Know what is wrong with your appbefore a regulator does.

Vespez checks your web app for security and GDPR issues the way an auditor would, and scans it again after every deploy.

  • Your first scan is free
  • No credit card
  • Results in about a minute
vespez.com/scan/shop.northwind.dev

Security score

7010 lowerout of 100, fair

Compliance score

3012 lowerout of 100, poor

Needs attention

  • Critical
    Stripe secret key exposed in JavaScriptFound in /assets/checkout.js
  • Critical
    Trackers load before consentMeta Pixel and Google Analytics
  • Warning
    Privacy policy does not state a retention periodChecked against /privacy

Two scores, every finding in full, and a fix for each one. A scan takes about a minute.

Apps ship fast. Compliance does not keep up.

These are the default state of most apps built quickly, and the same rules apply to a small app from its first EU visitor.

Analytics that load before consent are a GDPR violation.

Networkshop.northwind.dev
   0 ms   GET /                               200  42 ms   GET /assets/index.css               200  84 ms   GET googletagmanager.com/gtag/js    200 1.2 s    Cookie banner shown
Tracking started 1.1 seconds before the visitor could refuse.

A secret key in the frontend is someone else's bill.

index-4f2a9c.jspublic bundle
import { loadStripe } from "@stripe/stripe-js" const stripe = new Stripe(  "sk_live_51Hx8K…q9fQ2")
Readable by anyone who opens the browser's developer tools.

No privacy policy means exposure from the first EU user.

Terminalzsh
$ curl -I https://shop.northwind.dev/privacyHTTP/2 404content-type: text/htmlx-powered-by: Next.js
No privacy policy is linked anywhere on the site.

From a URL to a fixed app, in three steps.

  1. 1

    Enter your URL

    Vespez loads your real site in a browser: the rendered page, its scripts, its headers and your policy pages.

  2. 2

    Read your report

    A security score, a compliance score, and specific findings, each with the evidence and how to fix it.

  3. 3

    Stay compliant

    Connect GitHub, Netlify or Vercel. Vespez scans again after every deploy and emails you when something changes.

What a scan covers

  • Secret keys in JavaScript
  • Trackers before consent
  • Cookie consent banner
  • Privacy policy and what it leaves out
  • Security headers
  • HTTPS and HSTS
  • Source maps in production
  • Terms of service
  • Who is responsible for the data
  • How email addresses are used

Built to run in the background.

Continuous monitoring

Vespez scans your app again after every deploy. There are no manual checks to remember: you receive an email when a score drops or a critical issue appears.

  • Deploy 2142 minutes ago1 new finding, email sent
  • Deploy 213YesterdayNo changes
  • Manual scan2 days ago2 findings resolved
  • Deploy 2123 days agoNo changes

Fixes in code

Each finding comes with a fix you can copy into your project.

layout.tsxsuggested fix
<script src="gtag.js?id=G-7QX" />onConsent("analytics", () => {  loadScript("gtag.js?id=G-7QX")})

Score history

Every scan is saved, so you can see the scores rise as issues are fixed.

Regulatory tracking

Every day Vespez reads new decisions and guidance from the EDPB and national data protection authorities, and tells you when one matches what your site uses.

CNIL
Sanction for placing advertising cookies without consentMatched shop.northwind.dev because the site uses Meta Pixel. Always linked to the official source.

Share a report with a client

Create a private link to any report. The person you send it to does not need an account.

Simple pricing. Start free.

Free

$0forever

Account required, no card needed

  • 1 scan per month
  • All findings visible
  • Security + compliance scores
  • Plain-language fix suggestions
  • Scan history
  • No continuous monitoring
Start free

Pro

$19/ month

or $180/year, save 21%

  • Unlimited scans
  • Automatic re-scan after every deploy
  • Up to 5 monitored sites
  • Email alerts when something changes
  • Code-level fix suggestions
  • Regulatory tracking, checked daily
  • Score history over time
  • Client sharing via private link
Get Pro

All payments are non-refundable. Cancel anytime.

Vespez identifies likely issues. It is not legal advice.

See your app the way a regulator would.

Enter a URL and receive the full security and compliance report.

Free to try. See pricing