A GotoDeck compliance scan turns a short product description and target markets into a structured market-access brief in minutes. You fill seven fields, run deterministic rule packs first, then optionally add a labelled AI narrative. The output is decision-support for founders — not a certificate, not legal advice, and not a guarantee that any regulator will clear your launch.
Crossing from a single home market into the EU, UK, US, Canada, Australia, or Japan usually means stacking privacy, tax, consumer, distribution, and payment themes on top of product work. Solo founders rarely have a full-time compliance hire. The practical need is a repeatable checklist that names the same themes every time, so you know what to ask counsel — not a tool that pretends to finish the legal work.
GotoDeck is built around that job. The ruleset is versioned. Hits carry severity, remediation cues, and references. Heavily regulated sector flags (finance, health, children) surface early so you do not treat a consumer SaaS checklist as enough for a licensed product.
Write two to six sentences that state what the product does, who pays, and what data moves. Vague marketing slogans produce weak hits. Specific sentences such as "B2B analytics SaaS that stores customer emails and Stripe customer IDs for EU and US tenants" give the classifier something to match.
Comma-separated codes or names (EU, US, UK, CA, AU, JP). Markets drive which regional packs apply. Selecting markets you do not serve yet is fine if you are planning ahead; just remember the brief is a planning artifact, not a live registration status.
These selects flip flags for consumer-facing obligations, payment regulation cues, app-store privacy labels, and children's privacy themes such as COPPA when the age group includes children. See the FTC's COPPA rule page if minors are in scope.
Internally the run advances intake → classify → assess → report. Classify is deterministic: the rule engine evaluates markets, business model, PII, payments, distribution, and age group against a versioned ruleset. Assess may call an LLM for a narrative that must respect those rule hits and must not invent legal guarantees. Report formats both into a readable brief with a runId.
| Mode | When | What you see |
|---|---|---|
| Live | Key configured, quota ok | HTTP 200 with source Model-assisted |
| Demo | You explicitly enable Demo | HTTP 200 with demo:true and a clear banner |
| Not configured | No OPENAI_API_KEY | HTTP 503 AI_NOT_CONFIGURED |
| Upstream fail | Model error | HTTP 502 AI_UPSTREAM_FAILED |
| Quota | Fair-use exhausted | HTTP 429 before the model call |
That matrix exists so a missing key never looks like a successful live AI answer. Support chat follows the same honesty pattern: kb-only replies are labelled when the model is unavailable.
Each hit includes an id, title, severity, remediation cue, and regions. High-severity hits often map to privacy bases, security of processing, consumer transparency, or payment handling. For privacy themes, start from official materials such as GDPR Article 6 on lawfulness and Article 32 on security of processing, plus the European Commission's data protection overview.
Consumer-facing SaaS should also skim the Commission's consumer rights materials. Advertising and US marketing claims should stay inside FTC guidance — see the FTC business guidance hub. If you send commercial email into the US, the CAN-SPAM compliance guide is a practical baseline for sender identity and unsubscribe mechanics.
When live AI is available, the narrative restates findings in founder language. It must not invent certifications, audit logos, or guarantee language. Treat it as a drafting aid for your internal memo. For AI-feature products, also read the OWASP Top 10 for LLM Applications and LLM01 prompt injection so support and product prompts do not become an attack surface.
Export or copy the brief. Open tickets for high hits. Book counsel for anything that touches licensed activity, health data, children, or complex cross-border transfers. Keep the runId if you want to compare a later product description against the same ruleset version.
Pricing context: Free includes a small monthly scan budget; Pro expands quota and export; Enterprise adds multi-seat and BYOK options. Checkout always goes through /api/checkout so session links are minted fresh (hard-coded cs_ URLs expire in about 45 minutes).
Imagine a North American B2B SaaS that stores work emails, bills via card, and plans an EU launch next quarter. Inputs: markets EU,US; B2B; collects PII yes; payments yes; distribution Web; age Adults. Expect privacy and payment themes, VAT/OSS reminders for EU digital services, and consumer-protection notes that may be lighter for pure B2B but still matter if any self-serve consumers exist. The brief should push you toward a data map, a lawful-basis table, and a conversation with tax counsel — not a green checkmark.
Older links under the gstack name redirect to GotoDeck URLs. The product slug is gotodeck; the Vercel project may still appear as gstack-saas in dashboards. Bookmarks to how-to-run-a-gstack-compliance-scan-2026.html should land on this article.
Run the scan from the home page demo block, review severity first, then schedule the human work the tool cannot do. That is the intended loop for 2026 indie and small-team launches.
Keep a shared spreadsheet with columns for rule id, owner, due date, status, and the official URL you used. When a hit repeats across scans, merge tickets instead of opening duplicates. When a hit disappears after a product change, record why so future teammates do not reintroduce the same gap.
Schedule a 30-minute review after every major pricing or data-model change. Invite engineering, support, and whoever owns billing copy. Read severity high items first. Resist the urge to close medium items with "we will fix later" unless a date is attached.
For vendors, maintain a short processor list with purpose and region. When you add analytics or a new AI provider, update both the privacy policy and the GotoDeck product description so the next scan matches production. If support macros mention compliance claims, route them through the same honesty rule as the marketing site.
Store runIds next to release tags in your changelog. That makes it possible to answer "what did we know at launch" without archaeology. If counsel asks for source links, prefer the Commission, EDPB, FTC, and OWASP pages cited in this article over secondary blog roundups.
Finally, separate backlog hygiene from launch gates. A launch gate is a small set of must-fix items tied to the markets you will bill in the first 90 days. Everything else stays visible but does not block revenue if counsel agrees the residual risk is acceptable and documented.
A practical documentation pack for multi-market SaaS includes: product description (one page), data map, lawful-basis table, sub-processor list, security overview, incident contact, refund policy, support escalation path, and the latest GotoDeck brief with ruleset version. Store them in a folder that sales, support, and engineering can all read. When an enterprise prospect asks for security answers, reply from this pack instead of improvising in email.
Update the pack when you change authentication, add regions, introduce AI features, or switch payment providers. Each update should note the date and the person who approved public wording. That habit prevents the common failure where the privacy policy, the app-store label, and the sales deck describe three different products.
No. Deterministic rule packs run without a key. Narrative assist needs configuration. Explicit Demo mode is labelled on the response.
No. It surfaces themes and remediation cues. Lawfulness still depends on your lawful basis, records, and counsel — see GDPR Art.6.
The API returns 502 with AI_UPSTREAM_FAILED. It does not invent a fake live success under HTTP 200.
Yes. Successful scans store a runId via /api/runs so you can pull the structured result later.