LCMS Legal and Security Review

What this review assumes

This is a product-readiness review, not a certification opinion. It applies to a narrow B2B beta and deliberately excludes higher-risk use until a separate assessment is complete.

What the current LCMS already does well - and where independence breaks

The findings below are based on the LCMS code at commit fef65e848e19. Deployment configuration, vendor contracts, production access, and operational practice were not available in the repository and therefore remain evidence gaps.

Personal data, roles, purposes, and lawful bases

The company will be both a controller and a processor. The role changes by processing purpose; it should not be described with one blanket label.

Minimum GDPR artifacts

• Data inventory and record of processing: systems, fields, purposes, recipients, locations, transfers, retention, and safeguards (Arts. 5 and 30).
• Privacy notice: controller identity, purposes, lawful bases, recipients, transfers, retention, rights, complaints, and contact routes (Arts. 12-14).
• Processor DPA: subject matter, duration, data, people, instructions, confidentiality, security, subprocessors, rights assistance, breach support, deletion/return, and audit rights (Art. 28).
• Privacy by design: default minimization, private content, restricted permissions, short retention, and review of every new vendor/data field (Art. 25).
• Transfer assessment: document where every subprocessor stores/supports data and use an adequacy decision, SCCs, or applicable UK mechanism as required (Arts. 44-49).

Ten items required before the first independent beta customer

These are the go/no-go conditions. Manual, well-documented processes are acceptable for a small beta; missing processes are not.

1. Blocker 01
   Independent identity and tenant lifecycleReplace platform/VAR bearer-cookie dependency with standalone OIDC/SAML or a clearly contracted shared identity service. Require MFA for privileged access, safe provisioning, role assignment, revocation, and offboarding.
2. Blocker 02
   Signed beta terms and DPAEvery beta customer accepts the service terms, acceptable-use rules, privacy allocation, security responsibilities, subprocessor terms, liability framework, and beta limitations before receiving access.
3. Blocker 03
   Privacy notice and contact routesPublish a product-specific notice and monitored privacy/security contact addresses. Do not rely on a generic company notice unless it accurately covers the LCMS.
4. Blocker 04
   Data map, RoPA, lawful bases, and DPIA screenApprove the data inventory and purposes. Record controller/processor roles, the legitimate-interests assessment, special-data exclusions, and DPIA/DPO/representative decisions.
5. Blocker 05
   Subprocessors and international transfersConfirm the real deployment list, locations, DPAs, transfer mechanisms, security posture, and customer notification/change process.
6. Blocker 06
   Retention, export, deletion, and rights runbookSet enforceable periods for every data class. Demonstrate account/content export and deletion, explain backup expiry, and establish a 30-day request workflow.
7. Blocker 07
   Telemetry privacy correctionTurn off Sentry default PII; redact secrets/content; disable non-essential Segment collection until consent and vendor controls are ready; minimize LaunchDarkly identifiers.
8. Blocker 08
   Production security baselineProve TLS, encryption at rest, secret management, least privilege, MFA, private storage, rate limiting, dependency scanning, patch ownership, backups, and a successful restore test.
9. Blocker 09
   Tenant-isolation and authorization release testsTest cross-tenant reads/writes/uploads/search/preview/API access and all three roles. Resolve the incomplete visibility-rule enforcement before offering affected sharing modes.
10. Blocker 10
    Incident and breach responseName an incident lead and alternates, keep an incident log, define containment/forensics/customer notice steps, and contractually support controller notification without undue delay. Controllers need a process capable of meeting the GDPR 72-hour authority deadline where applicable.

Documents the independent product needs

Additional commercial protections

• Customer retains ownership of its content and grants only the license necessary to host, process, back up, and deliver it.
• Customer warrants it has the rights and notices required for uploaded materials; provide an infringement/takedown channel.
• Do not store payment-card data in LCMS. Use a payment provider and document that boundary.
• Complete an open-source license inventory/SBOM and remediate incompatible or missing notices before general availability.
• Screen export-control, sanctions, sector-specific education rules, and local contracting rules as the market expands.

Minimum technical controls for beta

Specific engineering fixes

• Set Sentry sendDefaultPii to false and implement explicit event scrubbing.
• Remove IP, external user UUID, and raw tenant identifiers from Segment unless approved for a necessary purpose; prefer aggregated beta metrics.
• Mark LaunchDarkly name/tenant attributes private or use pseudonymous keys.
• Remove legacy database credentials and reverse-sync workers from the independent deployment.
• Reduce preview credential duration from one hour where practical and bind authorization checks to current user/tenant as well as course/version.
• Decide whether search indexes customer content; apply tenant isolation, deletion propagation, minimization, and subprocessor controls.

How the beta handles rights, deletion, and incidents

Data-subject and customer requests

1. Log the request, date, requester, customer, data scope, and legal role.
2. Verify identity proportionately; never collect more identity evidence than necessary.
3. If LCMS is a processor, promptly route the request to the customer/controller and act only on documented instructions unless law requires otherwise.
4. Search accounts, memberships, content metadata, logs, support, analytics, error monitoring, feature flags, search indexes, and relevant vendors.
5. Export, correct, restrict, object, or delete as directed; record exceptions and backup expiry.
6. Respond within one month under GDPR unless a lawful extension applies; keep the completion evidence.

Retention schedule to approve

Use the periods below as product decisions, not automatic legal defaults: active account data for contract life; content until customer deletion/termination plus a short recovery window; authentication/session data for days; security logs for months based on investigative need; support records for a defined business/legal period; stale multipart uploads for hours or days; backups on a fixed rolling expiry; telemetry shorter than primary product data. Legal should approve the final table and engineering must prove enforcement.

Breach workflow

The incident lead records discovery time, affected tenants/data, containment, evidence preservation, risk assessment, vendors, decisions, and communications. As processor, LCMS must notify the affected controller without undue delay after becoming aware. As controller, the company must be capable of notifying the supervisory authority within 72 hours where the breach is likely to risk people, and affected people where the risk is high.

Build evidence habits now; do not buy an audit for beta

SOC 2 is independent assurance over controls, not a product license and not a substitute for GDPR compliance. Do not say “SOC 2 compliant” or “certified.” A CPA firm issues the examination report.

30/60/90-day path from conditional no-go to controlled beta

Go decision

The accountable product and security owners should sign a one-page release record that lists each gate, evidence link, residual risk, accepting owner, and customer restrictions. Any open blocker keeps the decision at no-go. Medium residual risks may be accepted only in writing with a deadline and a beta-specific containment.

What the launch reviewer should be able to open

Primary legal and assurance references

• EU General Data Protection Regulation - official text, especially Arts. 5, 6, 12-22, 25, 28, 30, 32-35, 37, and 44-49.
• EDPB Guidelines 07/2020 on controller and processor concepts.
• EDPB Guidelines 9/2022 on personal-data-breach notification.
• European Commission rules on international data transfers.
• European Commission Standard Contractual Clauses.
• ICO guidance on controller-processor contracts.
• ICO guidance on data protection by design and default.
• ICO guidance on cookies and storage/access technologies.
• AICPA Trust Services Criteria.

Repository evidence reviewed

resources/js/app.ts, app/Services/Segment/SegmentTracker.php, app/Services/LaunchDarkly/LaunchDarklyContext.php, app/Auth/EntryPointAuthenticator.php, app/Http/Middleware/SyncPlatformSession.php, app/Services/Preview/PreviewToken.php, multipart-upload services and tests, tenancy/permission configuration, routes, CI configuration, database migrations, and dependency manifests.