Phase 7 · Security & monitoring

Four jobs, in order: harden the deployed app, give it an audit trail, make it observable, then settle the legal & compliance layer. Don’t monitor an insecure target — security comes first, then observability watches what you secured, and the legal pages make launch lawful. The observability half is an insertable gate: rehearse the stack on staging, or wire the real thing on production.

Phase 7 — secure, observe, then comply

Security precedes observability precedes legal. Each node is a gate, not a suggestion — alerts with no escalation path are just dashboards nobody watches.

Gate

Vendor default credentials rotated, sessions and mass-assignment audited, TLS/HSTS + security headers live, activity logging capturing changes and auth events. Automated daily backups to off-server storage, Sentry tracking errors with release health, uptime monitoring with escalation, and log aggregation in place. Privacy/Terms hosted, cookie consent live, GDPR export + deletion working; compliance tracks scoped.

Idempotent server installs (S10)

One schedule:run cron per server — install in Phase 5 · Secure & verify schema using crontab -l | grep -v 'schedule:run' ; echo … | crontab -. Later phases verify (grep -c must be 1), never paste a second line. Same rule for .env keys: grep -q '^KEY=' file || echo … >> file.

Pages in this phase

1 · Harden first Rotate every vendor default, rate limits, file permissions, mass-assignment & session audit.

2 · Security headers & packages HTTPS + HSTS, .htaccess + middleware headers, force HTTPS, PII encryption, strong passwords.

3 · Activity logging Spatie Activity Log: model changes, auth events, GDPR actions, scheduled cleanup.

4 · Off-server backups The MUST: Spatie Laravel Backup → S3/Spaces/B2/R2 daily, 3-2-1 rule, restore drills.

5 · Observability Full Sentry (crons, perf, release health), log aggregation, uptime + health endpoint, alert escalation.

6 · Legal, privacy & GDPR Generate + host Privacy/Terms, cookie consent, GDPR export + deletion, ROPA + DPAs.

7 · Compliance tracks Reference: when SOC 2 and HIPAA apply, what they cost, and the platforms that automate them.

Start with Harden first — never monitor a target you haven’t secured.