WebCompliance.in
Book a 10-min demo
TRANSPARENT METHODOLOGY SPECIFICATION

How WebCompliance Works

WebCompliance inspects the visible privacy surface of public websites using deterministic checks, reproducible evidence snippets, and practical remediation guidance. We never speculate on backend processing or claim to certify legal compliance.

CORE PRINCIPLE 01 // OBSERVATION VS LEGAL CERTIFICATIONNON-HALLUCINATION RULE

We Report Language Detected, Not Legal Sufficiency

When the scanner evaluates a published privacy policy, it checks whether specific transparency concepts appear in the text (such as purpose of processing, user rights, data retention, grievance officer, and third-party sharing).

STRICT SYSTEM RULE: The scanner reports “Relevant language detected.” It never reports “The policy is legally sufficient.”

Legal sufficiency requires understanding your business relationships, data processing agreements with third-party vendors, actual retention purging schedules, and internal handling procedures.

CORE PRINCIPLE 02 // SCRIPT INVENTORY & CONSENTTECHNICAL ACCURACY

We Distinguish Script Found From Script Executed

Many audit tools naively grep HTML for vendor names. WebCompliance inspects initial network traffic to distinguish:

  • • Script found in HTML: Tag exists in markup.
  • • Script executed: JavaScript executed by the browser engine.
  • • Network request observed: Data packet dispatched to external server.
  • • Cookie created: State persisted in client browser storage.
  • • Before vs After Consent: Whether network calls occurred prior to user interaction with the cookie banner.
SCOPE SEPARATION ARCHITECTURE

Your Website Is Only The Visible Layer

Privacy readiness begins with what the public can see, but true DPDP compliance requires inspecting what happens behind the screen.

LAYER 01 // PUBLIC WEB SURFACEAUTOMATED SCANNER V1

What WebCompliance Inspects Publicly

Safe, non-intrusive discovery of public indicators without logging into accounts or submitting transactions:

  • ✔Privacy Notice & Policy: Discovery, link health, footer placement, purpose and rights language signals.
  • ✔Forms & Personal Data: Form labels, email/phone/address fields, purpose statements, and near-form notices.
  • ✔Cookies & Trackers: Scripts loaded on initial load before consent interaction, advertising pixels, analytics tags.
  • ✔Consent Indicators: Observable banner controls (Accept vs Reject vs Settings buttons).
  • ✔Children’s Signals: Visible age-gate presence, school/coaching cues, and date-of-birth fields.
  • ✔Website Hygiene: HTTPS enforcement, redirects, sitemap.xml, robots.txt, security response headers.
DELIVERABLE: Instant Web Assessment Dossier with findings, evidence URLs, practical next steps, and manual review queue.
LAYER 02 // ORGANISATIONAL SUBSURFACEEXPERT HUMAN SERVICE

What Requires Human-Led In-Depth Review

Statutory compliance cannot be verified from the outside. These operational dimensions require verified documentation:

  • ✦Internal Data Mapping & RoPA: Lifecycle flow of personal data across internal microservices, databases, and third parties.
  • ✦Vendor & Processor Contracts: Valid Data Processing Addendums (DPAs), cross-border transfers, and sub-processor indemnities.
  • ✦Data Retention & Deletion Execution: Automated database pruning, archival policies, and verifiable deletion workflows.
  • ✦Security & Access Controls: Role-based access control (RBAC), KMS encryption, employee training, and penetration testing.
  • ✦Incident & Breach Response: CERT-In and DPBI breach notification playbooks, disaster recovery, and forensic evidence logs.
  • ✦Statutory Consent & Grievance Logs: Immutable consent logs and operational grievance dispute ticketing systems.
EXPLICIT BOUNDARIES // OUT OF SCOPE FOR V1 WEBSITE SCANNERSAFE HARBOR

To protect target web infrastructure and avoid false assurances, the following are strictly excluded from automated scans:

NO INVASIVE ACTIONS
No form submissions, test purchases, spam ticket dispatches, or account creation routines.
NO BYPASSING CONTROLS
No CAPTCHA cracking, no Cloudflare bypassing, and no private network penetration attempts.
NO INTERNAL ACCESS
Cannot inspect backend database encryption, internal CRM pipelines, or employee access logs.
BEYOND THE PUBLIC SURFACE // HUMAN-LED SERVICEEXPERT ENGAGEMENT

Your website is only the visible layer.

If you need a review of internal processes, data flows, vendors, contracts, policies, retention, security, or evidence, request an in-depth assessment from the WebCompliance team.

WHAT AN IN-DEPTH ASSESSMENT EXAMINES:
  • ✦Data processing agreements & sub-processor contracts
  • ✦Backend data flows, CRM databases & third-party APIs
  • ✦Data retention schedules & verifiable automated deletion
  • ✦Role-based access controls & data fiduciary audit trails
  • ✦Grievance redressal workflows & breach incident response