Security and privacy
We scan our customers' sites, so how we behave is part of the product. Here it is, plainly: how the scanner works, what we store and how organizations are kept apart.
How the scanner behaves
The rules the scanning workers follow.
- An identifiable User-Agent
- Scanner requests carry a User-Agent that contains PageLookout/<version> (+https://pagelookout.com/bot). Browser-based checks append the same token to the browser's own User-Agent. You can recognize the requests in your server logs and tell them apart from ordinary traffic.
- A bounded number of requests
- Every scan has a budget: the maximum number of URLs, the crawl depth and the request rate defined in the site policy. We do not generate traffic beyond it.
- Same site only
- The scanner visits URLs belonging to the site registered in your organization. We do not wander off that domain when fetching pages to analyse.
- We never request private addresses
- We send no requests to private address ranges or to resources on internal networks. The scanner works against publicly reachable addresses.
- No credentials
- We do not accept or store credentials to your systems. We do not sign in to panels, applications or protected areas.
- No attempts to bypass protections
- We do not exploit vulnerabilities and we do not run penetration tests. The scanner reads server responses the way an ordinary HTTP client does.
About the scanner: how it identifies itself, and how to block it
What we store
Scan results come in three layers.
-
Findings
A normalized description of what was observed, with a severity and a stable fingerprint that lets the same issue be recognized in later scans.
-
Evidence
The structured data behind a finding: the URL, the header name and value, cookie attributes, certificate data.
-
Artifacts
Raw output from the tools we used, preserved unchanged so you can go back to the source of a finding.
-
Scan history
A record of every run together with the scan policy it used, which makes consecutive scans of a site comparable.
Tenant isolation
The organization is the data access boundary: sites, scans, findings and artifacts belong to one organization, and users only ever see what belongs to their own. Admin and member roles decide who can change site settings and policies and who works with the results.
Hosting
The platform runs on Google Cloud in the EU (europe-west1), in Belgium. Details of data processing arrangements and retention periods are set out in the contract and the privacy policy.
Reporting a security issue
If you spot a security problem in our service, or in how the scanner behaves towards your site, write to us. We treat such reports as a priority and answer them first.