[All handbook](/handbook) - **03 / Handbook** — Company # Privacy should move with the product Every software company makes promises about data\. Those promises are implemented in code, and every product change can make them untrue\. - **11 July 2026** — Updated - **6 min** — Reading time On this page - Every commit can change the promise - Developers cannot see every promise - Compliance cannot see every change - The tools see pieces - Someone else usually finds the gap - AI makes the gap wider - Privacy has to ship with the product - **Christopher Burns** — Written by — Founder, Inth Every software company makes promises about how it handles data\. Those promises live in privacy policies, terms, customer contracts, and master service agreements\. But they are implemented in code\. Every commit can change whether the company is still keeping them\. 01 / Section ## Every commit can change the promise A privacy policy is a promise about the product\. So are the terms, the security schedule in a customer contract, and the answers given during an enterprise review\. They say what data the company collects, where it goes, how long it stays, and what happens when a user asks for it to be deleted\. The product decides whether any of that is true\. A developer adds an SDK\. A team starts sending support conversations to a language model\. A retention job stops running\. A vendor changes where it processes data\. Each change looks like ordinary software work, but each one can put the product on the wrong side of a promise the company has already made\. Nobody has to behave badly for this to happen\. The feature ships, the policy stays where it was, and the gap opens quietly\. > **Privacy should check every change, not wait for a periodic review\.** > If the product moves every day, the promises around it have to move at the same speed\. 02 / Section ## Developers cannot see every promise Developers make the changes, but they rarely know every obligation attached to them\. They have not read every customer contract\. They do not know which answer sales gave in a security review six months ago\. They should not need to memorise privacy law before they add a package\. Telling developers to be more careful does not solve this\. There are hundreds of small decisions in a codebase that can affect consent, data access, retention, deletion, or disclosure\. Most look harmless on their own\. Every line of code can matter, but a lawyer does not need to sit beside every developer\. The company needs checks and balances that can keep up with the way software is built\. 03 / Section ## Compliance cannot see every change The other side has the opposite problem\. Legal and compliance know what the company has promised, but they cannot follow every commit, deployment, vendor setting, and marketing script\. So they work backwards\. They ask engineering for access, collect answers in spreadsheets, chase people in Slack, and assemble evidence for an audit or customer review\. By the time they understand the product, it has changed again\. That process was built for a slower company\. It cannot follow a product that ships all day\. 04 / Section ## The tools see pieces A security scanner can say that the code has no known vulnerability\. A legal tool can explain the contract\. A privacy platform can hold the data map\. A GRC system can show that a review process exists\. All four can be right while the product is breaking a promise\. The missing connection goes back to the change itself\. The team still has to work out whether a new SDK altered a data flow, whether an AI feature introduced a processor the customer was told would never see its data, or whether a release made yesterday’s evidence false\. Today, people close that gap by hand\. Inth keeps the obligation, the product change, and the decision in the same record while there is still time to do something about it\. 05 / Section ## Someone else usually finds the gap Most companies do not notice the gap themselves\. A plaintiff’s lawyer, regulator, auditor, or enterprise customer finds it for them by asking a question nobody can answer\. Even privacy\-aware teams miss obvious things\. We only understood how many small mistakes were possible after we put tooling against our own work\. The reaction was usually the same: that is stupid, how did we not spot it? The fine or failed deal is only the visible cost\. Trust is the asset underneath it\. A company can recover money\. Recovering the belief that it handles customer data responsibly is much harder\. 06 / Section ## AI makes the gap wider AI has made code cheaper to produce, but not cheaper to understand\. Agents can work across a codebase, add dependencies, and change data flows before anyone responsible for the company’s promises knows it happened\. More code reaches review\. The review still has the same number of people and the same amount of time\. “Looks good to me” becomes easier when the change is large, plausible, and already passes the tests\. Compliance is hardly ever one of those tests\. The gap between code and legal predates AI\. AI removed the last excuse for managing it by hand\. 07 / Section ## Privacy has to ship with the product Companies need a way to compare what the product does with what they have promised while the product is changing\. The repetitive work should happen automatically\. People should still decide what the consequence means and what the company is willing to accept\. This changes privacy from a reconstruction exercise into part of shipping software\. The developer can stay in the development workflow\. Legal and compliance can work from the obligations and consequences they understand\. Both sides see the same change\. That is the company we are building with Inth\. When the product changes, the privacy record should change with it\. Anything slower will always be catching up\. ## Keep reading\. - **Why cookie banners are our wedge** — Cookie banners look like a small UI problem\. They are a live test of performance, consent, and whether a product honours what its users chose\. - **We have to look like a big deal** — A small company does not get a smaller standard\. If we want companies to trust Inth with an important problem, every part of the product has to show that we understand the weight of it\.