How AorTag scans a website

1. Declaration, before every scan

You declare a website by entering its address and confirming that you own it or may test it. You confirm again before each scan. The account terms are recorded with the time, the IP address and the browser. We do not ask you to prove ownership with a DNS record or a file on your server.

2. A real browser, not a copy of your site

The scanner loads your pages in a Chromium browser, as a visitor would. It follows the starting address and the scope you choose, up to your plan's page limit. For consent checks it accepts or rejects the banner using the selectors you give it.

The scanner does not submit forms, log in with your details, or change your site or your tag manager. Journeys use synthetic inputs only, which you enter.

3. Good manners on your server

• The scanner identifies itself with the user-agent AorTag-Scanner.
• It reads robots.txt, honours the rules that apply to it, and waits between requests to the same site, including any crawl-delay you set.
• It refuses private and internal network addresses, so it cannot be pointed at your own servers' internals or at other networks.

If you want the scanner to stop or slow down, see the scanner page.

4. What is recorded, and for how long

AorTag records the requests each page sends, with sensitive values masked, and screenshots of the pages it visited. Results are kept for seven days on the free plan, ninety days on Pro and a year on Business. You can download your data at any time, and you can remove a website from Settings at any time.

What a scan does not tell you

A scan is a technical assessment of the tags on the pages it visited. It is not legal advice, a penetration test, or a guarantee that your analytics or your compliance are correct. Pages that were not reached, or consent states that were not tested, are reported as not tested.