> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## Related Documents

- Privacy Policy (`PRIVACY_POLICY.md`)
- Compliance Notes (`COMPLIANCE_NOTES.md`)
- Annual Review Checklist (`ANNUALREVIEWCHECKLIST.md`)

## Certificate of Compliance Self-Attestation

### Acme Inc

Certificate ID: CODEPLIANT-20260319-NEXTJSSAASEX

Date of Assessment: 2026-03-19

Project: nextjs-saas-example

> Important: This is a self-attestation certificate based on automated code analysis. It is not a legal certification and does not replace professional audits, certifications (SOC 2, ISO 27001), or legal advice. It demonstrates that the organization has taken steps toward compliance and has generated the documented policies and procedures listed herein.

## 1. Compliance Summary

Metric | Value
--- | ---
Organization | Acme Inc
Assessment Date | 2026-03-19
Compliance Score | 0/100
Grade | N/A
Documents Generated | 133
Services Covered | 8
Data Categories Detected | 9
Service Categories | monitoring, auth, ai, analytics, database, email, payment
Jurisdictions | EU, US-CA, US-VA, UK

## 2. Compliance Status by Area

Compliance Area | Status | Supporting Documents
--- | --- | ---
Privacy & Data Protection | Comprehensive | Privacy Policy, Cookie Policy, Consent Management Guide, Data Subject Categories, Lawful Basis Assessment
Information Security | Comprehensive | Security Policy, Incident Response Plan, Access Control Policy, Encryption Policy, Information Security Policy
Third-Party Management | Comprehensive | Data Processing Agreement, Sub-Processor List, Third-Party Risk Assessment, Vendor Security Questionnaire, Supplier Code of Conduct
AI Governance | Comprehensive | AI Disclosure, AI Act Compliance Checklist, AI Model Card, Acceptable AI Use Policy, AI Governance Framework
Business Continuity | Comprehensive | Business Continuity Plan, Backup Policy, Disaster Recovery Plan
Compliance Framework | Comprehensive | Compliance Notes, Compliance Timeline, SOC 2 Readiness Checklist, ISO 27001 Compliance Checklist, Annual Review Checklist

## 3. Documents Generated

The following compliance documents have been generated for this project:

# | Document | Filename
--- | --- | ---
1 | Privacy Policy | `PRIVACY_POLICY.md`
2 | Terms of Service | `TERMSOFSERVICE.md`
3 | Security Policy | `SECURITY.md`
4 | Incident Response Plan | `INCIDENTRESPONSEPLAN.md`
5 | AI Disclosure | `AI_DISCLOSURE.md`
6 | AI Act Compliance Checklist | `AIACTCHECKLIST.md`
7 | AI Model Card | `AIMODELCARD.md`
8 | Cookie Policy | `COOKIE_POLICY.md`
9 | Consent Management Guide | `CONSENTMANAGEMENTGUIDE.md`
10 | Data Processing Agreement | `DATAPROCESSINGAGREEMENT.md`
11 | Sub-Processor List | `SUBPROCESSOR_LIST.md`
12 | Data Retention Policy | `DATARETENTIONPOLICY.md`
13 | DSAR Handling Guide | `DSARHANDLINGGUIDE.md`
14 | Vendor Contacts Directory | `VENDOR_CONTACTS.md`
15 | Data Flow Map | `DATAFLOWMAP.md`
16 | Compliance Notes | `COMPLIANCE_NOTES.md`
17 | Compliance Timeline | `COMPLIANCE_TIMELINE.md`
18 | SOC 2 Readiness Checklist | `SOC2READINESSCHECKLIST.md`
19 | ISO 27001 Compliance Checklist | `ISO27001CHECKLIST.md`
20 | Third-Party Risk Assessment | `THIRDPARTYRISK_ASSESSMENT.md`
21 | Privacy Impact Assessment | `PRIVACYIMPACTASSESSMENT.md`
22 | Environment Variable Audit | `ENV_AUDIT.md`
23 | Data Classification Report | `DATA_CLASSIFICATION.md`
24 | Dependency Vulnerability Scan | `VULNERABILITY_SCAN.md`
25 | Transparency Report | `TRANSPARENCY_REPORT.md`
26 | Acceptable Use Policy | `ACCEPTABLEUSEPOLICY.md`
27 | Refund Policy | `REFUND_POLICY.md`
28 | Service Level Agreement | `SERVICELEVELAGREEMENT.md`
29 | Data Flow Diagram | `DATAFLOWDIAGRAM.md`
30 | Audit Log Policy | `AUDITLOGPOLICY.md`
31 | Acceptable AI Use Policy | `ACCEPTABLEAIUSE_POLICY.md`
32 | Risk Register | `RISK_REGISTER.md`
33 | Record of Processing Activities | `RECORDOFPROCESSING_ACTIVITIES.md`
34 | Transfer Impact Assessment | `TRANSFERIMPACTASSESSMENT.md`
35 | Data Dictionary | `DATA_DICTIONARY.md`
36 | Access Control Policy | `ACCESSCONTROLPOLICY.md`
37 | Change Management Policy | `CHANGEMANAGEMENTPOLICY.md`
38 | Data Breach Notification Templates | `DATABREACHNOTIFICATION_TEMPLATE.md`
39 | Vendor Security Questionnaire | `VENDORSECURITYQUESTIONNAIRE.md`
40 | API Privacy Documentation | `APIPRIVACYDOCUMENTATION.md`
41 | Supplier Code of Conduct | `SUPPLIERCODEOF_CONDUCT.md`
42 | Privacy by Design Checklist | `PRIVACYBYDESIGN_CHECKLIST.md`
43 | Penetration Test Scope | `PENTEST_SCOPE.md`
44 | Cookie Inventory | `COOKIE_INVENTORY.md`
45 | AI Governance Framework | `AIGOVERNANCEFRAMEWORK.md`
46 | Business Continuity Plan | `BUSINESSCONTINUITYPLAN.md`
47 | Encryption Policy | `ENCRYPTION_POLICY.md`
48 | Backup Policy | `BACKUP_POLICY.md`
49 | Disaster Recovery Plan | `DISASTERRECOVERYPLAN.md`
50 | Information Security Policy | `INFORMATIONSECURITYPOLICY.md`
51 | Data Subject Categories | `DATASUBJECTCATEGORIES.md`
52 | Lawful Basis Assessment | `LAWFULBASISASSESSMENT.md`
53 | Annual Review Checklist | `ANNUALREVIEWCHECKLIST.md`
54 | Sub-Processor Change Notification | `SUBPROCESSORCHANGENOTIFICATION.md`
55 | Data Protection Policy | `DATAPROTECTIONPOLICY.md`
56 | Responsible Disclosure Policy | `RESPONSIBLEDISCLOSUREPOLICY.md`
57 | API Terms of Use | `APITERMSOF_USE.md`
58 | Third-Party Cookie Notice | `THIRDPARTYCOOKIE_NOTICE.md`
59 | Data Portability Guide | `DATAPORTABILITYGUIDE.md`
60 | AI Training Data Notice | `AITRAININGDATA_NOTICE.md`
61 | Employee Handbook Privacy Section | `EMPLOYEEHANDBOOKPRIVACY_SECTION.md`
62 | Vendor Onboarding Checklist | `VENDORONBOARDINGCHECKLIST.md`
63 | Executive Dashboard | `EXECUTIVE_DASHBOARD.md`
64 | Privacy Notice (Short) | `PRIVACYNOTICESHORT.md`
65 | Cookie Consent Configuration | `COOKIECONSENTCONFIG.json`
66 | Quick Start Compliance Guide | `QUICKSTARTCOMPLIANCE_GUIDE.md`
67 | Compliance Roadmap | `COMPLIANCE_ROADMAP.md`
68 | Privacy Dashboard Configuration | `PRIVACYDASHBOARDCONFIG.json`
69 | DPO Handbook | `DPO_HANDBOOK.md`
70 | Incident Communication Templates | `INCIDENTCOMMUNICATIONTEMPLATES.md`
71 | Training Record | `TRAINING_RECORD.md`
72 | Consent Record Template | `CONSENTRECORDTEMPLATE.md`
73 | Data Deletion Procedures | `DATADELETIONPROCEDURES.md`
74 | Security Awareness Program | `SECURITYAWARENESSPROGRAM.md`
75 | Privacy Risk Matrix | `PRIVACYRISKMATRIX.md`
76 | Data Mapping Register | `DATAMAPPINGREGISTER.md`
77 | AI Ethics Statement | `AIETHICSSTATEMENT.md`
78 | Data Breach Response Drill Template | `DATABREACHDRILL_TEMPLATE.md`
79 | Regulatory Correspondence Log | `REGULATORYCORRESPONDENCELOG.md`
80 | Privacy Policy Changelog | `PRIVACYPOLICYCHANGELOG.md`
81 | Privacy Program Charter | `PRIVACYPROGRAMCHARTER.md`
82 | Third-Party Due Diligence Template | `THIRDPARTYDUEDILIGENCETEMPLATE.md`
83 | Compliance Maturity Model | `COMPLIANCEMATURITYMODEL.md`
84 | Compliance Summary Email | `COMPLIANCESUMMARYEMAIL.md`
85 | Vendor Exit Plan | `VENDOREXITPLAN.md`
86 | Privacy Policy Comparison | `PRIVACYPOLICYCOMPARISON.md`
87 | AI Impact Assessment | `AIIMPACTASSESSMENT.md`
88 | Cross-Border Transfer Map | `CROSSBORDERTRANSFER_MAP.md`
89 | Compliance Gap Analysis | `COMPLIANCEGAPANALYSIS.md`
90 | Key Person Risk Assessment | `KEYPERSONRISK_ASSESSMENT.md`
91 | Regulatory Readiness Scorecard | `REGULATORYREADINESSSCORECARD.md`
92 | Data Lifecycle Diagram | `DATALIFECYCLEDIAGRAM.md`
93 | Compliance Budget Template | `COMPLIANCEBUDGETTEMPLATE.md`
94 | Incident Severity Matrix | `INCIDENTSEVERITYMATRIX.md`
95 | Data Subject Rights Portal | `DATASUBJECTRIGHTS_PORTAL.md`
96 | Compliance Automation Guide | `COMPLIANCEAUTOMATIONGUIDE.md`
97 | Compliance Oath | `COMPLIANCE_OATH.md`
98 | Privacy Impact Register | `PRIVACYIMPACTREGISTER.md`
99 | AI Red Team Guide | `AIREDTEAM_GUIDE.md`
100 | Compliance KPI Dashboard | `COMPLIANCEKPIDASHBOARD.md`
101 | Data Retention Schedule Visual | `DATARETENTIONSCHEDULE_VISUAL.md`
102 | Compliance Communication Plan | `COMPLIANCECOMMUNICATIONPLAN.md`
103 | Compliance Glossary | `COMPLIANCE_GLOSSARY.md`
104 | Vendor Risk Tier Assessment | `VENDORRISKTIER_ASSESSMENT.md`
105 | Compliance Scorecard | `COMPLIANCE_SCORECARD.md`
106 | DSAR Log Template | `DSARLOGTEMPLATE.md`
107 | Compliance FAQ | `COMPLIANCE_FAQ.md`
108 | Privacy Program Roadmap | `PRIVACY_ROADMAP.md`
109 | Executive Briefing | `EXECUTIVE_BRIEFING.md`
110 | AI Supply Chain Risk Assessment | `AISUPPLYCHAIN_RISK.md`
111 | Compliance Onboarding Guide | `COMPLIANCEONBOARDINGGUIDE.md`
112 | Data Processing Inventory | `DATAPROCESSINGINVENTORY.md`
113 | Compliance Policy Index | `COMPLIANCEPOLICYINDEX.md`
114 | Compliance Digest | `COMPLIANCE_DIGEST.md`
115 | Privacy Notice (App) | `PRIVACYNOTICEAPP.md`
116 | Compliance Maturity Assessment | `COMPLIANCEMATURITYASSESSMENT.md`
117 | Regulatory Mapping Matrix | `REGULATORYMAPPINGMATRIX.md`
118 | Compliance Calendar | `COMPLIANCE_CALENDAR.md`
119 | Data Minimization Checklist | `DATAMINIMIZATIONCHECKLIST.md`
120 | Compliance Board Report | `COMPLIANCEBOARDREPORT.md`
121 | Privacy Notice (Deutsch) | `PRIVACYNOTICEDE.md`
122 | Privacy Notice (Français) | `PRIVACYNOTICEFR.md`
123 | Privacy Notice (Español) | `PRIVACYNOTICEES.md`
124 | Privacy Engineering Guide | `PRIVACYENGINEERINGGUIDE.md`
125 | Compliance Testing Plan | `COMPLIANCETESTINGPLAN.md`
126 | Compliance Investment Case | `COMPLIANCEINVESTMENTCASE.md`
127 | Vendor Compliance Tracker | `VENDORCOMPLIANCETRACKER.md`
128 | Privacy Metrics Dashboard | `PRIVACYMETRICSDASHBOARD.md`
129 | Compliance Evidence Log | `COMPLIANCEEVIDENCELOG.md`
130 | Privacy Impact Screening | `PRIVACYIMPACTSCREENING.md`
131 | End User License Agreement | `ENDUSERLICENSE_AGREEMENT.md`
132 | Disclaimer | `DISCLAIMER.md`
133 | Impressum | `IMPRESSUM.md`

## 4. Services Covered

The following third-party services have been identified and documented:

Service | Category | Documented
--- | --- | ---
@sentry/node | monitoring | Yes
@supabase/supabase-js | auth | Yes
openai | ai | Yes
posthog | analytics | Yes
prisma | database | Yes
resend | email | Yes
stripe | payment | Yes
stripe-ios | payment | Yes

## 5. Data Categories Identified

Category | Sources
--- | ---
Personal Identity Data | @supabase/supabase-js, User.name
Financial Data | stripe, stripe-ios
Usage & Behavioral Data | posthog
AI Interaction Data | openai
Communication Data | resend
Technical & Diagnostic Data | @sentry/node
Stored User Data | prisma
Contact Information | User.email, User.phone
Authentication Data | User.passwordHash

## 6. Self-Attestation Statement

Acme Inc hereby attests that:

1. The automated code analysis has been conducted on the above-named project
2. The compliance documents listed above have been generated based on detected services and data processing activities
3. The organization commits to reviewing all generated documents for accuracy and completeness
4. The organization will engage legal counsel to validate compliance documents before publication
5. The organization will maintain and update these documents as services and data processing practices change

## 7. Validity

Field | Details
--- | ---
Issue Date | 2026-03-19
Valid Until | 2027-03-19
Review Frequency | Annually, or upon significant changes to services or data processing

This certificate should be renewed by running a fresh compliance scan after the validity period or whenever significant changes are made to the application's data processing activities.

## 8. Authorized Signatures

Role | Name | Date | Signature
--- | --- | --- | ---
Data Protection Officer | Jane Mueller |  |
Chief Executive Officer |  |  |
Chief Technology Officer |  |  |

## 9. Contact

For verification of this certificate or questions about our compliance posture:

- Email: legal@acme.com
- DPO: dpo@acme-saas.com
- Website: https://acme-saas.com

This Compliance Certificate was auto-generated by Codepliant based on automated code analysis. It is a self-attestation document and does not constitute a legal certification. Organizations should obtain professional audits and legal review for formal compliance certification.