligations in our versioned rulebook. Each obligation maps to the exact provision in every jurisdiction you chose — GDPR Art. 13 in the EU, CCPA §1798.100 in California, LGPD Art. 9 in Brazil. Then AI reads your context to add findings rules cannot see.

  6. 06

    Write the dossier

    Findings are scored by severity and jurisdiction. Higher tiers add file and line, before/after code, a patch file, draft policies and prompts written for your builder. Every report names the exact version it checked, and code reports can be signed off: a signed, permanent record of what passed, for that version only.

safelaunch — audit
$ safelaunch audit https://smith-injury-law.com --jurisdictions US-TX,EU,UK

What we never do

  • — Give legal advice or certify that you are "compliant"
  • — Keep your source code after the scan
  • — Scan private networks or sites you don't point us at
  • — Show your secrets in the report (they are redacted)

Rulebook first

Every report starts from deterministic checks against a versioned rulebook (v2026.10.2), so the same product always gets the same core findings.

AI second

Lovable AI (Gemini) reads your code and context to find what rules miss and to write prompts in your stack's language. Claude and OpenAI plug in as additional engines.

Cited always

Each finding names the law and the article for each jurisdiction, so a lawyer, investor or app reviewer can verify it in minutes.

Run your first audit