No-code compliance: six questions make the deployment auditable

Our thesis: a no-code deployment becomes auditable when the CIO obtains written answers to six questions — data location, legal basis, access model, logging, reversibility, continuity. Written down, they feed the Article 30 GDPR record of processing and hold up under inspection. The framework is falsifiable: if the vendor answers all six points precisely and nothing is documented on your side, the problem is no longer the tool.

No-code compliance is not a separate body of law: low-code security rests on the same texts as any business SaaS subject to the GDPR. Article 28(3) requires eight clauses in the processing contract (points a to h): documented instructions, confidentiality, security (Art. 32), controlled sub-processing, help with data subjects' rights, assistance, return or deletion of data at the end of the service, and the right to audit. Each question in the framework maps to one of these clauses.

That is the logic behind how we build: document before deploying. The vendor commitments cited here are self-declared, verified on August 12, 2026 — check them again on the day you sign.

Example verified on August 12, 2026: with Airtable's European data residency, base content (records, attachments, history) is stored on AWS in Frankfurt and backed up in Ireland — but authentication data, metadata and base names remain in the United States. The reflex to build: ask for a map by data category, never a yes-or-no answer.

As soon as one category leaves the EU, Chapter V of the GDPR (Art. 44 and following) governs the transfer. For the United States, it rests on the Data Privacy Framework, whose annulment the EU General Court rejected on September 3, 2025 (case T-553/23), with an appeal still possible. On the Swiss side, Article 16 nLPD makes disclosure abroad conditional on an adequacy finding by the Federal Council — the list sits in Annex 1 of the ordinance (OPDo) — with Article 17 setting out the derogations; the United States has been on that list since September 15, 2024, only for companies certified under the Swiss-U.S. DPF — to be checked vendor by vendor.

Under the GDPR, Article 6(1) sets six exhaustive legal bases: consent, contract, legal obligation, vital interests, public interest, legitimate interests. HR app, CRM, customer form: every processing operation must map to one of the six before deployment, then appear in the record (recipients, transfers, erasure periods).

The Swiss nLPD works differently. Its Article 6 sets principles — lawfulness, good faith, proportionality — with no closed list of legal bases: the Swiss private-sector regime rests on the absence of unlawful harm to personality rights. In force since September 1, 2023 with no transition period, its Article 12(5), implemented by the OPDo ordinance, exempts companies under 250 employees from the record of processing where the risk is limited.

On sub-processing, Article 9 nLPD requires the controller to ensure the processor is able to guarantee data security (para. 2), and makes onward sub-processing subject to the controller's prior authorisation (para. 3). The GDPR is more formal:

The processor shall not engage another processor "without prior specific or general written authorisation" of the controller. — Article 28(2) GDPR

Operational translation: require the vendor's sub-processor list and change notifications. A shared GDPR/nLPD checklist must flag these gaps — otherwise it over-constrains Swiss SMEs.

The access model first. No-code's strength — everyone builds — becomes a risk when everyone administers. The useful questions: role granularity and periodic access reviews. Article 32 GDPR requires measures appropriate to the risk; one admin account shared across three teams is not.

Logging next — this is where the gap widens. Since its deliberation of October 14, 2021, the CNIL has recommended keeping logs for six months to one year, tracing access, creation, modification and deletion events, with user ID and timestamp: this is the foundation of auditability.

Auditability often depends on the pricing tier: budget for it at signature, not after the incident.

What doing nothing costs — In its January 2024 cloud guidance, the CNIL noted that security breaches accounted for roughly one third of the sanctions issued in 2022. An incident detected on day 45, on a plan retaining 30 days of logs, leaves no usable trace: impossible to document the breach for the authority.

Reversibility has a precise textual anchor: Article 28(3)(g) GDPR requires deletion or return of the data at the end of the service, at the controller's choice. The text says nothing about the format or usability of the export. Hence three requirements to put in the contract: a complete export (data, files, history), a documented open format, and a restore test before go-live — not on the way out.

For automation, a structural answer exists: some source-available tools allow self-hosting for internal use, putting hosting and reversibility back under your direct control — an operating-cost trade-off we detail in our method.

Continuity, finally, is not a commercial favor. Article 32(1) GDPR requires the ability to ensure the ongoing availability and resilience of systems (b), to restore data availability after an incident (c), and a regular testing procedure (d). Ask for the written SLA: at Make, the 99.5% SLA is attached to the Enterprise plan (verified August 12, 2026) — same pattern, the guarantee follows the tier.

Six rows to attach to any consultation of a no-code or business SaaS vendor — one of the first documents we produce in our engagements. A red flag does not necessarily rule the tool out: it requires a documented compensating measure.

The framework makes a deployment auditable; it does not make it compliant on its own. It replaces neither an impact assessment where the processing warrants one, nor the legal qualification of a specific case — that is your DPO's job. Vendor answers remain self-declared and change regularly. The six questions look at the vendor; they say nothing about your internal governance — who is allowed to build what, with which data. For an app holding no personal data at all, the full questionnaire is oversized: questions 5 and 6 suffice.