Ownership
- Domain, cloud, database, email and store accounts are in the company's name
- At least two people can reach every account
- Secrets live in the platform's environment settings, not in the repo
Environments
- Production and staging exist and differ only by environment variables
- Database backups run daily and one has been restored as a test
- Migrations run from CI, not from a laptop
Monitoring
- Error tracking on web and mobile with alerts routed to a person
- Uptime check on the login page and the API
- A dashboard for signups, activations and failed payments
Store and legal
- Privacy policy and data deletion page published and linked from the app
- Play Store listing with screenshots from the real app
- Support email that a human reads
- Terms that describe the plan and lock behaviour honestly
First week
- Someone watches the error tracker every morning
- Every signup gets a personal message within a day
- Abandoned signups are cleaned up so metrics stay honest