Limits and retention
The free scan has a small number of limits. They exist to keep the service available to everyone and to keep the amount of data held about third-party sites short-lived. This page states them plainly.
How many scans you can run
- Five scans per hour per IP address. Once the limit is reached the scan page asks you to try again later. The counter resets on its own.
- One report per host per hour. Scanning the same host again within 60 minutes returns the existing report rather than running a new scan. This keeps repeat requests cheap and means a colleague pasting the same URL sees the same evidence you did.
- One scan at a time per host. If a scan for that host is already running, you are sent to that report and can watch it complete.
What can make a scan fail
A scan needs a URL that a browser on the public internet can reach. A URL that is not publicly reachable is refused on the scan page before a scan starts. A scan that starts but cannot be completed, for example because the site blocks automated browsers, shows "Scan failed" on the report page, and you can run it again. A scan takes about two minutes; the page refreshes itself every ten seconds while it runs.
How long a report is kept
The report, the evidence archive behind it, and the two screenshots are deleted seven days after the scan. After that the link stops working. If you need to keep the result, save the page or note the findings before the seven days are up. There is no account, so there is no history to return to.
Who can see a report
A report link is public. Anyone who has the link can open it, and no login is required. Treat it the way you would treat any shared document: the URL is unguessable, but once it has been sent it can be forwarded.
We may remove a report at our discretion.
What the scan does not offer
To be clear about scope, the free scan does not include:
- scheduled or continuous monitoring;
- alerts or notifications;
- accounts or saved history;
- an API;
- a badge for your site;
- PDF export;
- CCPA reporting.
Not legal advice
Automated compliance indicators, not legal advice.
The checks are automated indicators of common GDPR and ePrivacy requirements, not a legal assessment of a specific site. What we check lists the rules and their legal basis so the findings can be reviewed with a qualified professional.