Security, data and law

Required

• Test the access rules on the running product

  TDD-11

  With two test accounts in the running product, try to read and change the other account's records on every route. Check that no secret key ships to the browser and that payments are confirmed on the server.

Recommended

• Check how personal data is handled

  TDD-12

  Record whether a record of processing exists, which vendors receive personal data without a signed processing agreement, and whether deletion requests reach every store.

• Record the product's Cyber Resilience Act duties

  TDD-13

  State whether the Cyber Resilience Act covers the product. For a product it covers, name who reports exploited holes, the reporting route and the published support end date.

• List every AI model the product depends on and its AI Act role

  TDD-18

  List every model provider and model version the product calls, with the contract terms on training and data retention, the monthly cost and the fallback. Record the company's AI Act role and risk class for each AI feature.

• Time how long it takes to leave each sub-processor

  TDD-19

  List every sub-processor with the personal data it holds and the export path for that data. Record the measured or estimated time to move to another provider, and mark each one that has no export path.