> Detectify is a Swedish EASM scanner. EU based hosting reduces transfer risk but the console embeds US analytics. Learn how to deploy it under GDPR. > > Canonical: https://www.flowconsent.com/en/services/security/detectify Security # Detectify Essential · [Official website](https://detectify.com/) Detectify is a Swedish External Attack Surface Management and web vulnerability scanner. Operated by Detectify AB in Stockholm, it crawls customer websites from cloud workers, simulates real attacker payloads from a crowd sourced research community and reports findings via a SaaS console. [Block Detectify until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Required - Documented cookies 3 - Third-party domains 4 - Servers Sweden (Detectify AB, headquartered in Stockholm). Production infrastructure runs on AWS, primarily in EU regions (Frankfurt, Ireland) with scanner workers distributed worldwide to test geographically dependent assets. Marketing site and analytics tools may use US sub processors (Segment, HubSpot, Google Analytics 4). Overview ## What does Detectify do? ## **What is Detectify?** Detectify is an External Attack Surface Management (EASM) and web vulnerability scanner founded in Stockholm in 2013. The product crawls internet exposed customer assets from cloud workers, fingerprints services and runs payloads contributed by an invite only crowd sourced research community (Detectify Crowdsource). Findings appear in the Detectify console with severity, exploit description and remediation guidance. ## **Cookies and data collected** Detectify does not embed any client side tag on customer websites. The console at detectify.com sets first party authentication cookies (detectify\_session, csrf\_token) for the customer team. The marketing site at detectify.com loads HubSpot, Google Analytics 4 and Segment, which set their own cookies subject to consent. Scanner workers fetch HTTP responses, headers, screenshots and DOM trees from the customer assets being assessed. ## **GDPR and ePrivacy implications** Detectify acts as a processor of the customer for the scanning service (Art. 28 GDPR). The console authentication cookies are strictly necessary. Marketing site analytics and CRM cookies fall under Article 5(3) of the ePrivacy Directive. Scans that traverse authenticated areas may expose user account data: customers must define scope carefully and obtain employees and end users awareness where appropriate. ## **Consent requirements** For the Detectify console, only strictly necessary cookies are set, and they are consent exempt. For the Detectify marketing site, HubSpot and Google Analytics cookies are gated behind their own consent banner. For the customer adopting Detectify, no consent is needed from website visitors because Detectify does not embed any code on the customer site; the scanner runs externally. ## **Data residency and transfers** Detectify AB is a Swedish company and the core platform runs on AWS EU regions (Frankfurt, Ireland). Scanner workers are distributed globally to verify geo dependent exposure. Customer support, marketing analytics and certain sub processors operate in the United States. Detectify signs SCCs and publishes a sub processor list and DPA addendum. ## **Practical compliance steps** Sign the Detectify DPA, define scanning scope explicitly to avoid touching user account data unintentionally, configure SSO for the console, document Detectify as a processor in your record of processing, and inform DPO and security teams about findings handling. No update to your public cookie policy is required for the scanner alone. Compliance ## Detectify and the GDPR Detectify is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Strictly necessary cookies on the Detectify console (authentication, CSRF) do not require consent. Analytics and marketing cookies on the public marketing site require consent under Art. 6(1)(a) GDPR. Scanning customer assets is performed under the customer's instruction as a processor under Art. 28 GDPR. - Risk level low - Applicable regulations GDPR, ePrivacy Directive (Cookie Law), CCPA ### Impact assessment (DPIA) Detectify scans customer owned assets and discovers vulnerabilities, configuration issues and exposed data. The processing acts on assets, not on end users of the customer site, so a DPIA is rarely required for the scanner itself. It may be appropriate where Detectify findings include personal data exposures that the customer must triage and remediate, or where scanning includes authenticated areas with user accounts. ### Sample text for your banner > We use Detectify to scan our own websites for vulnerabilities. Detectify does not embed any code on this website; the scanner runs externally from Detectify AB infrastructure in the European Union. No personal data of visitors is shared with Detectify as part of routine scanning. Cookies and trackers ## What Detectify sets and contacts - Tracking method External SaaS vulnerability scanner that crawls customer websites from cloud workers; web app at detectify.com sets first party authentication cookies for the customer console and runs analytics and marketing scripts on the marketing site; does not embed any tag on customer websites. - Server location Sweden (Detectify AB, headquartered in Stockholm). Production infrastructure runs on AWS, primarily in EU regions (Frankfurt, Ireland) with scanner workers distributed worldwide to test geographically dependent assets. Marketing site and analytics tools may use US sub processors (Segment, HubSpot, Google Analytics 4). - Data transferred outside the EU Detectify AB is a Swedish company and the core scanning infrastructure is EU based, which makes Detectify a low risk option for European customers. However, the customer facing console at detectify.com loads analytics and CRM scripts from US sub processors (Segment, HubSpot, Google), and customer support traffic is processed by Zendesk in EU and US. Standard Contractual Clauses are signed. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------------ | --------------------------------------------- | -------- | -------------------------------------------------------------------------- | | detectify\_session | Strictly necessary (console authentication) | Session | Maintains the authenticated user session in the Detectify console | | csrf\_token | Strictly necessary (CSRF protection) | Session | Protects authenticated requests against CSRF attacks | | OptanonConsent | Functional (Detectify marketing site consent) | 1 year | Records the consent state for marketing analytics cookies on detectify.com | ### Third-party domains contacted (4) - `detectify.com` - `app.detectify.com` - `assets.detectify.com` - `api.detectify.com` Questions ## Frequently asked questions about Detectify Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Detectify set? On the Detectify console, only strictly necessary cookies (detectify\_session, csrf\_token). On the marketing site detectify.com, HubSpot, Google Analytics 4 and Segment cookies are loaded behind a consent banner. Detectify does not embed any tag on customer websites. ### Is consent required for Detectify? Not on the customer site itself, because Detectify does not embed any client side code. The Detectify marketing site has its own consent banner. The console runs on strictly necessary cookies, which are exempt. ### What is the legal basis? Detectify acts as a processor of the customer under Art. 28 GDPR for the scanning service, which itself relies on Art. 6(1)(f) legitimate interest in keeping the customer assets secure. Console authentication uses Art. 6(1)(b) contract. ### Does Detectify transfer data outside the EU? Core scanning and customer data live on AWS EU regions (Frankfurt, Ireland). Scanner workers are distributed globally to verify geographically dependent issues. Some marketing and support sub processors operate in the US under SCCs and the EU US Data Privacy Framework. ### Do I need a DPIA? Usually no: Detectify scans assets, not visitors. A DPIA may be appropriate if Detectify findings include personal data exposures requiring triage, or if scans target authenticated areas with user accounts at scale. ### How do I implement Detectify compliantly? Sign the Detectify DPA, define scanning scope explicitly, activate SSO for the console, document Detectify in your record of processing as a processor for security testing, and connect findings to your vulnerability management process. ### Are there alternatives? Yes: Acunetix (Liechtenstein), Qualys (US), Tenable (US), Probely (Portugal/EU), Intruder (UK), Snyk (UK/US), Burp Suite Enterprise (UK). EU origin scanners reduce transfer risk; non EU need SCCs and a TIA. ### How do I update my cookie policy? You do not need to update your public cookie policy because Detectify does not embed cookies on your website. If you log in to the Detectify console, the cookies are first party to detectify.com and managed by Detectify's own privacy policy. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [Thawte](https://www.flowconsent.com/en/services/security/thawte) [Thawte is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Thawte supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Thawte ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/thawte) [Security](https://www.flowconsent.com/en/services/security/thawte) · ### [ReCaptcha v2 for Contact Form 7](https://www.flowconsent.com/en/services/security/recaptcha-v2-for-contact-form-7) [ReCaptcha v2 for Contact Form 7 is a form building and data collection platform that helps businesses create professional online forms, surveys, and questionnaires without coding. It offers a drag-and-drop builder, conditional logic, file uploads, and payment collection. ReCaptcha v2 for Contact Form 7 integrates with CRM, email marketing, and productivity tools to automate workflows triggered by submissions. With responsive designs and spam protection, ReCaptcha v2 for Contact Form 7 helps capture leads.](https://www.flowconsent.com/en/services/security/recaptcha-v2-for-contact-form-7) [Essential](https://www.flowconsent.com/en/services/security/recaptcha-v2-for-contact-form-7) · ### [TrafficGuard](https://www.flowconsent.com/en/services/security/trafficguard) [TrafficGuard is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. TrafficGuard integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, TrafficGuard makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/security/trafficguard) [Marketing](https://www.flowconsent.com/en/services/security/trafficguard) · ### [Forter](https://www.flowconsent.com/en/services/security/forter) [Forter is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Forter supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Forter ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/forter) [Essential](https://www.flowconsent.com/en/services/security/forter) · ### [Covery](https://www.flowconsent.com/en/services/security/covery) [Covery is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Covery integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Covery makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/security/covery) [Essential](https://www.flowconsent.com/en/services/security/covery) · ### [AntiBot.Cloud](https://www.flowconsent.com/en/services/security/antibot-cloud) [AntiBot.Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. AntiBot.Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, AntiBot.Cloud ensures optimal performance at scale.](https://www.flowconsent.com/en/services/security/antibot-cloud) [Essential](https://www.flowconsent.com/en/services/security/antibot-cloud) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)