How Dxtra reads your site the way a regulator does.

What the scan is — and isn't

Dxtra reads your public surface and assesses it against the obligations a regulator would expect to see evidenced there. It is an automated indicator that points you to where attention is likely needed. It is not legal advice and not a determination that any law has been breached — that is a judgement only a qualified privacy professional can make on the full facts.

Because it works from the outside, the scanner cannot see your contracts, internal records, processing purposes, or anything behind a login. The absence of something on your public surface is treated as a prompt to check, not as proof of non-compliance.

The three scan agents

Every scan runs three agents over your public surface, each with a clearly defined job:

Surface Agent — reads your public pages (homepage, footer, policy links) as static HTML, discovering your privacy notice, rights routes and other published material.

Browser Agent — drives a real headless browser to observe live behaviour: cookies, trackers and marketing pixels before any consent, plus a simulated Reject All and a Global Privacy Control signal. All tracker and consent evidence is attributed to this agent.

Policy AI — reads your privacy notice for the substance regulators expect (rights, transfers, retention, contacts and disclosures). Deep policy analysis is attributed to the Policy AI.

The headline is a risk band — the number is just a progress meter

Every scan returns one of three risk bands — Low, Medium or High. The band is the headline and the only thing that carries weight. It is set by the count of confirmed high- and medium-severity findings under the methodology's Appendix B thresholds, scored across the jurisdictions that apply to your site.

We show a 0–100 figure alongside the band, but it is deliberately secondary. It is a capability-maturity indicator: a measure of how much of a credible privacy programme is already evidenced on your public surface, and how far that is from the 91/100 threshold a site needs to reach to earn a Dxtra verified badge. It is not a regulatory determination, not a grade or league-table position, and it never changes the band. Two sites in the same band can show different numbers simply because one has more above-baseline practice visible.

Sites that process higher-sensitivity data — health, biometric, financial, child-directed, AI significant-decisioning, or Washington MHMDA scope — are assessed against tightened bands, because regulators expect more of them: a single high-severity finding can place such a site in the High band.

Commendable practices (above-baseline things you already do well — a transparency hub, a published sub-processor list) are recognised and can lift the 0–100 figure, but they are informational only — they never move the risk band.

What Low, Medium and High mean

The band is set purely by how many confirmed High and Medium findings your public surface shows, under the methodology's Appendix B thresholds. Higher-sensitivity sites are held to the tightened column on the right, because regulators expect more of them.

A site is treated as elevated when the scan sees any of these triggers: health, biometric, financial, child-directed, AI significant-decisioning, Washington MHMDA consumer health data, EU AI Act Art.5 scope, mandatory cross-border pathway. Any number shown alongside the band is a presentational composition summary only — it is not the headline and not a regulatory determination.

Every finding is anchored

Nothing is asserted on a hunch. Each finding maps to a named regulator source and to a recognised control framework: the NIST Privacy Framework v1.1, ISO/IEC 27701:2025, and an ENISA-style assessment of likelihood × impact × sensitivity. Regulator citations, finding identifiers, dates and statutory instruments come from the published Regulator Reference — they are never invented. Where something can't be confirmed from the public surface, the scanner records it as not evaluated rather than guessing.

Findings catalogue

Each finding on your report carries a short code (for example M13). The code is a stable reference into this catalogue — not a score. Here is every code the scanner can return, in plain language, with the regulator source it maps to. Codes beginning F are high-severity, M medium, L low. A code only appears on your report when the scan actually observed that gap on your public surface.

"What it checks" describes the public-surface signal, not internal detector logic. Commendable practices (codes beginning C) are recognised separately and never move the band.

Cross-border sites

When a site reaches users in more than one jurisdiction, each indicator is scored against the most stringent applicable regime. A clean result from one vantage is reported as "not observed from this vantage" — never as "compliant" — because the absence of a finding in one country is not evidence of compliance in another.

When a site limits access

Some sites rate-limit or block automated visitors. When that happens the scanner does not fail silently or invent results: it returns a preliminary, access-limited assessment with an explicit banner, reports only what it could directly observe, and withholds any finding that depends on having fully read the site. You always know what was — and wasn't — established.

Canonical reference documents

This page is the plain-language summary. The full, citable source documents are published openly: the complete methodology and the regulator reference — every regulator source, statutory instrument and enforcement decision behind the finding catalogue.

Scanner methodology (full) ↗ · Regulator reference ↗

Versioning

The current ratified methodology is Methodology v1.8 (with Regulator Reference v1.7). It incorporates the geo-vantage addendum governing multi-region scans — disclosing the vantage each result was observed from and the rule that absence ≠ compliance. The methodology is versioned and auditable, and findings are reproducible against the published rules.