Compliance checks

Verifying requirements set by a regulator, a standard or a store policy.

Mandatory for 46 of 46 product types. Usually run by a product manager.

What it catches

• missing consent
• audit trail gaps
• policy violations

What it misses

• general bugs

Which product types need it and why

Done conditions used on playbook pages

Each mandatory cell has its own done condition, written for that product type.

• accounting and invoicing SaaS (Fintech): A reviewer traces a filed VAT return back to ledger entries with no manual export step, and finds edited or deleted entries kept in the audit log.
• buy now pay later service (Fintech): For a sample of plans, a reviewer finds the pre-contract information, the missed-payment notice and the hardship option the shopper was shown, each stored with a date.
• clinical trial management software (Healthcare): A signed validation package maps each Part 11 and GCP requirement (audit trail, e-signature, access control, retention) to a test record an inspector can open.
• crypto exchange (Fintech): Test deposits that match monitoring scenarios raise alerts that reach the review queue, and sign-ups from unlicensed countries are blocked in app and on web.
• data pipeline (Infrastructure and developer products): Every regulated report traces each figure back to its source tables, and personal fields are masked or dropped before the shared layer.
• dating app (Consumer apps): A reviewer confirms report and block exist on every profile and chat screen, and that no location or orientation data leaves the device before the consent screen is accepted.
• desktop application (Infrastructure and developer products): Each build passes notarization and Microsoft Store certification, and release notes name every helper, service or login item the update installs.
• e-signature service (B2B SaaS): Legal signs off the consent text, certificate fields and retention period against ESIGN and, for life-science customers, the 21 CFR Part 11 audit trail rules, and access to completed documents is limited to the named signers and the sender.
• ecommerce store (Commerce): A signed checklist shows review moderation treats one-star and five-star reviews by the same rule, and shipping-delay notices follow the mail order rule.
• electronic health record system (Healthcare): A reviewer confirms that a test patient's full electronic health information exports in the standard format on request and that the access audit log is reviewed on a set schedule.
• email marketing platform (B2B SaaS): Every campaign template carries a working unsubscribe link and the sender's postal address, and sending is blocked until both are present.
• ERP system (B2B SaaS): An auditor can trace each line of the month-end report to its source postings, and the patch level of every module is recorded against the vendor's advisories.
• EV charging app (Infrastructure and developer products): A signed checklist for each market shows price display before start, accepted payment methods and the published reliability data, with a screenshot or link for each.
• expense management tool (Fintech): A reviewer finds, for a sample of reimbursements, the receipt, the business purpose, the approver and any returned advance recorded with dates.
• fleet and logistics tracking (Infrastructure and developer products): A signed review shows the driver notice, the private-use switch and, where hours-of-service logs are offered, each log rule mapped to a screen in the driver app.
• government services portal (Public sector): A reviewer holds a current accessibility conformance report and a current security authorisation for the release.
• grocery delivery app (Commerce): A signed checklist shows that free delivery wording, membership trial terms, consent before renewal and store privacy labels match what the app does.
• identity and access management service (B2B SaaS): MFA phone numbers and recovery emails are tagged security-only, no marketing or analytics export includes them, and support uploads are scrubbed of tokens on receipt.
• insurance app (Fintech): A reviewer finds a dated record of bias and accuracy testing for each model used in pricing or claims, and a sign-off before each model change.
• smart home or IoT app (Infrastructure and developer products): A signed record per device model shows a unique or user-set password, the published security update period and a vulnerability report contact before the model ships to a new country.
• kids app (Education): A reviewer confirms the SDK list matches the store declarations, contains no third-party analytics or ad SDK outside the families-certified list, and the parent consent step comes before any personal data leaves the device.
• language learning app (Education): A reviewer confirms the paywall states price, billing period and cancel steps, and the age gate routes users under the COPPA age to a parent consent step before any voice recording.
• lending platform (Fintech): For a sample of applications, a reviewer finds the dated disclosures, the identity checks performed and the adverse action notice stored with each file.
• LLM-based assistant (Infrastructure and developer products): A signed review shows the age gate, the training-data opt-out and the AI disclosure, with a screenshot of each from the release build.
• loyalty program app (Commerce): Each change to earn rates, award prices or expiry is checked against the program terms and notice period before release, and paid point sales follow the store billing rules.
• online marketplace (Commerce): A signed checklist shows that sellers above the volume threshold are verified, and that their name, address and a report link show on every listing on web and app.
• mental health app (Healthcare): A reviewer confirms the consent screen names every third party that receives health data, the age gate blocks under-age sign-up without parental consent, and the store health declarations match the build.
• messaging app (Consumer apps): A reviewer confirms the privacy notice states what happens to uploaded address books and what is shared with group companies, and report and block appear in every one-to-one and group chat.
• machine learning model service (Infrastructure and developer products): Each score returned for a credit or screening use carries the top reasons in plain words, the model record lists data sources and tested groups, and a sample of prediction logs holds no raw personal fields.
• mobile banking app (Fintech): A transfer to a new payee shows the scam warning, the customer's confirmation appears in the audit log, and the reimbursement claim opens from the transaction screen.
• mobile game (Consumer apps): A reviewer confirms each loot box shows item odds before purchase, and a player under 13 cannot reach chat or purchases without a parent's consent.
• neobank (Fintech): Test applicants whose names are on the current sanctions list are stopped at sign-up, and the screening log shows the list version used.
• peer-to-peer payment app (Fintech): A test unauthorised-send claim opens an error investigation with a provisional credit decision and a written result, without routing the user to their card issuer.
• patient portal (Healthcare): A reviewer confirms that a records request made through the portal is logged with a due date and that a test patient can download their record in a standard format.
• pharmacy delivery app (Healthcare): A pharmacist-in-charge signs a checklist showing where the app enforces the prescription requirement, controlled-substance refill limits and patient consent for data sharing.
• ride-hailing app (Commerce): A data map shows where each driver document type is stored, with the transfer basis for any copy outside its home region, and store privacy labels match it.
• software as a medical device (Healthcare): A reviewer confirms that every requirement in the release has a linked verification result, the risk file lists each change, and the cybersecurity documentation matches the shipped build.
• SDK or client library (Infrastructure and developer products): The privacy manifest and the sample disclosure text list every data type the SDK collects and every recipient, signed off by legal, and the binary is signed.
• social network (Consumer apps): A signed review shows that an account registered with a minor's birth date starts private and cannot be messaged by strangers, and a sign-up with an under-13 birth date is blocked or sent to parental consent, with a screenshot for each market's rule.
• subscription box service (Commerce): A signed review of the checkout shows the price, renewal frequency and cancellation method next to the subscribe button, and a record of the subscriber's consent is stored.
• telemedicine app (Healthcare): A reviewer confirms that every controlled-substance prescription record shows the prescriber's registration and the patient's state, and that the HIPAA risk analysis covers the video and chat services.
• event ticketing platform (Commerce): A signed checklist shows total-price display on every price screen and that accessible seats go on sale online at the same time as other seats.
• stock trading app (Fintech): A test applicant who fails the options eligibility rules is refused options trading, and the refusal and the answers given are stored for review.
• travel booking app (Commerce): A signed checklist shows how results are ranked is disclosed, scarcity banners match supplier data, and store privacy labels match the data collected.
• video conferencing tool (B2B SaaS): Every security claim in marketing and in the app (encryption type, recording storage) matches a design document signed by a security specialist, and the release notes name every helper or local service the desktop installer adds.
• wearable companion app (Healthcare): A signed review lists every health alert and claim in the app and store listing, and states for each whether it makes the product a medical device and who approved it.

Tools

Alphabetical. Not recommendations.

No tool in the list serves this test type.