Product guide
Outside-in privacy scanning: from observation to action
Start an external data and vendor inventory, compare policy with website behavior, and build a roadmap with human review.
Start where a visitor starts
Outside-in privacy scanning begins at the website surface: the pages, consent choices, forms, and services a visitor can encounter. Public scans begin with a URL without installing code on the site. This view helps ground policy discussions in captured behavior; it does not reveal every internal data flow.
Start with what was captured
A watch records the website experience and the evidence available during a scan. Begin with the final URL, capture time, consent state, and any loading limitations. A missing image or blocked page matters when interpreting the result.
Keep observations and decisions separate
A scanner can surface activity that deserves attention. Your team supplies the business context. Use Review to record what you checked, then Verify and clear when you have enough information to close the review. The original observation stays available.
Promote a warning when it needs action
If an observation calls for follow-up, promote the warning to a finding. Record the reason, assign the next step, and keep the linked evidence with the task. This makes the decision understandable to the next reviewer.
Build inventories and a roadmap
Use observed cookies, requests, forms, and third parties to start your external inventories. Add the purpose, owner, and vendor relationship from your team’s knowledge. Promote an observation that needs action to a finding, and track the fix in your roadmap. Vendor privacy requests and audit follow-ups can stay connected to the evidence.
Prepare for questions
A regulator or reviewer may ask what you observed, when you observed it, and what your team did next. Preserve capture conditions, original evidence, manual verification, and unresolved questions together. This prepares a traceable response; a scan or a cleared review is not a regulatory approval seal.
Return to the evidence
A completed review describes a decision at a point in time. Schedule rechecks and alerts to revisit it as the website changes, with scans running when the scan worker is available. Advanced authenticated journeys can examine an approved test customer’s experience, where the site allows that flow. Watch helps organize that work; your team remains responsible for its conclusions.