A Day at the Company
A Monday at a Series B SaaS company.
140 employees. B2B SaaS platform. Enterprise customers with their own legal teams. Every contract, every policy, and every terms update runs through a legal department of two — supported by outside counsel they can't afford to use for everything.
8:00 AM
Identity Audit™
The Privacy Policy Update
The company is launching a new analytics feature that processes user behavior data. The privacy policy needs updating. Audit runs the draft from the perspective of a CCPA plaintiff's attorney, an FTC enforcement attorney, and a consumer privacy advocate. Identified: the data collection disclosure doesn't meet CPRA's "specific pieces of information" requirement. The opt-out mechanism described doesn't comply with the "Do Not Sell or Share" framework. The data retention section conflicts with the company's actual deletion practices. Fixed before publication.
9:30 AM
Identity Edge™
The Contract Negotiation Email
The head of sales is emailing a customer's MSA redline to the CEO for quick review. The attachment includes the customer's proprietary pricing terms, confidential volume commitments, and internal negotiation notes. Edge is designed to identify the confidential information before it goes to a personal email address — keeping privileged negotiation content within the company's secure systems.
11:00 AM
Identity Audit™
The Enterprise MSA
A Fortune 500 prospect sent over their standard MSA. It's 47 pages. The company's two-person legal team doesn't have time to review it line by line before the deal deadline. Audit runs the MSA from the perspective of a commercial litigation attorney and an IP licensing specialist. Identified: an IP assignment clause that would give the customer ownership of any customizations. A liability cap that doesn't account for IP indemnification. A termination clause with no cure period. Three issues that would have cost six figures to litigate.
1:00 PM
Identity Route™
The Customer Data Request
A customer submits a request through the support portal: "Under CCPA, I want to know what personal information you have on me and I want it deleted." Route reads the input: CCPA data subject request, 45-day response deadline, identity verification required. Route escalates to the privacy team with the statutory clock flagged. The AI doesn't process data subject requests. A human does.
2:30 PM
Identity Comply™
The Vendor DPA Review
The company is onboarding a new email marketing vendor. Under CPRA, they need a Data Processing Agreement. Comply is designed to cross-reference the vendor's DPA against CPRA service provider requirements, identifying gaps: the DPA doesn't restrict the vendor from combining the company's data with other customers' data, and the audit rights clause is unenforceable. Renegotiated before the vendor touches a single customer record.
4:00 PM
Identity Audit™
The NDA That Actually Matters
The company is entering a partnership discussion that requires sharing proprietary algorithms. The partner sent their standard NDA. Audit runs it from the perspective of a trade secret litigation attorney and an IP specialist. Identified: the "residual knowledge" exception is broad enough to let the partner use anything their employees remember. The definition of "confidential information" doesn't specifically cover algorithms or training data. The non-solicitation clause is unenforceable under California law. Three gaps. All fixed before a single slide deck is shared.