No. A pentest attacks your site to see how far someone gets. We only look at what every visitor gets to see too, and stop at the first sign of a weakness.

Does this check make us GDPR compliant?

No. A check alone makes nobody compliant. It shows with evidence what happens on your site, so you know what to look into.

Do you read our visitors' data?

No. We note the names of cookies, not what's in them, and we sign in nowhere. If anything personal does come in, we drop it at once. It never goes to an AI model.

Do you also look at privacy in the code?

Yes, through the documentation. Our fixed catalogue checks whether it's written down which personal data your application processes and how you secure it: present, thin or missing.

Do we need to install anything?

No. You enter your site's address in your workspace. You connect your code alongside it, with read access only.

GDPR and cookies on your application

Checking cookies and privacy on your application (GDPR)

Does your site set cookies before a visitor has chosen, can they find your privacy statement, and which scripts do you load from other parties? We look at your public site the way a visitor sees it: passively, read-only, without attacking anything.

Updated 9 October 2026

What we look at on your site

A browser opens your public site, as a visitor does, and notes what happens before anyone chooses in the cookie notice. No AI is involved in this step.

Whether there is a cookie notice, and which cookies are already set before the visitor chose. We note their names, never their contents
Whether there is a privacy statement and whether it can be found from your pages. Also your terms, your company registration details and an accessibility statement
Which scripts you load from other parties, and which domains they come from
Whether your site uses HTTPS throughout and sends the usual security headers
Whether there is a security.txt, so whoever finds a flaw knows where to report it
Outdated JavaScript libraries and links that lead nowhere

What the rules say about cookies

According to the ACM and the Dutch Data Protection Authority (AP), you ask for consent before you set tracking cookies. Functional cookies, and analytics cookies with little effect on privacy, need no consent. You do say that you set them.

We're not lawyers. We show what happens on your site before a visitor has chosen. Whether that's allowed, you can read at the regulators listed below this page.

How far we go, and where we stop

We only look. The browser fills in no forms, signs in nowhere and visits only the domain you gave us. We note scripts from other parties, but we don't fetch them.

If we see a sign of a weakness, we stop there. We try nothing out, attack nothing and do no pentest. We read how your site is built, not what is on it, so we pull in no personal data. Your view lists such a finding as possibly vulnerable, with the place and the advice to check it yourself.

What you get back

The findings go under Privacy and Security in your workspace, next to what we found in your code. For every finding you see what we saw and on which page.

We only look at your site when you enter it in your workspace and have agreed. We fix nothing: you decide what to change.

Sources

The pilot is by invitation. Sign up, we check whether your application fits and email you. You connect your repository with read access only, the first check starts by itself, you see what is checked and what is proven, and then we ask what it is worth to you. Have a question first? Ask it in the message below.

Our team

Reads every sign-up and every question

Our team reads what you send and answers by email. A conversation only happens if you ask for one: with the people who do the work, not a salesperson.