MODEL
Threat model → personal-data scope.
The model traces personal data, identifies controllers and processors, and maps each finding to the Article that governs it.
GDPR
Article 25 data protection by design, in code.
VibeReview traces personal data through your services and generates guardrails for Article 25 (by design and by default), Article 32 (security of processing), and Article 35 (DPIA inputs). Evidence sits in your audit log, not in a quarterly review meeting.
14-day free trial · No card required
You prompting Cursor · app/api/users/update.py
"Add a PATCH endpoint so users can update their profile."
VibeReview matched 3 GDPR articles · invisibly - ✓ Art 5(1)(c) — accept only the explicit subset of editable fields
- ✓ Art 30 — log the lawful basis on every personal-data write
- ✓ Art 17 — reject writes when the user holds an active erasure request
ALLOWED = {"display_name", "locale", "marketing_optin"}
@app.patch("/users/me")
def update_me(
body: dict,
user = Depends(auth),
):
if erasure.is_pending(user.id):
raise Conflict("erasure in progress")
fields = {k: v for k, v in body.items() if k in ALLOWED}
db.update("users", user.id, **fields)
audit.log(
"user.updated",
actor=user.id,
fields=list(fields),
lawful_basis="contract",
)✓ Minimized fields. Erasure-aware. Lawful basis recorded. Articles 5, 17, and 30 satisfied without a privacy-team review.
ENFORCE
Guardrails → Articles 25, 32, 35.
Minimization, lawful processing, encryption, pseudonymization, integrity, resilience. Each guardrail cites the Article it enforces.
EVIDENCE
PR review → per-Article evidence.
Every diff that touches personal-data code runs the matching guardrails. Audit log records the Article and the outcome.
REPORT
Mapping report → DPIA-friendly.
Per-Article coverage. Useful inputs for Data Protection Impact Assessments and supervisory authority responses.
WHAT'S COVERED
GDPR Articles and the VibeReview controls behind them.
Coverage focuses on Articles directly addressable through code controls.
- Article 5 — Principles relating to processing: Guardrails on data minimization, purpose limitation in code paths, storage-limitation patterns.
- Article 25 — Data protection by design and by default: Threat-modeled guardrails at prompt time. Every new feature ships with by-design controls. Audit log proves the chain.
- Article 28 — Processor obligations: VibeReview is a processor under your DPA. Code never persists. Audit log is your own.
- Article 32 — Security of processing: Guardrails on encryption-at-rest, encryption-in-transit, pseudonymization, integrity, resilience patterns.
- Article 33 — Breach notification: Audit log captures security-relevant events with timestamps and authors. Useful evidence for 72-hour notification timelines.
- Article 35 — DPIA inputs: Threat model output names data flows, processing purposes, and identified risks. Drop into your DPIA template.
Get the GDPR mapping report for your repo.
Bring your DPO. We walk through personal-data scope, Article 25 evidence, and DPIA inputs.