Web applications
GDPR-compliant web applications from Berlin
GDPR compliance is not a feature you add to a finished application. It is decided in three places: where the data sits, who may see it, and when it disappears again. We build web applications so that these three questions are answered from the start — and stay answerable.
What that means in practice
A German server location solves exactly one issue: third-country transfer. The remaining obligations stay, and they are where things actually go wrong.
- A record of processing activities that describes the actual data flow, not the intended one.
- Retention periods per data category — including ones that apply to backups.
- Access rights that match what the privacy policy claims.
- Access and erasure requests under Articles 15 and 17 that can be answered without touching the database.
How we build
Next.js on the front end, Python with FastAPI on the back end, data in Germany. No tracking without consent, no third-party scripts quietly siphoning data. Where an application uses AI, a deterministic layer sits in front of it — not on principle, but because it is cheaper, faster and traceable.
In our receipt-capture case study that layer settles 94 % of bookings without a single AI call. That is the number we show when someone asks whether AI belongs everywhere.
Evidence, not assurance
“GDPR-compliant” on a sales page is a claim. It becomes checkable through a security test, a record someone has actually read, and headers you can measure. We deliver that with the work — and if you already have an application, a test is a more honest starting point than a rebuild.
Limits we name up front
We are not legal counsel. We build and run the technical side and document it so your data protection officers can work with it. The legal assessment stays with you — and where a requirement cannot be met cleanly in technical terms, we say so beforehand rather than afterwards.
Frequently asked
Questions we get asked a lot
What makes a web application GDPR-compliant?
Three things decide it: where the data sits, who may see it, and when it disappears. Technically that means a record describing the actual data flow, retention periods per data category — including for backups — and access rights that match what the privacy policy claims.
Which technologies do you use?
Next.js on the front end, Python with FastAPI on the back end, data on servers in Germany. No tracking without consent and no third-party scripts quietly siphoning data.
Does every application involve AI?
No, deliberately so. Where AI is used, a deterministic layer sits in front of it — cheaper, faster and traceable. In our receipt-capture case study that layer settles 94 % of bookings without a single AI call.
Can you review an existing application?
Yes. For an existing application a security test is a more honest starting point than a rebuild — it shows what actually needs doing instead of guessing.
Do you also handle the legal assessment?
No, we are not legal counsel. We build and run the technical side and document it so your data protection officers can work with it. Where a requirement cannot be met cleanly in technical terms, we say so beforehand.
Get in Touch
Have a project?
Let's bring your idea to life together. We're happy to advise you with no obligation.