Privacy Policy & Scanner Data Handling
SiteScanAPI is built on a simple defensive premise: we analyze public HTTP headers and DNS configurations without invasive tracking, ad monetization, or private data harvesting.
1. Scope & The Passive Architecture
SiteScanAPI ("SiteScanAPI", "we", "us", or "our") provides automated, passive security header audits, DNS-over-HTTPS (DoH) records validation, and perimeter posture diagnostics via our website and public REST API (GET /api/scan).
This Privacy Policy explains the nature of data processed when you interact with our platform. Because SiteScanAPI functions solely as a defensive diagnostic engine, we do not require account registration, passwords, credit card numbers, or administrative access credentials to evaluate public web endpoints.
2. Information We Process
We process two categories of operational information:
A. Target Domain Information (Input by Users)
When a user initiates an audit, our edge nodes request public HTTP/HTTPS response headers from the specified Fully Qualified Domain Name (FQDN). We collect:
- Public HTTP Response Headers (e.g.,
Strict-Transport-Security,Content-Security-Policy,Server,X-Frame-Options). - Public DNS Resource Records queried via RFC 8484 DNS-over-HTTPS (e.g., SPF TXT records, DMARC TXT records, CAA records).
- TLS Handshake Negotiation parameters (e.g., TLS protocol version, cipher suite identifier, certificate expiration date).
B. Client Edge Telemetry (Your Connection)
When you access the SiteScanAPI web dashboard or REST endpoints, our Cloudflare edge network automatically processes standard HTTP request headers:
- IP address (used exclusively for volumetric rate limiting and edge DDoS mitigation; anonymized after edge processing).
- User-Agent and referring URL to properly format the response.
- Timestamp and latency metrics to ensure global edge reliability.
3. Purpose & Processing
We process collected data under the following legitimate interests and operational purposes:
- Security Posture Scoring: Calculating deterministic defensive scores against IETF and W3C specifications to help engineers patch missing HTTP security protections.
- Automated Remediation: Generating tailored server configurations for Nginx, Apache, Caddy, Cloudflare, and Vercel.
- Abuse Prevention & Availability: Throttling automated scrapers or abusive traffic that violates our 60 req/min fair-use threshold.
We do not sell, rent, monetize, or broker scanned data to third-party data aggregators or advertising networks.
4. Caching & Public Scan Data
To protect scanned origin servers from unintended denial-of-service and to optimize edge performance, audit results are cached for 15 minutes at the Cloudflare edge layer.
Because HTTP response headers are public broadcasts by specification, audit results generated through SiteScanAPI may be accessible to other users who query the exact same target domain within that 15-minute window. We do not expose the identity or IP of the user who initiated the scan.
6. Infrastructure & Sub-Processors
We operate exclusively on verified enterprise cloud infrastructure to guarantee deterministic uptime and cryptographic data confidentiality:
Executes serverless worker logic, handles anycast routing, provides DNS-over-HTTPS recursive resolution, and mitigates L3/L4 volumetric attacks. Data processed in the USA and European Union edge locations under Cloudflare Data Processing Addendum (DPA).
7. Data Retention Schedules
| Data Category | Retention Period | Disposition Mechanism |
|---|---|---|
| Domain Scan Results | 15 Minutes | Automatic TTL edge eviction |
| Rate Limiting Counters | 60 Seconds | In-memory sliding window reset |
| Edge Access Logs | Max 14 Days | Automated Cloudflare log purge |
| Contact Form Submissions | 90 Days | Encrypted archive rotation |
8. GDPR, CCPA & International Rights
Depending on your physical location (including the European Economic Area, United Kingdom, and the State of California), you possess explicit statutory rights:
- Right of Access & Portability: Request details of any personal information associated with your connection.
- Right to Erasure ("Right to Be Forgotten"): Request immediate flushing of cached scan records for domains you demonstrably own.
- Domain Opt-Out / Exclusion: If you are the verified administrative owner of a domain and wish to prevent third parties from auditing it via our public dashboard, you can request permanent exclusion by emailing
privacy@sitescanapi.comwith DNS TXT verification proof. - Non-Discrimination: We do not alter service availability based on the exercise of statutory privacy rights.
9. Edge Security Protections
We practice what we preach: SiteScanAPI enforces maximum perimeter defenses including mandatory TLS 1.3, strict Content Security Policy directives, HTTP Strict Transport Security with preload flags, Cross-Origin Opener Policy isolation, and automated cryptographic key rotation.
10. Contacting the Data Protection Officer
For privacy inquiries, domain exclusion requests, or statutory compliance matters, please reach our Data Protection Office directly: