Privacy & Compliance Suite

Paid pluginsize Lplanned, not built

Indicative price, not an offer: EUR 250-500/year or EUR 600 one-off

Generated from docs/plan/paid/privacy-compliance-suite/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

Paid bundle (EUR 250–500/year or EUR 600 one-off) combining GDPR + CCPA + LGPD + APPI enforcement: cookie consent management, multi-region privacy flows, DSR (data subject request) automation, consent audit logs, and accessibility compliance (WCAG, color contrast, alt text, focus). Merchants face fines up to EUR 20M (GDPR), USD 7,500 per incident (CCPA), BRL 50M (LGPD), or JPY 1B (APPI) if they fail. A complete compliance suite is a business requirement for international merchants.

The problem

We face GDPR fines of EUR 20M, CCPA penalties up to USD 7,500 per incident, LGPD fines of BRL 50M+, and ADA/WCAG lawsuits for non-compliance. We need comprehensive privacy and accessibility enforcement — cookie consent, multi-region flows, DSR handling, and accessibility validation — all in one place.

What it does

• Cookie consent management (GDPR, Google Consent Mode v2): banner, category-based consent, analytics/marketing/functional toggles, consent audit log
• Multi-region privacy flows (CCPA, CPRA, LGPD, APPI): region detection, region-specific disclosures, DSR handling with jurisdiction-specific deadlines
• DSR (Data Subject Request) workflow: automated email notifications, identity verification, access/delete/portability/correct fulfillment within regional deadlines
• Accessibility audit (WCAG 2.1 AA): page scanner, inline editor checks, issue dashboard, export reports
• Accessibility enforcement: focus indicators, skip links, font-size adjuster, color contrast validator, alt-text suggestions
• Consent and compliance audit logs: all consent grants, denials, DSRs, and compliance events logged with timestamp and proof
• Settings: centralized privacy and accessibility configuration (all toggles, templates, verifications in one admin section)

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• No legal advice or template generation — merchants must ensure compliance with their jurisdiction’s laws (reason: AstroBaaS is a tool, not a law firm)
• No automatic remediation — merchants must fix accessibility issues themselves (reason: accessibility is a design choice)
• No guaranteed deadline enforcement — module alerts but cannot force compliance (reason: legal compliance is a business process, not an API output)

Data model

Combined from all component modules: ConsentLog, DataSubjectRequest, AccessibilityIssue, AuditLog (all events). Settings: all privacy and accessibility toggles, templates, verification methods. No single new entity; consolidates existing ones.

API

• GET /api/compliance/status → { gdpr: boolean, ccpa: boolean, lgpd: boolean, appi: boolean, wcag: boolean, accessibility_score }
• GET /api/compliance/dashboard → { consent_rate, dsr_count, accessibility_issues, upcoming_deadlines }
• GET /api/compliance/audit-log (all compliance events across all modules)

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Compliance dashboard: overview of all privacy + accessibility status, compliance deadlines, audit log. Settings → Compliance Suite: centralized toggles for GDPR/CCPA/LGPD/APPI, cookie banner config, accessibility settings, DSR verification method. Single settings page instead of five separate ones. Monthly compliance report (exportable) showing: consents granted/denied by region, DSRs fulfilled, accessibility score, audit log.

The seam — why this is paid

Paid bundle owns the suite assembly, unified dashboard, and compliance reporting. Individual modules (GDPR, CCPA, WCAG, etc.) own their own logic. Core owns customer/order/post entities that the suite audits.

Paid per-country obligation. Requires legal expertise, regulatory monitoring, and support for audit compliance.

Dependencies

• All privacy + accessibility modules (GDPR Cookie Consent, CCPA Multi-Region Privacy, WCAG Checker, etc.)
• Audit logging (core)
• Settings (core)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Activating the bundle enables all privacy + accessibility features
• Compliance dashboard shows ‘GDPR: Compliant (95% consent rate)’, ‘CCPA: Pending (1 DSR overdue)’, ‘WCAG: 92 issues, AA-compliant on 85% of pages’
• Monthly compliance report exports as PDF: consent rates by region, DSR fulfillment times, accessibility trend
• All settings (cookie categories, CCPA flow, WCAG rules, focus indicators) are in one admin section
• Audit log combines all compliance events (consent, DSR, accessibility scan, focus change) in one queryable list

Risks

Merchants forget to enable individual modules; suite is incomplete (e.g., GDPR enabled but CCPA not). Compliance dashboard is advisory; merchant ignores overdue DSR deadline. Accessibility score is misleading (e.g., 92% but pages are not usable). Regional detection (CCPA) is GeoIP-based and wrong; merchant over/under-complies. Monthly report is generated but not reviewed; merchant still faces fines.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.