Desktop · macOS, Windows, Linux
Compliance is written in documents.
It is broken in code.
Norma 29 reads your source and your database schema and tells you which specific obligations your implementation currently fails — with the file, the line, and the article it comes from.
Free tier: one regional framework plus every store policy. No account needed to scan.
The gap
A privacy notice cannot see your logging statements
Data-protection compliance is almost universally practised as paperwork. An organisation writes a notice, files a record of processing, appoints someone accountable, and treats the obligation as discharged. None of those documents touch the place where personal data is actually read, written, logged, transmitted, and retained.
So a company can hold a well-drafted notice promising that national identity numbers are never logged, while a debug statement three layers down writes the full record to stdout on every request. Both facts are true at once. Only one of them is visible to the person who signed the policy.
Security scanners will not close that gap, because they answer a different question. They ask whether code is exploitable. They do not ask whether it satisfies a named article of a named statute in a named jurisdiction.
How it works
Two surfaces, three passes
Pattern rules
Every installed framework ships rules bound to a specific article and a stable control identifier, filtered by scope so server-side heuristics are never applied to browser code. Includes inverse checks that assert something must be present — the test that catches a missing control rather than a bad one.
Semantic analysis
Where a regular expression sees text, this pass sees syntax. It matches on abstract syntax trees, which is what lets a rule state that a request parameter reaches a raw SQL query, or that a personal-data field is written with no accompanying consent check.
Context
Every finding is enriched with the enclosing function or scope. A line number tells you where; the scope tells you what the code was trying to do. In practice that is the difference between a finding you can act on and one you re-investigate from scratch.
The schema scanner connects to a live database, reads its column catalogue, and matches names and declared types against the framework's schema rules. It never reads row data — only the shape of the database.
What it refuses to claim
Every framework declares what it cannot check
A large share of any data-protection statute is not verifiable by reading code. Whether consent was freely given. Whether a data protection officer was appointed. Whether a breach was notified in time. Whether a retention period is justified.
Norma 29 will not quietly leave those out. Each framework ships a manifest naming the obligations it cannot verify, and that manifest is reported beside every result — because “all controls passed” is a claim about the controls that were tested, and a ceiling presented without its limits is a lie by omission.
Frameworks
The law is a versioned download, not a hard-coded feature
Norma 29 ships no jurisdiction knowledge of its own. Every rule it applies comes from a framework you install, and each one is independently versioned and dated against the text it encodes. A tool that hard-codes one country's law is useless in every other market and stale the first time that law is amended.
| Framework | Jurisdiction | Kind | Declared limits |
|---|---|---|---|
| UU PDP No. 27 of 2022 | Indonesia | regional | 9 |
| GDPR | European Union | regional | 12 |
| Apple App Review Guidelines | Apple App Store | platform | 17 |
| Google Play Developer Policy | Google Play Store | platform | 13 |
Regional frameworks answer whether an implementation satisfies a statute. Store policies answer a different question on a different deadline — what will get this build rejected — so they get their own console and a pass/attention verdict instead of a score. Both are pre-flight checks. Store review is performed by people and stays discretionary; nothing here predicts an outcome.
Data handling
Nothing you scan leaves your machine
Your source code is read from your disk by a process on your own computer and never transmitted. Database credentials open a connection from your machine directly to your database. There is no upload step, no analysis queue, and no server-side copy of anything you scan.
This is not a privacy feature bolted on for irony's sake — it is a precondition for the product existing. The people who most need this scan are the least able to send a proprietary codebase and production credentials to a third party.
Results are stored in an encrypted database on your own machine. Account email addresses are encrypted on your device before they reach us, so we cannot read them. The only network traffic the app generates is framework downloads and authentication.
Who it is for
Engineers carrying compliance obligations without a compliance department
Solo founders, small product teams, agencies delivering into regulated markets, and developers shipping to jurisdictions whose law they read once and hope they remembered correctly.
It is not legal advice, not an audit, and not a certification. It is an instrument: it tells you, specifically and with evidence, which parts of your implementation currently fail which obligation. Then it lets you fix them and check again.