Choose the coverage your website needs. Compare monitoring frequency, technical checks and human review. Every plan keeps findings and supporting evidence together.
Commercial scope
Agree what we monitor. Coverage Apex domains, subdomains, consent flows, trackers and exposed services. Cadence Monthly, weekly or daily monitoring depending on risk and operating model. Evidence Findings, supporting records and retest history. Signature and review status are shown where available. Legal basis GDPR, ePrivacy and NIS2 mapped to EU guidance and relevant local implementation. Plans
Monitoring that fits your team. Start with the domains you manage. Choose a cadence and the review support you need. Your proposal records the agreed scope.
Monthly monitoring · core
Essentials Monthly monitoring for a single website.
Evidence Evidence and review status Governance Guided remediation Monthly automated scan of 1 apex domain Cookies, consent, security headers and accessibility (WCAG) Privacy policy compared against actual site behavior Data transfers outside the EU tracked and flagged Compliance report with remediation guidance Privacy Monitored badge displayed on your site — publicly verifiable Email support within 24 hours For a recurring view of privacy, accessibility and security findings.
Book demo Most popular Weekly monitoring · deep
Professional Weekly monitoring with deeper checks and human review.
Evidence Evidence and review status Governance Guided remediation Weekly automated scan of 1 apex domain Everything in Essentials, plus deeper security and tracking analysis Full-depth analysis across our scanning platform — security, tracking, forms, fingerprinting and exposed-service discovery Hardcoded passwords and keys in your site code detected New subdomains discovered and risk-ranked NIS2 mapped to relevant EU and national implementation requirements Manual expert verification of low-confidence findings Retest reported fixes and keep the verification history For teams that need to investigate and follow up changes.
Book demo Weekly monitoring · custom
Enterprise Wider coverage with review and dedicated support.
Evidence Evidence and review status Governance Dedicated support Weekly automated monitoring across up to 5 apex domains — wider footprint All scan areas active across our scanning platform: cookies, consent, policies, security headers and accessibility Deep technical checks: forms, fingerprinting, data residency and CNAME tracking Subdomain discovery and risk ranking for assets under your control Manual expert verification of low-confidence findings by a Vakteye analyst Dedicated customer success contact for critical-finding follow-up Custom compliance roadmap and scan configuration support For organisations managing several domains and teams.
Get quote No list prices. Price set by how much you need watched and for how long. Demo and quote takes 30 minutes.Why no list prices?
Enterprise readiness
Built for legal, security and procurement review Pricing is scoped because the risk surface differs by footprint, cadence, legal exposure and required assurance. The buying package is designed to be reviewed by more than one team.
DPA-ready Data processing terms, sub-processor categories and retention expectations are available during commercial review.
Processing locations Review the published subprocessor information and request the current named schedule and processing details for your scope.
Evidence chain Findings are backed by browser behavior, network observations, timestamps and source references.
Security review support Security teams can review scan scope, evidence handling and operational controls before activation.
Named operating model Enterprise scope can include named contacts, critical-finding SLAs and review cadence.
EU-wide legal mapping Findings are grounded in GDPR, ePrivacy, EDPB guidance, NIS2 and relevant national implementation.
What you don't get from CMP vendors
OneTrust, CookieBot and Cookiebanner.com manage consent. We check it works — the reject button gets tested for real, cookies before consent are caught and the Meta Pixel gets reviewed. Vakteye is a complement, not a replacement.
What's included
What we test The commercial tiers scale the same core evidence model: observed browser behavior, legal mapping, remediation context and repeat monitoring. Open any capability for the detailed test logic.
Consent & privacy GDPR · ePrivacy · LEK ch. 9
Cookie consent and tracker detection Identifies every cookie — tracking, analytics, advertising. Classifies against a tracker database of 400,000+ tracker domains and checks Secure/HttpOnly/SameSite flags. Detects cookies set before consent. Legal basis: ePrivacy Art 5(3), LEK ch. 9 §28.
Reject button is actually tested Clicks 'Reject' and checks whether tracking cookies are set anyway. Detects dark patterns, pre-checked boxes and non-functional buttons. Includes zombie-cookie detection (cookies that respawn after deletion). Legal basis: ePrivacy Art 5(3), GDPR Art 6(1)(a) and Art 7. Reference: EDPB Cookie Banner Taskforce report (2023).
Privacy policy against GDPR Art 13 Checks every mandatory section: legal basis, retention period, third parties, data-subject rights, DPO contact. Each gap is tied to the article it sits under. Legal basis: GDPR Art 13.
Policy vs practice — contradictions Compares what your privacy policy promises against what the site does. Catches things like 'We use no third-party cookies' while tracking still runs. Legal basis: GDPR Art 5(1)(a) transparency, Art 13 information duty.
Hidden tracking and session replay Detects canvas, WebGL and audio fingerprinting. Catches session-replay tools that record visitor behaviour without consent. Legal basis: ePrivacy Art 5(3) device access.
US transfers (Schrems II / DPF) Maps third-country transfers. Flags US recipients without DPF certification. Checks that adequate safeguards are in place (SCC, adequacy decisions). Legal basis: GDPR Art 44–49.
Security NIS2 and GDPR Art 32
Security headers and TLS configuration Checks security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy, COOP/COEP). Analyses TLS configuration, certificate validity and cipher strength. Legal basis: GDPR Art 32, NIS2 Art 21(2)(e) (network/information-systems security, for headers) and Art 21(2)(h) (cryptography, for TLS).
Known vulnerabilities (CVE) and exposed libraries Passive vulnerability scanning with continuously updated templates: CVEs, vulnerable JavaScript libraries, exposed admin panels, and missing security controls. Vakteye never sends active injection probes (SQL injection, Cross-Site Scripting, CSRF) — detection is passive in every tier, and no add-on changes that. Legal basis: NIS2 Art 21(2)(e) system acquisition and vulnerability handling.
Services exposed on the internet Surfaces services and admin panels reachable from the internet, plus subdomain-takeover risk against known cloud providers, from passive discovery and DNS records. No port scanning is performed. Legal basis: GDPR Art 32(1)(b), NIS2 Art 21(2)(e) vulnerability handling.
Hardcoded secrets in client-side JavaScript API keys, cloud credentials, payment-provider keys and private keys that ended up in frontend code are caught via a vendor rule library and issuer-prefix detection. Legal basis: GDPR Art 32, NIS2 Art 21(2)(e) vulnerability handling.
Accessibility per WCAG 2.1 AA Contrast, alt text, form labels, keyboard navigation and ARIA attributes get reviewed automatically. You get a remediation suggestion per finding. Mapping: European Accessibility Act obligations where applicable, national accessibility law, and WCAG 2.1 AA as a practical testing baseline.
Evidence and reporting GDPR Art 5(2) burden of proof
Continuous monitoring, not one-off audit Scan frequency follows your plan — monthly or weekly. You get a notification on new findings. Compliance status stays up to date in your dashboard. Legal basis: GDPR Art 5(2) burden of proof.
Human verification of lower-confidence findings Lower-confidence findings go to a review queue and are labeled awaiting verification; they are not presented as confirmed until an analyst reviews them. High-confidence findings have machine-checkable proof and publish directly. Confidence level (CERTAIN/FIRM/TENTATIVE) is shown on every finding.
Reports for board, IT and DPIA evidence Compliance reports with the legal basis on every finding. Executive summary for the board, detailed technical report for IT, and a DPIA-ready package your DPO can use. Each gap ties back to GDPR, ePrivacy, NIS2 or relevant national implementation.
Privacy Monitored badge with public verification A VKT record number (VKT-XXXX-XXXXXX) is issued after a passing scan. Trust badge embedded via JS widget or SVG. Anti-theft: badge renders only on the verified monitored domain. Publicly verifiable via /verify/[record-no]. Valid 90 days from each passing scan, renewed as further scans pass review. Maps to GDPR Art. 5(2) accountability evidence.
Forensic evidence package Browser recording, network log and timeline of cookie behaviour before and after consent. Downloadable zip with an integrity check so you can show the material has not been altered.
Buying process
From scope review to evidence pack A serious buying path without turning the first call into a sales deck.
Scope review We map domains, monitoring cadence, legal exposure and the teams that need the evidence.
Live evidence scan We scan live pages during the call and show what the browser actually sends.
Quote and DPA You receive a scoped plan, commercial proposal and procurement material.
Activation Domain verification, first production scan, evidence pack and verified badge.
Ready when you are. Bring your website address. We review the scope, walk through the findings and discuss a plan that fits.
Book demo VAKTEYE Independent digital compliance monitoring for privacy, accessibility and security. Evidence, human review and retest results in one place.
Book demo Monitored by Vakteye PRODUCT COMPANY LEGAL Contact © 2026 Vakteye. All rights reserved.