Confida — Compliance SaaS for French Freelancers
"From legal research to production: building a compliance scanner, monitoring engine and GDPR tooling solo, end to end."
1. The Product
French freelancers and small businesses face a maze of legal obligations for their websites: legal mentions, GDPR, cookies, e-commerce rules. Most don't know what applies to them, and lawyers are overkill for a landing page.
Confida answers that with three things: an automated compliance scanner that audits any site against 12 rules derived from French law (LCEN, RGPD, post-SREN 2024), a continuous monitoring engine that re-scans registered sites and alerts on regressions, and practical GDPR tooling (processing registry generator, versioned questionnaires).
Everything was built solo under my EXQD SERVICES brand: legal research, rule engine, product, design, infra, transactional emails, billing architecture.
2. Stack
- Frontend / API: Next.js 14 + Hono, in a pnpm + Turbo monorepo.
- Database: Supabase (PostgreSQL) with Row Level Security for multi-tenant isolation.
- Infra: Railway, 3 services — web, API, and a dedicated rescan cron.
- Emails: Resend + React Email.
- Billing: Stripe, architected but dormant behind a feature flag.
3. Decisions That Mattered
A Deterministic Rule Engine, Not an LLM
The scanner is 12 hand-written rules, each verified against primary legal sources and tested on a corpus of 25 real websites. No AI in the verdict path. Compliance claims must be explainable and stable: telling a business owner "your legal mentions are missing the host's identity, required by Art. 1-1 LCEN" only works if the rule fires identically every time. An LLM would have been faster to ship and impossible to trust.
The legal research itself was the hidden iceberg — including catching that the 2024 SREN law renumbered the LCEN article most online guides still cite incorrectly.
Monitoring Built for Flapping
Websites are noisy: a site can fail a rule at 6am because of a timeout and pass at noon. The monitoring engine treats every tick as idempotent and applies anti-flapping logic before alerting — a state change must be confirmed, not just observed once. Users get one meaningful email, not a storm of false alarms. The cron runs every 6 hours as an isolated Railway service, so a scan burst never degrades the app.
Immutable Compliance History
The GDPR registry uses versioned, immutable snapshots: once a questionnaire is finalized, it is never mutated — revisions create a new version. For a compliance product, being able to prove "here is what your registry said on date X" is a feature, not an implementation detail.
Billing That Exists but Doesn't Run
Stripe is fully architected — subscription model, webhook-driven state, idempotence via an event ledger — but disabled behind a BILLING_ENABLED flag while the product runs in open beta. Webhooks are the single writer for subscription state: the app never mutates billing data directly, which eliminates an entire class of drift bugs before they can exist.
One Content Structure, Three Renderers
Scan reports needed to exist as web pages, PDF exports and emails. Rather than maintaining three versions, a single structured content source feeds all renderers (HTML, PDF via @react-pdf/renderer, email). Fixing a legal citation once fixes it everywhere.
4. Lessons
- Determinism is a product feature. In a trust-sensitive domain, "explainable and repeatable" beats "smart".
- Legal sources rot. Laws get renumbered; verify against Légifrance, not blog posts — then version your citations.
- Feature flags let you build ahead. The billing system was designed under real constraints without a single euro flowing, and can be switched on without a refactor.
- Idempotency everywhere. Crons, webhooks, alerts: every stateful operation assumes it might run twice.
Confida is live at useconfida.com.