Online website inspection for cross-border font calls, third-party trackers, and cookie hygiene
Loading fonts, scripts, or captcha widgets from overseas servers exposes visitor network metadata immediately upon page open. Even before a user interacts with the interface, the browser sends device headers across national borders. This passive scanner inspects the initial homepage response and highlights hidden third-party calls, unguarded cookies, and missing statutory disclosures.
Set-Cookie headers, and public privacy links without modifying the target site.Inspect Raw JSON API Response & Ledger Entry
{}1. Passive homepage privacy and cross-border transfer inspection
Inspection of the initial HTML document and HTTP response headers: detects external font hosts, foreign analytics tags, public script CDN links, pre-consent cookies, and statutory privacy documents.
2. Seven technical privacy risks visible to external supervisory scanners
Supervisory authorities now inspect corporate websites with automated crawlers without waiting for individual complaints. Under Federal Law No. 152-FZ of July 27, 2006 on Personal Data, cross-border transfer requires prior regulatory notice and explicit legal grounds. Embedding external font stylesheets or foreign captcha scripts sends visitor connection metadata directly to servers outside the national jurisdiction.
A second frequent violation occurs when a web server emits tracking Set-Cookie headers or fires telemetry scripts on initial page load before the visitor has expressed informed consent. Even when a privacy notice exists somewhere on the site, omitting direct links to the privacy policy and consent terms beside lead-capture forms creates administrative exposure.
The scanner parses raw homepage markup and response headers across seven deterministic privacy rules in a single pass. Those checks cover transport encryption, external fonts, foreign tag managers, public script libraries, cookie flags, consent gating, and statutory notices.
3. Technical localization and audit logging package
Removing technical leaks requires self-hosting .woff2 font subsets on the origin server, vendoring JavaScript bundles locally, gating analytics behind an explicit opt-in banner, and aligning privacy notices with actual data flows. Perimeter localization pilots and cryptographic Streebog-256 logging packages for corporate operators are delivered at isslab.ru and via the pilot request contour below.
4. Engineering reference notes for verifier TOOL-152-02
Cross-border personal data exposure caused by external web font servers
Fetching a font file from an external server transmits the visitor's IP address, browser fingerprint, and referrer URL to a third-party infrastructure provider prior to any user consent.
Scope boundary between homepage inspection and full operator compliance
The express scanner inspects only public technical markers on the root page; complete compliance also requires internal database localization, operator registry filings, and verified consent records.
Enterprise pilot packages and air-gapped delivery
Perimeter posture, transport security & localization
Streebog-256 verification passport.Air-gapped interface verification (indra-core)
OpenAPI schemas and an isolated staging container as input, delivering a thirty-class paired decoy assessment with zero false positives, compiled mcp-sentinel contracts, and a full ledger passport.Autonomous agent runtime gate (MITR)
mcp.json manifests and tool schemas as input, delivering compiled satisfiability policies and pre-socket parameter enforcement.Request the offline kit or schedule a pilot
--no-index --find-links) and standalone verifier scripts are provided for isolated laboratory testing and enterprise pilot evaluations. Submit a work email below without page reload or write directly to af@isslab.ai.
Institutional developer and platform operator
OGRN 1267700083617, INN 9731161602, KPP 773101001, 18 Davydkovskaya Street, Suite VIII, Moscow, 121352). Under the Security 3.0 research and engineering program, the institute develops and operates the MITR runtime action gateway and the INDRA verification stand, publishes the monograph Proven Action, and maintains open Apache-2.0 software packages with zero outside subcontractors.