DPAflow

Feature

Website technology scan

See the third-party technologies your own websites load — and keep a GDPR-aligned evidence trail. Detection is review-gated: a detected technology is never automatically confirmed as a subprocessor.

How it works

Registered websites, ownership verification, a safe public-signal scan, and a human review step before anything counts as a subprocessor.

Register your website

Add the domain you own. Each plan includes a set number of registered website slots — Starter 1, Professional 2, Business 3. Enterprise/custom allowances are arranged separately.

Verify ownership

Prove ownership with a DNS TXT record or an HTML meta tag. Verification unlocks long-term tracking; unverified sites allow only a warned one-off scan.

Scan from safe public signals

We fetch your own pages over HTTPS and match third-party signals against a clean-room rule set. We never log in, never submit forms, and never store raw HTML, cookies, or tokens.

Review, then track

Detected technologies are labelled verified or experimental and are never automatically confirmed as subprocessors. A reviewer approves a candidate before any monitoring begins.

Evidence you can stand behind

Built for GDPR Article 28 accountability — safe, hashed, and review-gated.

Compliance-relevant detections

Consent, analytics, payments, support/chat and similar categories that matter for an Article 28 subprocessor picture.

Hashed, redacted evidence

Reports carry content and vendor-list hashes, signal summaries, and a safety-gate outcome — never raw HTML, cookies, auth headers, or URL query strings.

Reviewer decision trail

Every tracked technology and candidate keeps a date-stamped record, so 'how do you know?' has an answer.

Website slots

A website slot is one registrable domain you own; subdomains under it share the slot.

  • Starter includes 1 registered website slot.
  • Professional includes 2 registered website slots.
  • Business includes 3 registered website slots.
  • Enterprise / custom website allowances are arranged separately — talk to us.

Need more websites, brands, or client domains? See pricing or contact us — we do not offer unlimited website scanning, and detected technologies are always reviewed before they are treated as subprocessors.

Related

Scan a website you own

See the technologies your site loads, with safe evidence you keep — and a review step before anything is called a subprocessor.

View evidence workflow