Marco Sadjadi
ee4713f82c
feat(account): self-service GDPR Art.17 erasure; Enterprise price -> Custom
...
Deploy to Production / deploy (push) Successful in 1m19s
Account deletion (DELETE /v1/account): re-type email/phone to confirm, stops live containers and hard-deletes every org where the caller is sole member (FK cascade clears servers, builds, logs, encrypted secrets), deletes the user (cascade drops sessions), audits the action, clears the session cookie. Frontend danger-zone replaces the old open-a-ticket placeholder. Closes audit ACC-001. Enterprise price unified to Custom on landing + pricing, removing the 499/999 inconsistency.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-05-31 19:23:41 +02:00
Marco Sadjadi
ef30baf52a
feat: Swiss-compliant launch — Impressum/AGB/Contact, support panel, DSG exports, cookie banner
...
Deploy to Production / deploy (push) Successful in 57s
Legal (Swiss minimum, no individual named):
- Impressum page (UWG Art. 3 lit. s) — provider, contact via support panel,
no email required, jurisdiction = Switzerland
- AGB page — subscription terms, payment, cancellation, suspension on payment
fail, 14-day money-back, AI-processing-per-tier disclosure, Swiss law +
Swiss venue, modeled after typical Schweizer SaaS terms
- Privacy: Stripe added as subprocessor with full data-flow disclosure
Support panel replaces email contact entirely:
- @bmm/db: support_status enum + support_tickets + support_messages tables,
migration applied to prod DB
- @bmm/api: support routes (user create/list/view/reply, admin list/view/reply
/set-status), public /v1/contact for logged-out visitors with per-IP rate
limit of 3 submissions/day to prevent spam-flood
- Web: /settings/support (list + new), /settings/support/[id] (conversation),
/admin/support, /admin/support/[id]
- Public /contact form with email collection for guest tickets
Data rights (DSG Art. 25 / GDPR Art. 15+20):
- /v1/account/export returns user-scoped JSON of profile, org, servers,
builds, audit, support tickets and messages — excludes hashes, encrypted
secrets, other-user data
- /settings/account: download button + deletion-via-ticket workflow
Production-readiness gaps closed:
- org.suspended now blocks /v1/servers POST and /v1/servers/preview (402);
webhook flagged this state but enforcement was missing
- Cookie banner: minimal, essential-cookies-only disclosure (Swiss DSG +
GDPR compliant without dark-pattern consent UI), mounts on both layouts
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-25 17:12:06 +02:00
