About our scanner

Sasquatch Privacy is a website privacy scanner run by SaaSquatch Lab LLC. It loads web pages in a real browser to record what they share with third parties, before and after a visitor responds to the consent banner. This page is for the people who run those websites.

What it does

• Loads pages in headless Chromium from AWS in five regions (us-west-2, us-west-1, us-east-1, eu-central-1, eu-west-2), because consent banners differ by visitor location.
• Records which hosts a page contacts, which cookies and storage keys it sets, and how that changes before consent, after “Accept all”, after “Reject all”, and with the Global Privacy Control signal. It clicks only the consent controls the site itself shows.
• Runs one scan at a time per site: jobs for the same registrable domain are queued, never run in parallel.
• A paid audit crawls up to its page limit and obeys robots.txt. Its discovery requests wait at least 250 ms apart, or your Crawl-delay up to 10 seconds. It follows the * group, or a SasquatchPrivacy group when you add one. Free scans and monitoring load the page they were given and same-site links one hop from it, and do not read robots.txt.

What it does not do

• It does not try to get past bot protection on a site whose owner has not asked it to. No stealth browser patches, no CAPTCHA solving, no residential proxies. When a bot manager blocks a page load, the result says so (“bot protection blocked N of M page loads”), excludes it from scoring, and shows “Incomplete” instead of a score when most loads were blocked. The one exception is a site’s verified owner, who can switch on advanced options for their own site only: a less detectable browser, a proxy they supply, or a CAPTCHA solving service they supply. Those options are off by default and every result that used one says so.
• It does not record full URLs (only host and a hash of the path) or the values of cookies and storage (only their names).
• It reports observations. It is not a legal assessment of your site, and its results are not legal advice.

How to recognise it

• User-Agent. Scans a site’s verified owner has authorised add SasquatchPrivacyScanner/1.0 (+https://sasquatchprivacy.com/scanner) to a Chrome User-Agent. Other scans present an ordinary Chrome User-Agent, because consent platforms commonly show automated visitors a different experience, and a scan of that experience would not describe what your visitors get.
• Owner-authorised header. When a site’s verified owner enables scanner access, every request we send to that site’s own hosts carries X-Sasquatch-Scan: <secret>. The value is different for every domain and known only to that domain’s owner and to us. It is never sent to third-party hosts a page loads.
• Source addresses. We have not published fixed addresses yet. Scans leave from AWS’s shared address ranges in the regions above, so an IP address alone does not identify us.
• Signed requests. Owner-authorised scans are signed with HTTP Message Signatures (RFC 9421) following the IETF Web Bot Auth drafts: Ed25519, tag="web-bot-auth", with a Signature-Agent header pointing to https://sasquatchprivacy.com. Our public keys are at https://sasquatchprivacy.com/.well-known/http-message-signatures-directory, and that response is itself signed (tag="http-message-signatures-directory"). Current key IDs (JWK thumbprints): MXi4wwyakyLV5oqbAoCGMRRxw7XFCA6LCtQwuvCHR9U.

How to let it through

Only a site’s owner can do this, and only for their own site. Add the domain in a Sasquatch Privacy account, prove you control it with a DNS record or a file, and turn on scanner access. The Domains page then gives your security team the exact allow rule for your bot manager — Cloudflare, Akamai, HUMAN, DataDome, Imperva, Fastly, Kasada or AWS WAF — matching the secret header value, and a one-click test that shows whether the rule works. The same page can check, before you set anything up, whether we are blocked at all and by which product.

A rule that only checks the header is present lets anyone in: always match the exact value. You can rotate or revoke the value at any time, and it stops working immediately.

How to block it or report a problem

• To stop audit crawls, add a User-agent: SasquatchPrivacy group with Disallow: / to robots.txt. This does not stop a free scan of a single page someone submits, which loads like a person visiting.
• To report abuse or a scan that caused you trouble, or to ask us not to scan your site, contact Saasquatch Labs support or privacyinfo@saasquatchlab.com. Include the time of the requests and your domain. Security reports follow our disclosure policy (machine-readable at /.well-known/security.txt).