Three instruments you can run today.

Ley 81 Compliance Checklist

The compliance document that doubles as a procurement credential

Run time ~30 min · Requires access to your site and your data practices

Why this matters beyond compliance

Ley 81 de 2019 is Panama's personal data protection law. Most businesses treat it as a legal box to check. That framing costs them contracts.

Here's the distribution reality: corporate and institutional buyers run vendor reviews before they run negotiations. A procurement officer at a bank, a hospital, a government contractor, or a multinational's Panama office has a checklist. Data handling is on it. If you cannot demonstrate compliance, you are not rejected — you are filtered out before anyone reads your proposal.

The businesses that document compliance don't just avoid fines. They stay on shortlists their competitors never learn they were removed from.

Compliance is a market-access credential. Treat it as one.

The six principles — self-assessment

Score one point per principle you can fully evidence. Partial credit is zero credit — a procurement officer doesn't award partial credit either.

What visibility this unlocks

A documented compliance posture changes what you can pursue:

• Institutional and corporate contracts that require vendor data-handling review as a gate
• Multinational Panama offices operating under stricter parent-company standards
• Regulated sectors — financial services, healthcare, legal — where the review is non-negotiable
• International clients whose own compliance obligations extend to their vendors

The asymmetry: this is a one-time infrastructure investment that permanently expands your addressable market. Most competitors in most Panamanian verticals have not done it, and the buyer cannot tell who has until they ask.

Security Header Reference

The vendor review you're failing without knowing it

Run time ~5 min to scan, ~1 hour to correct · Requires access to your hosting configuration

Why this matters beyond hardening

Security headers are instructions your server sends to browsers before a single word of content loads. They are trivially checkable by anyone, from anywhere, in seconds, without permission.

That last point is the one businesses miss. A prospect, a competitor, a procurement officer, or an auditor can grade your security posture without asking and without telling you.

The distribution consequence: enterprise and institutional buyers increasingly run an automated scan as a pre-qualification step. It costs them nothing. A failing grade doesn't produce a conversation about remediation — it produces a quiet removal from the vendor list.

You will never receive that email. That's the entire problem.

Run the scan first

Scan your domain at Mozilla Observatory (developer.mozilla.org/observatory). Note your grade before reading further. Most Panamanian business sites score F.

If you scored F, nothing is wrong with your business. Your server was simply never configured to say anything — and defaults are silence.

The headers

Strict-Transport-Security (HSTS)

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Forces browsers to use HTTPS exclusively for one year, including subdomains.

Without it: A browser will attempt an unencrypted connection first. On untrusted networks — hotel wifi, airport, café — that initial request is interceptable. Session-downgrade attacks depend on this gap.

Content-Security-Policy (CSP)

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; form-action 'self'

Declares which sources may load scripts, styles, images, and other resources.

Without it: Any injected script executes with full page access — including access to your form fields. This is the header that turns a minor vulnerability into a data breach.

Note: Add your actual third-party domains to the relevant directives. Analytics, payment processors, and font providers each need explicit permission.

X-Frame-Options

X-Frame-Options: DENY

Prevents your site from being embedded in a frame on another domain.

Without it: Clickjacking. Your site rendered invisibly over an attacker's page, so users interact with your interface while believing they're somewhere else.

X-Content-Type-Options

X-Content-Type-Options: nosniff

Stops browsers from guessing file types.

Without it: An uploaded file the server labels as an image may be interpreted and executed as a script.

Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Controls how much URL information travels with outbound links.

Without it: Full URLs — including any parameters — leak to every external site your users visit from yours. This is also a Ley 81 exposure if those URLs carry personal data.

Permissions-Policy

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

Disables browser APIs your site doesn't use.

Without it: Any script on your page can request camera, microphone, or location access. Remove payment=() if you use a payment processor requiring the Payment Request API.

Implementation

Cloudflare Pages — create a file named _headers in your site root:

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; form-action 'self'

Other platforms use different mechanisms — Netlify uses the same _headers format, Apache uses .htaccess, nginx uses the server block. The header values are identical regardless.

Verify by rescanning. F to A is typically a single deployment.

What visibility this unlocks

• Passing automated pre-qualification at institutional buyers who scan before they shortlist
• Surviving vendor security questionnaires without a remediation delay that costs you the timeline
• Credibility with technical buyers — CTOs, IT directors, and security-conscious executives check, and they check first
• Ley 81 evidence — four of these headers directly evidence Seguridad, Integridad, and Confidencialidad

The asymmetry: this costs one afternoon and permanently removes a silent disqualifier. Most of your competitors are scoring F right now and have no idea, because failure in this channel is invisible from the inside.

Visibility Self-Diagnostic

Can a machine tell a buyer what you do?

Run time ~45 min · Requires your site, a browser, and honesty

Why this matters

Buyers no longer only search. They ask.

"Who does industrial cleaning in Panama with ISO certification?"

"Which production companies in Panama have worked with US networks?"

"Where can I find a specific watch reference in Latin America?"

A language model answering those questions builds its response from sources it can parse, classify, and cite. Being on page one is irrelevant if the model cannot determine what your business is, where it operates, or what it's certified to do.

The shift is structural. Search rewarded whoever spent the most on ads. AI-mediated discovery rewards whoever is most legible to a machine — and legibility is a one-time build, not a recurring spend.

That's the asymmetry, and it is temporary. It closes as competitors notice.

What visibility this unlocks

• Presence in AI-generated shortlists at the moment the vendor list is written — before any human contacts you
• Correct classification so you appear for queries you can actually serve
• Credential visibility so what qualifies you is readable rather than decorative
• Audience separation so international and local buyers each reach the right version
• Compounding returns — structured data is a permanent asset, not a monthly spend

The asymmetric window: most businesses in most Panamanian verticals score below 10. The gap between operational credibility and machine legibility is the widest and least-contested opportunity in the market right now — and it closes the moment competitors notice it exists.

Using these

Run all three against your own site before running them against anyone else's. The results are usually uncomfortable and always actionable.

Nothing here is gated. Nothing requires an email address. If they're useful, use them.

If the findings raise questions about your specific situation — that's a conversation worth having.