Compliance & responsible scanning
A security tool has to hold itself to a higher standard than the sites it checks. These are the principles that govern how ScanOpsPro operates — what we will do, what we will never do, and what our results are (and are not) meant to be.
In short
We run read-only, passive checks, only on the site a person asks us to scan. We respect robots.txt, never perform intrusive testing, and store no scan results. You never need an account or email to use the scanner. Results are informational — not a certification and not a penetration test.
Read-only, passive checks only
Every scan opens a normal HTTPS connection to a site — the same kind of request a browser or search-engine crawler makes — and reads the public response: the TLS certificate, HTTP response headers, protocol version and response timing. That is all. We do not send exploit payloads, fuzz inputs, brute-force logins, enumerate hidden paths, or interact with anything behind authentication. Nothing we do modifies the target site or its data.
Only sites a user requests
ScanOpsPro checks a site only when someone actively enters its address and runs a scan. We do not maintain lists of pre-scanned organisations, we do not crawl the web to generate unsolicited reports, and we do not publish audits of named third parties. If a report exists, it is because a person asked for it in that moment.
Respecting site operators
Our requests identify themselves honestly and respect robots.txt directives. We keep request volume minimal — a scan is a small number of ordinary requests, not a flood — so a scan behaves like a single considerate visitor. Because our checks are limited to publicly served information, they carry no more load or risk than a normal page view.
Privacy and GDPR-conscious by design
The scanner is built to collect as little as possible about the people who use it:
- No account, no email required to run a scan.
- Scan results are not stored. We generate your report on the spot and do not keep a database of past scans tied to you.
- No selling of data and no advertising trackers built on your activity.
For the full detail on data handling and your rights under the GDPR, see our privacy policy.
Compliance context
Many of the fundamentals we check — HTTPS everywhere, sensible headers, careful handling of user data — overlap with the baseline expectations of frameworks like the EU’s GDPR and the NIS2 directive. Our guides put that in practical terms: start with the GDPR website checklist and, if your organisation may fall in scope, the NIS2 directive explained. A good scan result supports those obligations but does not, on its own, demonstrate compliance with them.