FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Security

Detectify

EssentialOfficial website

Detectify is a Swedish External Attack Surface Management and web vulnerability scanner. Operated by Detectify AB in Stockholm, it crawls customer websites from cloud workers, simulates real attacker payloads from a crowd sourced research community and reports findings via a SaaS console.

Block Detectify until consentScan my site
Overview

What does Detectify do?

What is Detectify?

Detectify is an External Attack Surface Management (EASM) and web vulnerability scanner founded in Stockholm in 2013. The product crawls internet exposed customer assets from cloud workers, fingerprints services and runs payloads contributed by an invite only crowd sourced research community (Detectify Crowdsource). Findings appear in the Detectify console with severity, exploit description and remediation guidance.

Cookies and data collected

Detectify does not embed any client side tag on customer websites. The console at detectify.com sets first party authentication cookies (detectify_session, csrf_token) for the customer team. The marketing site at detectify.com loads HubSpot, Google Analytics 4 and Segment, which set their own cookies subject to consent. Scanner workers fetch HTTP responses, headers, screenshots and DOM trees from the customer assets being assessed.

GDPR and ePrivacy implications

Detectify acts as a processor of the customer for the scanning service (Art. 28 GDPR). The console authentication cookies are strictly necessary. Marketing site analytics and CRM cookies fall under Article 5(3) of the ePrivacy Directive. Scans that traverse authenticated areas may expose user account data: customers must define scope carefully and obtain employees and end users awareness where appropriate.

Consent requirements

For the Detectify console, only strictly necessary cookies are set, and they are consent exempt. For the Detectify marketing site, HubSpot and Google Analytics cookies are gated behind their own consent banner. For the customer adopting Detectify, no consent is needed from website visitors because Detectify does not embed any code on the customer site; the scanner runs externally.

Data residency and transfers

Detectify AB is a Swedish company and the core platform runs on AWS EU regions (Frankfurt, Ireland). Scanner workers are distributed globally to verify geo dependent exposure. Customer support, marketing analytics and certain sub processors operate in the United States. Detectify signs SCCs and publishes a sub processor list and DPA addendum.

Practical compliance steps

Sign the Detectify DPA, define scanning scope explicitly to avoid touching user account data unintentionally, configure SSO for the console, document Detectify as a processor in your record of processing, and inform DPO and security teams about findings handling. No update to your public cookie policy is required for the scanner alone.

Compliance

Detectify and the GDPR

Detectify is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Strictly necessary cookies on the Detectify console (authentication, CSRF) do not require consent. Analytics and marketing cookies on the public marketing site require consent under Art. 6(1)(a) GDPR. Scanning customer assets is performed under the customer's instruction as a processor under Art. 28 GDPR.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive (Cookie Law), CCPA

Impact assessment (DPIA)

Detectify scans customer owned assets and discovers vulnerabilities, configuration issues and exposed data. The processing acts on assets, not on end users of the customer site, so a DPIA is rarely required for the scanner itself. It may be appropriate where Detectify findings include personal data exposures that the customer must triage and remediate, or where scanning includes authenticated areas with user accounts.

Sample text for your banner

We use Detectify to scan our own websites for vulnerabilities. Detectify does not embed any code on this website; the scanner runs externally from Detectify AB infrastructure in the European Union. No personal data of visitors is shared with Detectify as part of routine scanning.
Cookies and trackers

What Detectify sets and contacts

Tracking method
External SaaS vulnerability scanner that crawls customer websites from cloud workers; web app at detectify.com sets first party authentication cookies for the customer console and runs analytics and marketing scripts on the marketing site; does not embed any tag on customer websites.
Server location
Sweden (Detectify AB, headquartered in Stockholm). Production infrastructure runs on AWS, primarily in EU regions (Frankfurt, Ireland) with scanner workers distributed worldwide to test geographically dependent assets. Marketing site and analytics tools may use US sub processors (Segment, HubSpot, Google Analytics 4).
Data transferred outside the EU
Detectify AB is a Swedish company and the core scanning infrastructure is EU based, which makes Detectify a low risk option for European customers. However, the customer facing console at detectify.com loads analytics and CRM scripts from US sub processors (Segment, HubSpot, Google), and customer support traffic is processed by Zendesk in EU and US. Standard Contractual Clauses are signed.

Cookies set (3)

NameTypeDurationPurpose
detectify_sessionStrictly necessary (console authentication)SessionMaintains the authenticated user session in the Detectify console
csrf_tokenStrictly necessary (CSRF protection)SessionProtects authenticated requests against CSRF attacks
OptanonConsentFunctional (Detectify marketing site consent)1 yearRecords the consent state for marketing analytics cookies on detectify.com

Third-party domains contacted (4)

  • detectify.com
  • app.detectify.com
  • assets.detectify.com
  • api.detectify.com
Questions

Frequently asked questions about Detectify

Can't find your question? Write to us, we answer fast.

What cookies does Detectify set?

On the Detectify console, only strictly necessary cookies (detectify_session, csrf_token). On the marketing site detectify.com, HubSpot, Google Analytics 4 and Segment cookies are loaded behind a consent banner. Detectify does not embed any tag on customer websites.

Is consent required for Detectify?

Not on the customer site itself, because Detectify does not embed any client side code. The Detectify marketing site has its own consent banner. The console runs on strictly necessary cookies, which are exempt.

What is the legal basis?

Detectify acts as a processor of the customer under Art. 28 GDPR for the scanning service, which itself relies on Art. 6(1)(f) legitimate interest in keeping the customer assets secure. Console authentication uses Art. 6(1)(b) contract.

Does Detectify transfer data outside the EU?

Core scanning and customer data live on AWS EU regions (Frankfurt, Ireland). Scanner workers are distributed globally to verify geographically dependent issues. Some marketing and support sub processors operate in the US under SCCs and the EU US Data Privacy Framework.

Do I need a DPIA?

Usually no: Detectify scans assets, not visitors. A DPIA may be appropriate if Detectify findings include personal data exposures requiring triage, or if scans target authenticated areas with user accounts at scale.

How do I implement Detectify compliantly?

Sign the Detectify DPA, define scanning scope explicitly, activate SSO for the console, document Detectify in your record of processing as a processor for security testing, and connect findings to your vulnerability management process.

Are there alternatives?

Yes: Acunetix (Liechtenstein), Qualys (US), Tenable (US), Probely (Portugal/EU), Intruder (UK), Snyk (UK/US), Burp Suite Enterprise (UK). EU origin scanners reduce transfer risk; non EU need SCCs and a TIA.

How do I update my cookie policy?

You do not need to update your public cookie policy because Detectify does not embed cookies on your website. If you log in to the Detectify console, the cookies are first party to detectify.com and managed by Detectify's own privacy policy.

Same category

More services: Security

See the whole category

Thawte

Thawte is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Thawte supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Thawte ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Security

ReCaptcha v2 for Contact Form 7

ReCaptcha v2 for Contact Form 7 is a form building and data collection platform that helps businesses create professional online forms, surveys, and questionnaires without coding. It offers a drag-and-drop builder, conditional logic, file uploads, and payment collection. ReCaptcha v2 for Contact Form 7 integrates with CRM, email marketing, and productivity tools to automate workflows triggered by submissions. With responsive designs and spam protection, ReCaptcha v2 for Contact Form 7 helps capture leads.

Essential

TrafficGuard

TrafficGuard is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. TrafficGuard integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, TrafficGuard makes advanced AI accessible to all teams.

Marketing

Forter

Forter is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Forter supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Forter ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

Covery

Covery is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Covery integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Covery makes advanced AI accessible to all teams.

Essential

AntiBot.Cloud

AntiBot.Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. AntiBot.Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, AntiBot.Cloud ensures optimal performance at scale.

Essential

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site