Desktop · macOS & Windows
Compliance is written in documents.
It is broken in code.
Norma 29 reads your source and your database schema and names the obligations your implementation currently fails — with the file, the line, and the article it comes from.
Free covers one regional framework plus every store policy. Scans, findings and the PDF report are never limited by plan.
What it reads
Three surfaces, one report
Source code
Frontend, backend, or both. Finds the logging statement that writes an identifier, the field collected without a stated basis, the token kept where it should not be.
Database schema
Reads the schema itself — columns holding personal data with no retention rule, no encryption, no deletion path.
Store review
Apple App Review and Google Play policy, on their own route, separate from the law of any country. A pre-flight check, not an approval guarantee.
How it works
Three passes over the same tree
Pattern rules
Fast, literal matches for the shapes that are wrong on sight — an identifier in a log line, a secret in a config file.
Semantic analysis
Semgrep reads the syntax tree, so a finding survives a renamed variable or a wrapped call. The app installs Semgrep for you, or uses the copy you already have.
Context
Tree-sitter adds the surrounding structure to each finding, so the report shows what the code was doing, not just which line matched.
What it refuses to claim
Every framework declares what it cannot check
A scanner reads code. It cannot read your contracts, your staff training, or the register you keep of processing activities. Across the frameworks shipped today,51 obligations are marked not testable by this tooland carried into the report as your remaining work.
The exported PDF prints no compliance percentage, and no scan result is a legal determination. That absence is the point: a number would be the first thing quoted back at you, and it would be indefensible.
Frameworks
The law is a versioned download, not a hard-coded feature
No framework is baked into the binary. You install the ones you need, and each carries its own version — so a report can always say which edition of the rules produced it.
| Framework | Jurisdiction | Kind | Declared limits |
|---|---|---|---|
| UU PDP No. 27 of 2022 | Indonesia | regional | 9 |
| GDPR | European Union | regional | 12 |
| Apple App Review Guidelines | Apple App Store | platform | 17 |
| Google Play Developer Policy | Google Play Store | platform | 13 |
Free: one regional framework, plus every store policy. Pro ($20/month) lifts the limit and keeps every rule set current.
Data handling
Nothing you scan leaves your machine
Scanning runs entirely on your computer. Source code, schemas, findings and reports stay in an encrypted database on your own disk — there is no upload step to opt out of, because there is no upload.
An account is needed to download rule sets and to hold your plan. Your email address is encrypted on your device before it is sent, so the server keeps a blind index it cannot read back — we cannot recover your address, and neither can anyone who takes the database.
Run it before the auditor does
Built for engineers carrying data-protection obligations without a compliance department behind them.