# Pre-launch checklist (short version)

> The 25 checks I'd never skip before letting strangers pay. Print it and tick it off.
> Not legal or tax advice.

## Accounts and email

- [ ] Signup, sign-in and sign-out work, and a signed-out visitor can't reach paid pages
- [ ] Password reset works and doesn't reveal whether an email address has an account
- [ ] Transactional email arrives in Gmail, Outlook and a work inbox, not in spam
- [ ] SPF, DKIM and DMARC are set for your sending service
- [ ] Inbound mail works: send a test to your contact address

## Money

- [ ] Hosted checkout and the billing portal are used. You built no payment forms
- [ ] Every billing scenario passes in Stripe test mode
- [ ] Then once with a real card on the live site: buy, change plan, cancel, refund
- [ ] The webhook signing secret is set for the live endpoint
- [ ] You know your sales-tax position before the first sale

## Legal pages

- [ ] Terms, privacy policy and refund policy, matching what you actually do
- [ ] A way to reach a person

## Hosting and deploys

- [ ] Production runs only production. Development happens elsewhere, or in a worktree
- [ ] Builds happen out of place and are swapped in only after every check passes
- [ ] Rollback is one command, and you've actually used it once
- [ ] Secrets live in env files that are not in git, and in your password manager

## Data and backups

- [ ] A database backup you control, not just the provider's
- [ ] You have restored a backup once, for real
- [ ] Row-level security (or your equivalent) is on for every table that holds user data

## Monitoring

- [ ] An uptime check from outside your network, alerting your phone
- [ ] A check for each thing that would break silently: inbound email, backups, scheduled jobs

## Launch day

- [ ] Make one real purchase yourself, then refund it, and confirm both emails arrived
- [ ] Sign up as a brand-new user in a private window and do the main thing
- [ ] Check the site from your phone on mobile data
- [ ] Check the mail (MX) records one more time