See the security surface your customers see first.

No. SOC 2 is an attestation from a licensed CPA firm covering process and internal controls, most of which is not visible from outside your systems. Trufend checks the externally visible slice and is explicit about not being a certification.

Ten security checks and thirteen SEO checks on whatever your domain publishes to the open internet: TLS and certificate setup, HTTP security headers, DNS and email authentication, exposed subdomains, cookie flags, leaked secrets, third-party scripts, CORS, tech fingerprinting, and edge and MFA signals, plus titles, meta descriptions, headings, canonicals, schema and the rest of the on-page set.

Yes. Every scan runs both and returns them side by side with their own grades, because the same public page is the evidence for both. The SEO side covers the on-page basics a search engine reads: title, meta description, H1, heading order, canonical, robots directives, viewport, language, structured data, social tags, image alt text and content depth.

Data isolation, backups and restore testing, access governance, engineering process, incident response and vendor management. Those live inside your systems, policies and contracts, and no scan of your domain can confirm them. That is roughly eighty percent of what a readiness review asks about, which is why the report separates the two.

Yes. The external check is free, with no account and no card. It is built as an honest first step toward the parts a public scan cannot reach, not as a replacement for one.

Yes. Everything the scan reads is already published to anyone who asks for it, which is the point: it shows what a stranger, a customer or a competitor can see about a domain without any special access.

It should not. A scan is passive: it requests your public pages and DNS records the way an ordinary visitor or search engine would, a handful of requests in total. Nothing is logged into, no payloads are sent and nothing is changed.

The report is cached for an hour so a repeat check of the same domain returns the same result rather than re-scanning. The public scan counter keeps a short hash of the domain so one domain is not counted twice, and a rate-limit file named after a hash of your IP address expires after ten minutes. No domains in the clear and no accounts. The domain you check is never sent to our analytics, which is separate, optional and covered in the privacy policy.

After any infrastructure change, such as a new subdomain, a certificate renewal or a new third-party script, and periodically between them. DNS, TLS and third-party configuration drift even when the application itself has not changed.