Field Notes

Practical writing on EU technical readiness, the EU AI Act, GDPR, data residency, procurement, and engineering leadership.

• The AI Jevons Paradox: Why Coding Agents Don't Save Time

  Linear data from 47,000 workspaces reveals the AI Jevons Paradox: coding agents tripled weekly pull requests from 21 to 65, but developers are working more, not less.

• Architecting Tenant-Level Isolation & BYOK Key Ownership under GDPR

  A step-by-step tutorial on building multi-tenant database isolation, PostgreSQL Row-Level Security, and BYOK envelope encryption for EU enterprise SaaS compliance.

• Building an Automated Data Subject Request (DSR) Pipeline Across Your SaaS Stack

  Architect an automated, event-driven DSR pipeline to execute GDPR access and erasure requests across microservices, databases, third-party APIs, and internal tools.

• Crypto-Shredding Patterns: How to Purge User Data from S3, Search Indices, and Delta Lakes

  Learn how to implement crypto-shredding to instantly invalidate user PII across immutable S3 objects, Elasticsearch indices, and Delta Lake Parquet tables under GDPR Article 17.

• EU AI Act + GDPR Harmonization: Building Human Oversight & Model Auditability into SaaS Architecture

  Architecting B2B SaaS for dual compliance under the EU AI Act and GDPR: human-in-the-loop controls, immutable model audit trails, and data minimization.

• EU Sovereign Cloud vs Multi-Region SaaS: Tradeoffs for Series A/B SaaS Teams

  An architectural cost and compliance comparison between US hyperscaler multi-region setups (AWS/GCP) and native European sovereign clouds (Hetzner, Scaleway, OVHcloud).

• Technical Implementation of Right to be Forgotten (GDPR Article 17) in Multi-Tenant Relational Databases

  A practical engineering guide to implementing cascade deletion, transactional anonymization, and soft vs. hard deletion patterns under GDPR Article 17 in multi-tenant PostgreSQL systems.

• GDPR-Compliant RAG Pipelines: Vector Database Privacy, Unlearning, and Embedding Erasure

  Learn how to build GDPR-compliant RAG architecture: vector inversion security, tenant-level embedding isolation, machine unlearning, and Article 17 vector erasure.

• Passing European Technical Enterprise Procurement: DPAs, TOMs, and Data Flow Diagrams

  Learn how US B2B SaaS engineering teams pass European enterprise procurement security reviews with technical DPAs, granular TOMs, and verifiable data flow diagrams.

• GDPR Engineering Blueprint for US SaaS

  A technical guide for US SaaS founders and CTOs on GDPR compliance, EU data sovereignty, tenant isolation, and engineering architecture for European expansion.

• SOC 2 vs GDPR for US SaaS: The 5 Engineering Divergences US CTOs Miss

  Discover the 5 critical engineering divergences between SOC 2 Type II and GDPR, and learn how US CTOs can refactor SaaS architectures for European compliance.

• Subprocessor Chain Auditing: Managing Third-Party Data Exposure in US B2B SaaS

  Learn how US B2B SaaS engineering teams audit subprocessor chains, enforce egress data minimization, and build automated GDPR Article 28 change notification pipelines.

• US Cloud Providers in EU Regions: Why AWS/GCP eu-central-1 Doesn't Solve CLOUD Act & Data Sovereignty

  Why hosting data in AWS eu-central-1 or GCP europe-west3 fails European legal scrutiny under the US CLOUD Act, and how engineering teams can implement true data sovereignty.

• The Digital Omnibus Passed: EU AI Act Timeline Breakdown

  The EU adopted the Digital Omnibus in June 2026, shifting high-risk AI deadlines to Dec 2, 2027. Understand watermarking & 2026 prohibited rules.

• EU Readiness Is a Sequence: What US Startups Must Build First

  Most US startups build EU readiness in the wrong order and pay for it twice. The 90-day sequence, what each phase depends on, and what you can safely defer.

• GDPR Compliance Cost of Waiting: Stage 1 vs Stage 3

  Compare the real costs of GDPR compliance for 10-50 person SaaS startups: €13k proactive vs €80k+ reactive vs €20M+ fines under Article 83 in 2026.

• Shift-Up Engineering: AI & Product-Engineering Boundary

  Understand shift-up engineering: how AI dissolves the product/engineering boundary, compile-time product specs, & product taste hiring for scale-ups.

• DORA 2026 AI Report: Engineering ROI & Org Fixes

  Google DORA 2026 report analysis: AI yields 35-40% gains on simple tasks but under 10% on complex work. Fix the engineering system first.

• EU AI Act Compliance Deadline: Why the Omnibus Delay Fails

  Understand why relying on the EU AI Act Omnibus delay creates legal risks: 2026 trilogue breakdown, high-risk deadlines, & technical compliance steps.

• GDPR LLM RAG Architecture Traps: 6 Production Pitfalls

  Avoid 6 GDPR failure modes in LLM and RAG architectures: vector store leaks, prompt logging, fine-tuning erasure, & EU API data transfers.

• GDPR Does Not Ban US Cloud: Complete Legal Breakdown

  Understand why GDPR does not ban US cloud providers: Schrems II, EU-US Data Privacy Framework, AWS EU regions, & 5 procurement steps for US startups.

• SOC 2 vs GDPR Overlap: Security Controls vs Legal Duties

  Understand the overlap between SOC 2 and GDPR: security controls vs legal duties, DSAR deletion rights, DPA requirements, & EU buyer compliance.

• Sovereign Cloud vs Data Region: 4 Infrastructure Layers

  Understand sovereign cloud vs EU data regions: AWS European Sovereign Cloud 2026, CLOUD Act jurisdiction, key custody, & 3 sovereignty lanes for US startups.

• Hiring Engineers in Germany: US Founder's Legal Overview

  Master 3 legal routes to hiring engineers in Germany: avoid Scheinselbständigkeit 1099 traps, EOR 18-month limits, & GmbH setup with 2026 tax rules.

• EU Expansion Decision Sequence for US Founders: 7 Steps

  Avoid 7 costly mistakes in European expansion: a step-by-step 2026 guide to entity formation, GDPR data flows, EOR hiring, & AI Act compliance.

• EU AI Act Entity Types: Provider, Deployer & Importer

  Understand the 6 EU AI Act entity types: Provider, Deployer, Importer, & Distributor. Avoid the Article 25 reclassification trap with 2026 legal checks.

• EU AI Act February 2025 Milestone: Key Bans & Mandates

  Discover what the EU AI Act's February 2025 enforcement milestone means for US startups, covering 3 banned AI practices & 1 AI literacy mandate.

• GDPR Compliance for US Startups: Beyond the Cookie Banner

  Adding a cookie banner doesn't make you GDPR compliant. Here is the operational and technical cloud architecture you actually need to build to serve European customers.

• EU AI Act for US Startups: Technical Compliance Overview

  Master the EU AI Act requirements for US startups: risk tiers, high-risk data governance, human oversight, & 2027 timelines with step-by-step code checks.