Security and compliance for AI-built apps
You shipped it in a weekend. Now a customer wants to know if it’s “secure” and “GDPR compliant”, and the honest answer is a shrug. Connect Ansvar to the agent that built your app and turn the shrug into a cited report.
Threat-model my app. Next.js + Postgres on Vercel, Stripe billing, EU users.
Verify webhook signatures; reject unsigned payloads.
GDPR Art. 32 — Security of processing · eur-lex.europa.euShipping fast is the easy half
A weekend of prompting gets you a working app. It does not get you a reviewed one.
Your app works. It also stores personal data, talks to Stripe, and serves people in the EU — three things the law has opinions about. Nobody threat-modeled any of it, because you were busy shipping and the model never brought it up. Then a customer’s procurement team sends the security questionnaire, and “the AI said it’s fine” is not something you can paste into the answer box.
Three steps, no new tools to learn
The same agent that wrote your code runs the review.
- ConnectAdd one MCP server to Claude, Cursor, ChatGPT, Copilot, or Gemini — whichever agent you already argue with. OAuth sign-in, a few minutes. Setup guide.
- DescribeTell your agent what the app is, in plain words: “Next.js, Postgres, Stripe, EU users.” No forms, no uploads — your code stays with you. The review works from a description.
- Get the reportA server-enforced workflow walks your agent through a STRIDE threat model — and, when you handle personal data, a separate privacy threat model — then produces a report (PDF, if you like) you can send to the customer instead of a nervous emoji.
From a description to fourteen findings
Same fictional app as the prompt up top: first the map, then the findings from walking it — the part your customer actually reads.
Next.js + Postgres on Vercel, Stripe billing, EU users.
The system map: your users (EU, browsers) and Stripe (external billing) sit on the internet side of trust boundary B1. Users reach the Next.js API on Vercel over HTTPS and Stripe calls it with webhooks — both crossing B1. The API queries Postgres, which holds personal data, across trust boundary B2.
The review starts where arrows cross the dashed lines.
- Elevation of privilegeCritical
Any signed-in user can read any other account's data
Scope every query to the session's user id — signed-in isn't authorized.
GDPR Art. 5(1)(f) — Integrity & confidentiality - RepudiationHigh
No auth or admin logs — a breach would be invisible
Log sign-ins, resets, and admin actions — you can't report a breach you can't see.
GDPR Art. 32 — Security of processing - SpoofingMedium
Password-reset tokens never expire and survive a password change
Single-use reset tokens with a short clock.
OWASP ASVS v4.0.3 — Credential recovery - Information disclosureMedium
The reset form tells strangers which emails have an account
Return the same response whether the address exists or not.
marked unresolved — no served legal basis found
Tomorrow's fix list
Ranked by severity. Start at the top, close them like tickets.
The questionnaire answer
“Do you have a threat model?” Yes — attached.
Proof, not promises
Findings that touch the law carry the citation. Gaps get flagged, not filled in.
False positives die at home
Your agent has the code — or grant it GitHub access — and can check each finding against what's actually there. Ansvar never asks for it.
It cites the actual law — or it tells you it can't
Compliance folklore is free everywhere. Sources are the product.
Ask a bare model about GDPR and you get an answer assembled from vibes: confident, sometimes right, never checkable. The gateway is wired the other way around. It looks up the law, quotes it, and links the official text — and when it can’t find something, it says so instead of improvising. Your report ends with citations, not folklore. (The analysis is still your agent’s work — the gateway’s guarantee is the sourcing.)
Your dependencies get the same treatment: checked against live CVE data and CISA’s known-exploited list, on the free plan. It screens the packages you name — it is not a code scanner, and it won’t pretend to be one.
Shortcut: install the Regulatory Threat Model skill — one file that teaches your agent this whole flow. More on the agent skills page.
Questions builders ask before connecting
If yours is not here, ask us — every message gets a human answer.
Is my AI-built app GDPR compliant?
No tool can stamp you compliant, and anyone who says otherwise is selling stickers. What you can do is find out which rules actually touch your app, then produce the assessments they expect — security measures, and a data protection impact assessment when what you do with people's data is likely to be high-risk — with citations to the real text.
What does a threat model give me?
A structured list of what can go wrong in your app, component by component, ranked, with fixes — and citations to the legal requirements involved, where there are any. It's usually the first thing a security-minded customer asks for. Now you'll have one.
Do I need a DPIA?
Only when your processing is likely to be high-risk for the people in your data — think profiling that affects real outcomes, lots of sensitive data, or monitoring public spaces at scale. If that sounds uncomfortably familiar, the DPIA workflow (Team plan) walks the assessment and produces the report. Orientation, not legal advice.
Which tools does this work with?
Claude, Cursor, ChatGPT, Microsoft Copilot, Gemini — anything that speaks MCP.
Is there a free plan?
Yes, with a business sign-up: regulatory search, law lookups, citation checks, and the CVE lane. Threat modeling starts on the Premium plan — prices live on the pricing page.
Can it scan my code?
No — on purpose. It threat-models the system you describe and screens the dependencies you name; it never asks for your code. Your agent is a different story: it already has the repo (or you can grant it GitHub access), so it can check each finding against the actual code and call out the false positives — that check stays on your side. Keep your code scanner — this adds the design review and the law on top.
Let your agent clean up after itself
Connect the gateway and get the review done before the next customer asks.
Free covers the vulnerability screen and law lookups (business sign-up). Threat modeling starts on Premium — metered monthly, STRIDE and privacy runs counted separately; see Pricing. Research support for professional review, not legal advice.