Self-Serve tier

Implement CCPA/CPRA compliance for a SaaS service with focus on business-purpose limitation under Cal Civ §1798.140(e), data subject rights (access/deletion/correction/opt-out under §1798.105/106/120), service-provider vs contractor vs third-party classification, sensitive person

Build / redline a Data Processing Addendum (DPA) for SaaS with EU GDPR + UK GDPR + EU-US Data Privacy Framework + 2021 Standard Contractual Clauses (Module 2 controller-to-processor) + UK International Data Transfer Agreement / Addendum. Embedded Schrems II adequacy, transfer imp

Determine EU AI Act 2024/1689 obligations for an AI system or General-Purpose AI model. Maps risk tiers (prohibited / high-risk / limited-risk / minimal), Annex III high-risk use cases, GPAI model + GPAI with systemic risk obligations, conformity assessment, post-market monitorin

Redline a SaaS Master Service Agreement focused on uptime SLA (99.9%/99.95%/99.99% downtime math), service-credit cap as sole remedy, force majeure scope, exclusions (scheduled maintenance, third-party providers, customer fault), liability cap interaction with credits, and termin

Plan / scope / evaluate a SOC 2 Type II audit under AICPA Trust Services Criteria (TSC 2017 + 2022 points of focus) + ISAE 3000 / SSAE 18 + AT-C 105/205. Maps in-scope systems, identifies common control families (CC1-CC9), addresses confidentiality / availability / processing int

Classify cryptographic SaaS / software / source code under U.S. Export Administration Regulations (EAR), specifically ECCN 5D002 (encryption commodities/software) and 5E002 (technology). Walks License Exception ENC requirements, classification request, encryption registration, ma

Audit open-source software (OSS) compliance with copyleft licenses (GPL v2/v3, AGPL v3, LGPL, MPL, EPL) and permissive (MIT, BSD, Apache 2.0). Maps copyleft propagation, AGPL §13 SaaS-trigger, derivative-work boundary, source disclosure obligations, attribution requirements, pate

Build an Inter Partes Review (IPR) defense strategy at the USPTO Patent Trial and Appeal Board (PTAB) under 35 U.S.C. §§311-319 + AIA. Maps timing, fees, page limits, prior art search strategy, claim construction (Phillips/BRI), §315 estoppel, parallel district court Fintiv discr

Build / negotiate the representations + warranties + indemnification + escrow + RWI insurance package for a SaaS acquisition. Maps R&W categories (organization / capitalization / financial / IP / data privacy / cybersecurity / contracts / employee / tax), survival periods, indemn

Apply Communications Decency Act §230, 47 U.S.C. §230 to user-generated content / takedown / moderation decisions. Maps publisher vs distributor distinction, §230(c)(1) immunity, §230(c)(2) good-faith curation, §230(e) carve-outs (FOSTA-SESTA, IP, federal criminal, ECPA), and pos

Run a third-party vendor risk assessment using CSA CCM v4 / CAIQ / SIG Lite + procurement gate framework. Maps NIST SP 800-161 supply chain risk, vendor classification (critical / high / medium / low), tiered diligence, ongoing monitoring (annual review + bridge letters), and con

Build a trade secret protection program + DTSA misappropriation claim under 18 U.S.C. §1836 + state UTSA. Embedded reasonable-measures requirement, ex parte civil seizure, 3-year statute of limitations, exemplary damages, attorney fees, whistleblower immunity, parallel state-law