GDPR applies to a US company that offers goods or services to people in the EU or monitors their behaviour, even with no office there. What that means in practice, the documents enterprise customers will ask for (a DPA, a subprocessor list, a transfer mechanism such as the EU-US Data Privacy Framework), and the engineering it implies.
Article 3(2) of the GDPR extends it to organizations outside the EU that offer goods or services to people in the EU, or monitor their behaviour there. A US app with EU sign-ups, EU pricing or EU marketing is likely in scope. A purely US business that occasionally gets an EU visitor usually is not.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
A DPA that meets Article 28.
A subprocessor list (your cloud, email, support and analytics vendors) and notice before adding one.
A transfer mechanism for data leaving the EU: the EU-US Data Privacy Framework, which the European Commission found adequate on July 10, 2023 and which US companies join by self-certifying, or Standard Contractual Clauses.
Where data is stored, and sometimes an option to keep it in the EU.
Security measures, usually answered by a SOC 2 report or an ISO 27001 certificate.
A data map: what personal data you hold, where, why and for how long.
Export and deletion per person, across every store, which the right of access and erasure require.
Consent handling for non-essential cookies and tracking for EU visitors.
Retention limits that actually delete.
Breach procedures that can notify the supervisory authority within 72 hours where required.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Multi-Tenancy Basics for B2B SaaS: Pooled vs Siloed, and Making Isolation Real
Every B2B app has to keep one customer's data from another's. Shared tables with a tenant ID are cheapest and the most common; separate databases or accounts per tenant are easier to explain to enterprise buyers. The models, where isolation is actually enforced, noisy neighbours, and when to move a big customer to its own silo.
Read
Your App Has Users Now: The Internet Underneath It, on One Page
Building fast skips the parts of the internet that only matter once people depend on you: DNS, certificates, email authentication, caching, timeouts, backups and abuse. What happens between someone typing your domain and your database answering, what breaks at each step, and the order we would fix things in.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.