Features

What we check

Scan by regulation or standard

• GDPR / ePrivacy

  EU / EEA, UK

  Consent, tracking before consent, cookie banner behaviour, privacy notice, third-party data flows.

  Not covered by a scan: Whether the privacy notice is accurate; Lawful basis, data processing records, DSAR handling; Server-side data transfers.

• CCPA / CPRA (US states)

  California and other US states

  Privacy notice, opt-out signals (Global Privacy Control), advertising trackers, cookie practices.

  Not covered by a scan: A "Do Not Sell or Share" link flow behind forms; Data broker and sale agreements; Request handling inside your systems.

• Accessibility: WCAG 2.1/2.2 (ADA, Section 508)

  Global; US ADA and Section 508

  Automated WCAG A/AA tests and the markup quality assistive technology relies on.

  Not covered by a scan: Roughly half of WCAG criteria need a person (keyboard flow, meaning of alt text, captions); Screen-reader testing.

• European Accessibility Act (EN 301 549)

  EU

  WCAG 2.1 AA mapped to EN 301 549 clauses, plus the accessibility statement and feedback route.

  Not covered by a scan: Manual audit clauses; Documents, apps and hardware covered by the same standard; Whether your business is in scope or exempt.

• PCI DSS (payment pages)

  Global card payments

  Transport security, security headers, script control and session cookies on pages that take payments.

  Not covered by a scan: Your processor's environment and cardholder-data storage; Network, access-control and logging requirements; A formal SAQ or ROC.

• OWASP Top 10 (web security)

  Global

  Browser-visible security: misconfiguration, headers, TLS, session cookies, API exposure, known-vulnerable software, reputation.

  Not covered by a scan: Authenticated areas; Business-logic flaws and server-side code review; Penetration testing.

• E-commerce and consumer law

  EU / UK / US

  Seller identity, policies, pricing and checkout information, privacy and governance pages.

  Not covered by a scan: Whether the terms are legally sufficient; Country-specific rules for your products; Order-flow behaviour behind login.

• Open-source licence compliance

  Global

  Libraries shipped to the browser and their licences and notices.

  Not covered by a scan: Server-side and build-time dependencies; Licence compatibility advice.

Automated checks show where a website falls short of a framework. They cannot certify compliance or replace legal, audit or accessibility-expert review.

The platform around the scan

Reports and evidence

Scores, grades, prioritised fixes with remediation guidance, PDF export, evidence packs and expiring, password-protectable share links.

Monitoring

Scheduled scans, score history, regression alerts, and notifications to e-mail, Slack, Microsoft Teams and webhooks.

Findings workflow

Assign owners and deadlines, acknowledge or accept risk with a reason and expiry, and let the next scan confirm each fix.

Custom rules

Add your own checks for text, selectors, headers and patterns that matter to your organisation.

Signed-in scanning

Scan pages behind a login with a dedicated test account, read-only by default (Pro and above).

Integrations

GitHub checks and pull-request comments, Jira and Linear tickets, deployment-triggered scans from your hosting provider.

Developer tools

REST API with scoped keys, a command-line client, and a GitHub Action with SARIF output for code scanning.

Teams and agencies

Workspaces, roles, enforced two-factor, client portals on your domain with your branding, and a portfolio view.

Enterprise controls

SSO with OIDC and SAML, SCIM provisioning, audit log, IP allow-lists and a dedicated agreement.