Legal Team · closed beta

GDPR-compliant backend for German legal-tech startups.

WORM-enforced retention for §50 BRAO, §257 HGB, and §147 AO. Hosted in France on Scaleway — no US CLOUD Act exposure. Postgres, storage, auth, and edge functions with an audit-defensible retention story out of the box.

The problem

If you build software for lawyers, tax advisors, or Buchhaltungspflichtige (bookkeeping-obligated) SMBs in Germany, your customers are on the hook for statutory data retention that a generic backend can't defend. When a Kanzlei is audited, "we back everything up nightly" isn't the right answer — the auditor wants to see that the specific record class the statute mentions cannot be deleted within the retention window, not that it hasn't been.

Building that on top of Firebase, Supabase, or a raw AWS S3 bucket means writing your own Object Lock configuration, your own retention-hold API, your own DSAR-erasure-that-respects-legal-holds workflow, and — most importantly — your own audit-log retention that survives the same statutory window as the data it describes. That's months of work, most of which will be reviewed by a lawyer who bills in 6-minute increments.

Eurobase Legal Team is a pre-built version of that stack. WORM by default on the record classes that need it, ad-hoc holds for the ones that don't, and an honest DSAR-erasure API that returns "retained under §257 HGB, purgeable after 2036-03-14" instead of a silent no-op that will hold up in a Landesdatenschutzbeauftragte's inbox for three months.

What Legal Team gives you

Per-prefix WORM policies

Every object under a configured prefix (e.g. /invoices/*) is retention-locked under S3 Object Lock. Even a compromised admin key cannot delete before the retention date. Governance-mode vs compliance-mode is a per-prefix choice.

Ad-hoc retention holds

When a customer cites a legal basis mid-lifetime ("this row is subject to litigation hold"), the console's Retention tab pins the specific row, object, or table beyond its default policy. Every hold is audited with actor + basis + expected release date.

Honest DSAR erasure

When a user asks to be forgotten, held items are refused with a specific message the requester sees in their export: "retained under §257 HGB, purgeable after 2036-03-14." No silent no-op; no ambiguous "we removed everything we could."

10-year audit-log retention

The audit trail survives the same statutory window as the data it describes. On standard tiers audit-log retention is 90 days; on Legal Team it matches §257 HGB / §147 AO. Hash-chained checkpoints for tamper-evidence.

Statutes covered

§50 BRAO

Federal Lawyers' Act — client files

Client files (Handakten) retained 6 years from case end. Configurable per-project retention policy on the /client-files/* prefix.

§257 HGB

Commercial Code — books, invoices, letters

Split by record class: books, inventories, opening balance sheets, annual accounts, and invoices (Buchungsbelege) retained 10 years; received / sent commercial letters (Handelsbriefe) retained 6 years. Both prefixes ship with the correct default policy.

§147 AO

Fiscal Code — tax-relevant records

Mirrors §257 HGB: 10 years for books and accounting records, 6 years for other tax-relevant business correspondence. Tax-audit-ready retention on the /tax/* prefix.

Statutory summaries are for orientation, not legal advice — your firm's counsel is the source of truth for the specific record classes and periods that apply to your workload. Eurobase provides the WORM enforcement mechanism; the retention decision itself is yours.

Sovereignty is a first-class feature, not a certificate

Every byte of Eurobase data lives in Scaleway data centres in Paris, France (fr-par). No US-hosted services in the stack — no AWS, no GCP, no Cloudflare, no Vercel, no Stripe. That means no CLOUD Act reach, no Schrems II ambiguity, no "your data is technically encrypted at rest but the encryption keys sit in a US KMS" workaround.

Payment processing runs on Mollie (Dutch, EU-headquartered). SMS OTP runs on GatewayAPI (Danish). Every third-party processor is listed on the auto-generated Article 30 DPA report you can download per project. If a customer's Datenschutzbeauftragte(r) asks for it, you send them a PDF instead of a 40-email thread.

Frequently asked

What is WORM retention and why does a legal-tech startup need it?

WORM (Write Once, Read Many) means once an object is stored, it cannot be modified or deleted until its retention period expires — even by an admin, even by a compromised key, even by a database-level DELETE. For a firm subject to §257 HGB (10y invoice retention) or §50 BRAO (6y lawyer-file retention), that guarantee is what a German auditor will ask for. Soft delete plus audit log is a nice-to-have; WORM at the storage layer is what the regulator wants to see.

How is this different from just backing up my data?

Backups are recoverable — good for accident recovery, not good enough for statutory retention. A backup can be deleted, modified, or restored to a state where the data is gone. WORM Object Lock refuses the DELETE at the storage boundary. It is the difference between "we can probably restore this" and "the storage service is contractually incapable of losing this within the retention window."

What happens when a user requests DSAR erasure on data under a legal hold?

The erasure API refuses each held item with a specific message the requester sees in their export: "retained under §257 HGB, purgeable after 2036-03-14." The exporter enumerates every held item plus its basis plus the earliest purge date so the user can plan a follow-up request. Honest interpretation of Article 17(3)(b) GDPR (legal obligation to retain), rather than a silent no-op that will hold up in a Landesdatenschutzbeauftragte's inbox for three months.

When can I sign up?

Legal Team is currently in closed beta. Email contact@eurobase.app with a one-line description of your workload and your retention basis (BRAO / HGB / AO / other). Grants are manual during the beta window; pricing is set per-workload until we exit beta.

Is my data really EU-only?

Yes — Scaleway data centres in Paris, France. No US infrastructure at any point in the stack. Full sub-processor list published on the Article 30 DPA report the console auto-generates per project. If a component of the stack ever changes region, we file a versioned DPA update and notify affected projects.

Ready to talk?

One-line description of your workload plus your retention basis in an email, and we'll get back to you the same day about beta access and rough pricing.

Prefer to see the technical details first? Read the Legal Team docs or the full pricing comparison.