▸case-01 We are updating our web app's tracking scripts and user signup flow. Please review our consent prompts, data retention approaches, and third-party analytics connections. Give us a breakdown of findings highlighting risk severities, relevant legal standards, and actionable fixes, making sure to separate technical software issues from regulatory exposure. | fail→fail | 21,583 | 37,223 | +72% | 1 | 1 | 0% | 4,312 | 6,339 | +47% | 0 | 0 | — |
▸case-02 Our SaaS product uses several open-source modules and processes user data across multiple regions. Could you audit our data residency rules, open-source license compliance, and cookie consent mechanisms? Provide a detailed review categorized by severity and legal reference, clearly differentiating code bugs from legal liabilities. | fail→fail | 30,394 | 21,856 | -28% | 1 | 1 | 0% | 6,196 | 4,249 | -31% | 0 | 0 | — |
▸case-03 We are bundling a GPLv3-licensed C++ library into our proprietary closed-source Windows desktop application, dynamically linking it via a DLL. The team believes dynamic linking avoids copyleft triggers. Evaluate this setup and provide compliance findings. | pass→fail | 13,484 | 3,932 | -71% | 1 | 1 | 0% | 2,403 | 360 | -85% | 0 | 0 | — |
▸case-04 Our US-hosted cloud infrastructure syncs raw EU customer telemetry and personal identifiers to US S3 buckets without using Standard Contractual Clauses (SCCs), assuming AWS EU servers are sufficient. Review this cross-border transfer setup for regulatory risk. | pass→pass | 15,627 | 34,536 | +121% | 1 | 1 | 0% | 2,962 | 3,495 | +18% | 0 | 0 | — |
▸case-05 Our e-commerce website sends user activity to third-party ad networks via marketing tags. We put a link in our privacy policy sub-page titled 'Privacy Settings', but do not process Global Privacy Control (GPC) opt-out signals. Audit our compliance. | pass→pass | 14,313 | 19,635 | +37% | 1 | 1 | 0% | 2,743 | 4,055 | +48% | 0 | 0 | — |
▸case-06 Our web app displays a cookie banner on first visit with 'Analytics' and 'Marketing' checkboxes pre-checked by default, allowing users to hit 'Accept Selected' or 'Close'. Provide a compliance evaluation with severity ratings and remediation steps. | pass→fail | 12,449 | 3,491 | -72% | 1 | 1 | 0% | 2,508 | 374 | -85% | 0 | 0 | — |
▸case-07 We deployed a modified version of an AGPLv3 microservice internally behind our cloud API gateway. Since end users do not download the software binary, our lead dev claims AGPL source disclosure requirements do not apply. Audit this architecture. | fail→fail | 14,777 | 4,763 | -68% | 1 | 1 | 0% | 2,608 | 432 | -83% | 0 | 0 | — |
▸case-08 Our user database soft-deletes closed accounts by setting `is_deleted = true`, keeping all personal profile data, order histories, and IP logs indefinitely for analytics. Audit this data retention approach against GDPR Article 5 storage limitation. | pass→fail | 15,138 | 3,806 | -75% | 1 | 1 | 0% | 2,799 | 370 | -87% | 0 | 0 | — |
▸case-09 We copied several Apache 2.0 source files directly into our commercial codebase and stripped the top copyright headers to clean up code style, though we kept the original LICENSE file in the repo root. Audit our open-source compliance. | pass→fail | 13,405 | 24,969 | +86% | 1 | 1 | 0% | 2,345 | 344 | -85% | 0 | 0 | — |
▸case-10 Our online mobile game allows children under 13 to register using an email address and birthdate, sending a welcome email without requiring verifiable parental consent, relying on an in-game pop-up asking 'Do you have parent permission?'. Audit this onboarding flow. | pass→fail | 16,505 | 3,861 | -77% | 1 | 1 | 0% | 2,851 | 425 | -85% | 0 | 0 | — |
▸case-11 Our incident response playbook dictates that security breaches affecting database PII must be investigated for 30 business days by internal engineering before notifying management or external regulatory authorities. Audit this policy. | pass→fail | 15,977 | 6,405 | -60% | 1 | 1 | 0% | 2,503 | 361 | -86% | 0 | 0 | — |
▸case-12 We imported a modern MongoDB-driver client library licensed under SSPL into our SaaS platform backend microservice. Our team treats SSPL the same as MIT/BSD since it's an OSI-adjacent license. Audit our license risk. | pass→fail | 17,640 | 4,477 | -75% | 1 | 1 | 0% | 3,022 | 335 | -89% | 0 | 0 | — |
▸case-13 Our mobile app uses facial recognition photo scans for account identity verification. We added a line in our general Terms of Service stating 'We may use biometric data for verification'. Audit this consent flow against Illinois BIPA requirements. | pass→pass | 14,259 | 22,950 | +61% | 1 | 1 | 0% | 2,611 | 4,021 | +54% | 0 | 0 | — |
▸case-14 Our web app allows 1-click subscription signup, but cancellation requires users to fill out a 5-step survey, wait for an email link, and call customer support during business hours. Audit this flow against consumer protection standards. | pass→fail | 15,236 | 4,906 | -68% | 1 | 1 | 0% | 2,865 | 406 | -86% | 0 | 0 | — |
▸case-15 We train internal machine learning models on raw production customer support chats (which include customer names and email addresses) without separate consent or an option to opt out of model training. Audit this data handling practice. | pass→fail | 15,761 | 4,524 | -71% | 1 | 1 | 0% | 2,665 | 448 | -83% | 0 | 0 | — |
▸case-16 Our iOS app integrates third-party marketing SDKs that track user advertising IDs (IDFA) and IP addresses. Our privacy policy lists 'analytics partners' generally without naming specific vendors or data categories shared. Audit this integration. | pass→pass | 19,150 | 31,885 | +67% | 1 | 1 | 0% | 3,419 | 6,323 | +85% | 0 | 0 | — |
▸case-17 When a user submits a 'Delete My Account' request under GDPR, our support team emails them a PDF form requiring notarized photo ID before processing the deletion manually within 90 days. Audit this DSAR fulfillment process. | pass→fail | 14,435 | 4,306 | -70% | 1 | 1 | 0% | 2,692 | 434 | -84% | 0 | 0 | — |
▸case-18 Our C++ project merges GPLv2-only source code files into an Apache 2.0-licensed repository to create a single compiled executable library. Audit this codebase for licensing conflicts. | pass→fail | 13,070 | 3,811 | -71% | 1 | 1 | 0% | 2,485 | 298 | -88% | 0 | 0 | — |
▸case-19 Our build pipeline minifies and tree-shakes all client-side JavaScript packages into a single `bundle.js`, stripping all license headers and top-of-file MIT copyright comments. Audit this JS bundling process for open-source compliance. | pass→pass | 12,817 | 21,821 | +70% | 1 | 1 | 0% | 2,357 | 4,016 | +70% | 0 | 0 | — |
▸case-20 We are negotiating a commercial M&A share purchase agreement and the seller wants to cap environmental indemnity liability at 10% of purchase price. Please review this clause and draft alternative negotiation language for the indemnity cap. | pass→fail | 15,299 | 3,734 | -76% | 1 | 1 | 0% | 2,782 | 327 | -88% | 0 | 0 | — |
▸case-21 Our enterprise customer is requesting a 99.99% availability Service Level Agreement (SLA) with financial credit penalties for downtime. Please draft a standard SLA agreement section defining service credits and scheduled maintenance exclusions. | pass→fail | 13,201 | 4,688 | -64% | 1 | 1 | 0% | 2,514 | 470 | -81% | 0 | 0 | — |
▸case-22 We want to register a trademark for our software product name 'DataShield' in Class 9 and Class 42 with the USPTO. Please explain the application filing requirements and specimen submission rules. | pass→fail | 15,220 | 4,449 | -71% | 1 | 1 | 0% | 2,823 | 383 | -86% | 0 | 0 | — |