GDPR you can demonstrate, not just claim.
Keep evidence of how your organization handles personal data. We prepare and review scoped compliance records in the platform. Your team and legal advisers own legal decisions, agreements, and responses to individuals.
- Records of processing under Article 30 that match what your systems actually do
- A DPA chain that survives an EU customer's legal review, sub-processors included
- Data subject requests and the 72-hour breach clock as processes, not fire drills
The burden of proof is on the controller. And on you.
GDPR has no certificate to hang on a wall. What it has is an accountability principle - you must be able to demonstrate compliance on request. Everything we build for you exists to make that demonstration possible.
Records that match reality
Article 30 records built from what your systems actually process, not from a workshop where someone guessed. Reviewed as the product changes.
A DPA chain that survives legal review
Your customers' DPAs, your processor terms, and every sub-processor beneath you - tracked with dates and flow-down obligations that actually match.
Data subject rights as a process
We prepare process documentation from your business inputs. Your organization handles requests and legal decisions; system changes and operational handling require separate agreement.
Transfers you can actually justify
Standard Contractual Clauses, transfer impact assessments, and a documented basis for every route personal data takes out of the EEA.
What GDPR actually asks you to hold.
The obligations that matter for a software company are concentrated in a handful of articles - and they are documentation obligations as much as security ones.
Records of processing
art. 30What personal data you process, why, on what lawful basis, who you share it with, where it goes, and how long you keep it.
Processor agreements
art. 28Contracts with the controllers above you and every sub-processor below, with the mandatory Article 28 terms flowed down intact.
Data subject rights
arts. 12-23Access, rectification, erasure, restriction, portability, and objection - answered within one month, extendable to three with reasons.
Security of processing
art. 32Appropriate technical and organisational measures judged against the risk - encryption, resilience, restoration, and regular testing of their effectiveness.
Breach notification
arts. 33-34Supervisory authority notified within 72 hours of awareness where the breach is likely to risk rights and freedoms; data subjects notified when the risk is high.
DPIAs and transfers
art. 35 - ch. VImpact assessments for high-risk processing, and a lawful basis - adequacy, SCCs, or a derogation - for every transfer out of the EEA.
GDPR has no certification scheme in general use, so nobody can hand you a GDPR certificate. Article 5(2) instead requires demonstrable accountability, which is what your customers' legal teams review and what we build to.
From scoping call to demonstrable accountability.
Two phases are gated - the data mapping and the transfer basis. Both are the questions an EU customer's counsel opens with, and both are cheapest to answer correctly the first time.
Map the personal data
Every processing activity, its lawful basis, its recipients, its retention, and its destination. This mapping is the source of the Article 30 records and everything downstream.
Fix the transfer story
Record where personal data leaves the EEA and collect the supporting agreements and assessments. Your legal advisers determine the transfer mechanism and approve the legal work; we organize and review the evidence within scope.
Assess and document security measures
Use scoped testing and risk assessments to support evidence of your security measures. Your team implements changes; Sythe implementation work requires a separate approved estimate.
Assign rights and incident responsibilities
Prepare process materials for customer review and identify responsible people. Request handling, incident response, legal advice, and additional assessments require separate scope.
GDPR: $20,000 a year total.
Startup base plus one framework.
$20,000/year including one framework. Each additional framework is $3,000/year. For companies under $5M revenue or 50 staff. The SOC 2 Type I, Security-only bundle includes the independent auditor fee. Type II audits, additional audit criteria, and other certification fees are quoted separately. Enterprise pricing is custom. The SOC 2 Type I, Security-only bundle is $20,000/year total, including the $3,000 independent auditor fee. Sythe coordinates preparation and the audit through the platform. The independent auditor performs the audit and issues the report. Type II audits and additional criteria are quoted separately.
For companies under $5M revenue or 50 staff. Base security services plus GDPR support.
- 2 scoped penetration tests per year
- One scoped retest per penetration test
- 2 risk assessments per year
- 12 host-limited vulnerability scan runs per year
- Third-party risk document uploads and Q&A
- Compliance & GRC support for one included framework
- The Sythe Labs platform, run by us
Over $5M revenue or 50 staff. Negotiated to your scale and obligations.
- Enterprise scope agreed separately
- Additional assets and testing quoted to scope
- Service levels defined in your agreement
Sythe operators request and review evidence, prepare materials, and follow up in the platform. You supply business information and approve your organization's policies. Routine clarification, corrections, and supported platform integration repairs are included.
Ongoing security monitoring and incident response are additional services. We recommend fixes; hands-on changes to your systems require a separate implementation scope.
Strategic compliance advice and expressly delegated decisions use a vCISO retainer at $250/hour, with hours approved in advance. Kickoff and pentest scoping and closure meetings are included. Other routine delivery happens in the platform; recurring consulting meetings are extra.
The people who already handed it over.
"Jarred, Andrew, and their team are trusted partners - extensive penetration testing, code analysis, and security reviews that protect our users. We share a vision of prioritizing customer security above all else."
"Sythe Labs was great to work with. Extremely knowledgeable, responsive, and trustworthy. I'd recommend them to anyone looking for security or penetration testing."
"The strategic security recommendations from Sythe Labs have been invaluable. Their expertise helped us put real protection in place while keeping us moving fast."
Real engagements. Real outcomes.
The same programme, run for teams who had no security function when they started.
GDPR, honestly answered.
The questions that come up on every GDPR scoping call, answered before you have to ask them.
- Can we be GDPR certified?
- Not in any way your customers will recognise. Article 42 anticipates certification schemes but none is in general use, so nobody can issue you a meaningful GDPR certificate. What you can hold is demonstrable accountability, which is what legal reviews actually examine.
- We are a processor, not a controller. What is on us?
- Article 28 terms, Article 30(2) records of the processing you carry out on controllers' behalf, Article 32 security, assisting controllers with data subject requests, notifying them of breaches without undue delay, and controlling your own sub-processor chain.
- Do we need an EU representative or a DPO?
- A representative under Article 27 if you have no EU establishment but target or monitor people in the EU, with narrow exemptions. A DPO under Article 37 in specific cases - public authorities, large-scale systematic monitoring, or large-scale special-category data. We assess both during scoping.
- How does GDPR relate to ISO 27001 or SOC 2?
- The Article 32 security obligations overlap heavily with both, so evidence collected once carries across. What GDPR adds is the documentation layer - records, agreements, rights, transfers - which neither security framework requires.
- What about UK GDPR?
- The UK regime is substantially aligned, with its own supervisory authority and its own transfer mechanism. We run them together rather than as two programmes.
Pass the DPA review the first time.
A 30-minute call. We will tell you what your Article 30 records are missing, where your transfer basis is thin, and what demonstrable accountability actually costs - whether or not you hire us.