gdprscan

Static GDPR/privacy technical audit scanner. A single Go binary scans a domain from the outside, the way a data protection authority or a privacy-conscious visitor would see it, and produces a scored, client-ready report in minutes.

It is a technical audit aid, not legal advice or a certification of GDPR compliance. Product page: Ilion Web Solutions.

What it checks

1. Security headers, CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and friends.
2. TLS and certificate, protocol versions, cipher configuration, certificate validity and coverage.
3. Third-party vendors, scripts, frames and resources loaded from external companies, matched against an embedded vendor database.
4. Cookies set before consent, what lands in the browser on first contact, before any banner interaction.
5. DNS, MX and hosting jurisdiction, where the site and its mail actually live, resolved offline against a local GeoIP database.
6. US data-transfer exposure, three-state classification of each third party against the EU-US Data Privacy Framework.
7. Legal pages, presence and reachability of privacy policy and legal notice pages.

Output

• Deterministic JSON (stable key order, sorted findings), suitable for diffing two scans of the same domain.
• A scored Markdown report with an A-F grade, per-finding severity (critical/high/medium/low/info) and an evidence appendix. Convert to PDF with pandoc if a client deliverable is needed.

Critical findings cap the grade: one critical caps at C, two or more cap at D.

Build and run

go build ./cmd/gdprscan
./gdprscan -domain example.com
./gdprscan -list domains.txt -out reports/

Flags: -domain, -list (one domain per line), -out, -config (JSON, includes report branding), -timeout, -user-agent, -geoip-country-db, -geoip-asn-db.

GeoIP attribution (check 5) is optional and fully offline. Download a free DB-IP Lite MMDB once and pass its path:

curl -fL -o dbip-country-lite.mmdb.gz \
    https://download.db-ip.com/free/dbip-country-lite-$(date +%Y-%m).mmdb.gz
gunzip dbip-country-lite.mmdb.gz
./gdprscan -domain example.com -geoip-country-db ./dbip-country-lite.mmdb

Without the flag the scan still runs; IP addresses are reported without country/organization attribution.

Design principles

• Go standard library first: exactly two dependencies (golang.org/x/net for HTML parsing and the public-suffix list, maxminddb-golang for offline GeoIP).
• Local CLI only: no daemon, no listening sockets, no telemetry, no stored credentials, nothing phones home.
• Polite scanning: sequential requests, at most 20 requests and 5 redirects per scan, GET/HEAD only, configurable User-Agent.
• The scanner's own HTTP client always uses modern TLS defaults; weak TLS on targets is inspected, never adopted.

License and commercial use

This repository is source-available for review; all rights reserved.

The tool is offered under white-label license to web agencies and GDPR/DPO consultancies that want a ready-made technical audit deliverable to complement their legal work.

Contact: info@ilion.info (Ilion Web Solutions).