GDPR

Your SaaS Vendor's Data Processing Agreement Is 47 Pages. I Read One.

Quick question: where does your customer data live right now?

I mean actually live. Not where you think it lives — where is it physically stored? Whose servers? Which country? Whose employees can access it at 2am on a Tuesday?

I asked this to a Dutch healthcare company last year. They said "on our systems." I said, "Really? What about your CRM?" They said HubSpot. I said, "Where's HubSpot's data centre?" They didn't know.

It's in the US. Virginia, to be exact. Their patients' health data — Dutch patients, EU citizens — sitting on American servers, governed by American law, accessible to American authorities under FISA Section 702.

That's not a hypothetical risk. That's Tuesday.

Schrems II is still a problem

Everyone talks about GDPR compliance like it's a checklist. It's not. It's an ongoing obligation. And the biggest unresolved issue in European data law is still cross-border transfers.

The EU-US Data Privacy Framework was supposed to fix this. It didn't. Privacy advocates are already challenging it. The fundamental tension — EU privacy law vs. US surveillance law — hasn't been resolved. It's been papered over.

When you use SaaS, you're signing data processing agreements for tools you've never read, hosted in jurisdictions you've never checked, with sub-processors you've never heard of. And every one of those is a potential compliance gap.

What "privacy by design" actually means

GDPR Article 25 says data protection should be built into systems by design, not bolted on afterwards. Most companies treat this as an aspiration. With custom software, it's just architecture.

When I build a system for a client, the data stays on their infrastructure. Period. No sub-processors. No cross-border transfers. No "we'll look into it" from a vendor support team in a different timezone.

I worked with a German financial services firm that needed full audit trails, role-based access, automated data retention, and EU-only hosting. With SaaS, they'd need three different compliance tools and a consultant to verify everything. With custom software, those were just features we built in from day one.

The cost difference? One GDPR incident — one poorly handled data subject access request, one breach notification, one audit finding — costs more than most custom builds. I've seen it happen.

I'm not saying every business needs custom software for privacy. But if you're handling sensitive data in Europe and your SaaS stack routes that data through American infrastructure? You should at least understand the risk you're taking.

Your Business Runs on Spreadsheets. That's a Problem.

Let me guess. You have a spreadsheet that runs your business. Maybe it's tracking orders. Maybe it's managing inventory. Maybe it's your "CRM" — a fancy name for a spreadsheet with customer names and phone numbers. Maybe you have several. Maybe someone calls

Custom Software Costs Less Than Your SaaS Stack. Here's the Receipt.

Two years ago, if you told a small business owner "you should build custom software," they'd laugh at you. "I can barely afford my current tools" was the standard response. And they were right. Custom software used to be a €50,000–€100,000

The €37K Software Bill Nobody Told You About

I'll let you in on a dirty secret about SaaS pricing. It's not about the sticker price. It's about everything around the sticker price that never shows up on the pricing page. I had a client — a mid-sized Dutch manufacturer — who thought they were

I Was Spending €45K/Year on SaaS Before I Built My Own

I ran a cafe before I ran a software company. Still do, actually. And here's the thing nobody tells you about running a small business: your biggest enemy isn't your competition. It's your software. I was paying for 12 different SaaS tools. Twelve. CRM,