For adult sites and cam platforms with California members

Members’ sex-life data is sensitive. California wants it assessed in writing.

Assay keeps the risk assessments California’s privacy regulations require since 2026: for every activity that sells or shares personal information, processes sensitive data, or uses automated decisions, inference or face technology — the nine parts of the report, every review and update, the three-year clock, and the yearly attestation to the Agency.

Open the demo See pricing

Opens in this browser with an invented membership site already in it. No account, no email address, nothing installed.

Open the free demo →

The problem

Written before the processing, reviewed on a clock, attested each April.

California’s privacy regulations, adopted July 2025 and in effect from January 1, 2026, require certain businesses to conduct risk assessments. An adult site processes exactly the sensitive data they cover. Each assessment covers nine things, is reviewed every three years and updated after a material change, and an executive attests each year, under penalty of perjury.

January 1, 2026

when the regulations requiring risk assessments and cybersecurity audits took effect.

California Privacy Protection Agency →

3 years

between reviews, and 45 days to update after a material change.

Under penalty of perjury

an executive attests to the Agency what was assessed.

Will not let a submission go without a signer.

No attestation is marked submitted without the executive who signs it named. An activity started with no assessment, an assessment missing any of the nine parts, a material change with no update, and processing still to assess by the 2027 deadline are each on the file. Reviews are added, never overwritten.

How it works

Processing, the Agency, the file

Record each activity

Which of the six triggers applies, when it started and was assessed, the nine parts, and any material change.

Name the signer

The point of contact and the executive who attests, and each submission with what it covers and when it went.

Print the file

Every finding, each activity’s record, its next review and how long to keep it.

What it will never do

It keeps the assessments. It submits nothing.

Assay records what you assessed and when. You submit to the Agency yourself.

No submission.Nothing goes to the Agency from Assay.

Nothing overwritten.Every review and update is added beside the last.

It is not a lawyer.Not legal advice.

It never touches a payment.The subscription is for software.

Pricing

Priced per business

Less than an hour of a privacy lawyer a month.

Most sites

One business

$49/month

One adult site or cam platform.

The nine parts per activity
Three-year and 45-day clocks
Yearly attestation record

One business, yearly

$490/year

The same, two months free.

Everything in One business
Retention dates
Export for your counsel

Subscription. Your bank statement says Assay Software. Refunded in full on request within 30 days. Your licence key is emailed to you within two working days of payment.

Checkout is our own bitcoin server, not a card processor — nobody we had to apply to and nobody who can close the account. The button takes you straight to it. Give your email address there — that is where your key is sent.

Questions

The ones we actually get asked

What triggers an assessment?

Selling or sharing personal information, processing sensitive personal information, or using automated decision-making, inference or face technology.

What about processing we already did?

Processing that was already running is assessed by December 31, 2027. Assay keeps that date in front of you.

Who signs the attestation?

An executive, under penalty of perjury. Assay will not mark a submission without one named.

Is this legal advice?

No. It is the file you wish you had kept.

What do I actually get when I pay?

The demo on this page is the whole program, running on invented records. Paying gets you a licence key — one line of text, emailed to the address you give at checkout within two working days. Paste it into the program and from then on it keeps your own records. Until then, nothing you type into it is kept.

The key is checked inside the page, on your own machine. It never calls us, so there is still no account and nothing about your business goes anywhere. If you ever stop paying, your records stay exactly where they are, read-only, and Export still hands you every one of them.

Open the demo before April

The invented membership site’s profiles are assessed but missing two parts, a retargeting pixel started with no assessment, a vendor changed a month ago, an engine is still to assess by 2027, and no signer is named. Assay names every one.

Open the demo See pricing