OWASP · GDPR · PCI DSS · Consent
Web security and GDPR compliance work for sites and online shops
In shortWeDevelop is a Romanian software company that reviews and hardens websites and online shops and implements the technical side of GDPR, PCI DSS and cookie consent, including data mapping, retention rules and recovery after a hack. It suits businesses on Magento, WordPress or custom platforms whose site has to match what their policies say. Legal interpretation stays with your lawyer or DPO.
At a glance
- Provider
- WeDevelop, a software company from Romania
- Clients
- Romania, the EU, the UK and North America
- Languages
- English and Romanian
- Invoicing
- EUR, GBP or RON
- Pricing
- Quoted after scoping, from your brief
- Contact
- office@wedevelop.ro
01Is this for you
When your site needs this work
This work is about the site itself and the data passing through it. If your concern is the whole company, including laptops, staff and email, look at cyber security instead. These are the usual triggers.
- Your privacy policy describes things the site does not actually do.
- Tracking scripts run before a visitor has made a consent choice.
- Nobody can delete a customer's data on request, or say when old records expire.
- The site has been hacked, or shows signs of it, such as spam pages or unknown admin accounts.
- A client, tender or partner is asking for evidence about the security of your site.
02What you get
What the work covers
Some buyers need one of these, and many need a mix once the first review is done.
Application security review
Authentication, authorisation, injection, file handling, sessions and dependencies checked against OWASP ASVS, with severity and reproduction steps per finding.
Platform hardening
Magento, WordPress and server configuration, security headers, rate limiting, WAF rules, TLS and SSO or MFA for the people who administer the site.
Hacked-site recovery
The attacker removed, evidence preserved, the real entry point closed and a clean version restored, with a written report and timeline.
The technical side of GDPR
Data mapping, retention rules, handling of data subject requests and support for DPIAs, all checked against what your systems really do.
Consent and tracking
Tags that wait for the visitor's choice, cookie information that matches what is loaded, and evidence of how consent is handled.
PCI DSS scope reduction
Card capture moved away from your servers where possible, plus support with the SAQ your acquirer asks for.
03Which option
Template policy, security plugin, legal adviser or technical work
People often assume that one of these covers the others. In practice each one leaves a specific part of the job undone.
| Option | What it covers | What it leaves open |
|---|---|---|
| Template policy and a cookie banner | Words on the site and a visible consent prompt. | Whether scripts really wait for consent and data really gets deleted. A policy that does not match the site is a problem of its own. |
| Security plugin or WAF alone | Common automated attacks and known signatures at the edge. | Flaws in custom code, weak access rules, outdated dependencies and unencrypted backups. |
| Lawyer or DPO | Lawful basis, policy wording, contracts and whether an obligation applies to you. | Making the decisions real in code and configuration, and finding out what your systems actually do with data. |
| Technical review and implementation | What the site really does with data and how it is exposed, then the fixes and the evidence. | Legal opinions, which come from your adviser, and any formal penetration test that must come from an accredited third party. |
Most businesses need the last two working together, with your adviser deciding what is required and engineers making it true. Technical work cannot promise compliance on its own. It does make what you say match what your systems do.
04Cost
What decides the cost of web security and GDPR work
A brochure site and a shop with custom modules are very different jobs, so we quote after seeing the platforms and the data involved.
| Factor | Why it matters |
|---|---|
| Sites and platforms in scope | Every Magento store, WordPress site or custom application has its own code, plugins and hosting to review. |
| Custom code | Standard platforms have known weak spots, whereas custom modules and inherited code have to be read. |
| Personal data footprint | Each CRM, newsletter tool, ERP or analytics service holding customer data adds to the map and to deletion and retention rules. |
| Tracking setup | A long list of tags and advertising pixels takes more work to bring behind consent than a site with basic analytics. |
| Payment flow | Moving card capture to hosted fields or a redirect may require checkout changes before the PCI scope gets smaller. |
| Incident work | Cleaning up a hack depends on how far the attacker got and whether a clean backup exists. |
A review on its own is a defined piece of work. Fixes can be quoted from its findings, done by your own team or given to another supplier.
05How to start
From first email to a gap that stays closed
If the site has already been hacked, tell us first in your message, because containment comes before everything below.
Send the sites and the reason
URLs, platforms, hosting, what personal and payment data they handle, and who is asking for what.
Review
Code, configuration, tags and data flows are compared with your existing policies and consent tooling, and written up with severity and reproduction steps.
Fix in order of severity
Exposed issues are closed first, then consent, retention and deletion behaviour are corrected in code and configuration.
Keep it closed
Dependency monitoring, prompt patching, audit logging and alerting, with reports and logs you can give to a partner or auditor.
06For an accurate quote
What to include in your request
A few facts are enough to scope the first review.
- The sites and shops in scope, with their platforms and hosting.
- What personal and payment data they collect, and where it goes next.
- Your existing policies and consent tool, if there are any.
- Obligations from clients, tenders or regulators, with any deadline.
- Any recent incident, including what you noticed and when.
07Questions
Questions buyers ask about web security and GDPR
How much does a website security audit cost?
The price depends on the number of sites, how much custom code they contain and how much data they handle, so we quote after seeing them. A standard WordPress site is a much smaller review than a Magento store with custom modules and several integrations.
How long does a web security review take?
The length depends on the amount of custom code and on how quickly we get read access to the code and the servers, so we confirm the duration once the sites are known. Anything exposed and urgent is raised as it is found rather than kept back for the final report.
My website was hacked. What should I do first?
Contain it first, and do not simply restore a backup, because that leaves the entry point open and resets the clock. Keep the logs and files as evidence, change administrator credentials and contact us with what you noticed. Your adviser should also check any duty to notify.
Can you make our website GDPR compliant?
We can implement and document the technical side, but no supplier can honestly promise compliance, because it also depends on your legal decisions and how your company behaves. The work covers data mapping, retention, deletion on request and consent, with your lawyer or DPO setting the requirements.
Is a cookie banner enough for GDPR?
No, a banner only helps if the site actually obeys the choice, with tracking scripts waiting until consent is given and stopping if it is refused. It also covers only part of the picture, since retention, deletion requests and data sent to other tools live in other systems.
Do we need a penetration test or is a code review enough?
A review with the source code in hand often finds a larger class of problems for less money, so it is usually the better starting point. You need a formal penetration test when a certification, client contract or regulator requires one, and that has to come from an accredited third party.
Will you sign a data processing agreement?
Yes, a data processing agreement is signed for every engagement and before work starts. Production data is not copied to laptops, and where a realistic dataset is needed for testing, it is anonymised. The same applies if we bring anyone else in to work on your systems.
08Related projects
Work we have done in this area
Optimum Medical — medical consumables store on Magento 2.4, maintenance
Online store for medical consumables and surgical supplies — needles and syringes, wound care, sutures, examination, surgery, emergency — with fast delivery across Romania, on Magento 2.4 with the Martfury theme. We keep it patched, compatible and quick.
Magento 2.4Martfury theme (MageBig)PHP 8MySQLView case study
Rat Bikes — Magento 2 bicycle shop, ongoing maintenance
Dutch online bicycle shop from Rotterdam, trading since 2008 and shipping across the EU — bikes, cargo bikes, frames, components and accessories from brands such as Surly, Salsa and Cinelli — in English and Dutch. We keep the Magento 2 store healthy, patched and fast.
Magento 2Argento theme (customised)PHPMySQLView case study
Montigen — medical products store on Magento 2.4, maintenance
Online store of a Romanian supplier of medical products and furniture for clinics — consumables, sutures, instruments, equipment, disinfectants, first aid — on Magento 2.4 with the Martfury theme. We maintain the platform and its integrations.
Magento 2.4Martfury theme (MageBig)PHP 8MySQLView case studyRequest a quote
Describe what you need. The enquiry goes to our team, and we reply by email with the next step.