Eleven things we kept rebuilding by hand, made properly and given away, grouped by what you are trying to do. Each one runs entirely in your browser. No account, no upload, and nothing you type is transmitted to us or to anyone else.
You bring a domain and a few answers. You leave with configuration to paste into your DNS or your server.
Build valid SPF, DMARC and CAA records for your domain, with a live count against the ten-lookup SPF limit.
You needYour domain, and who sends mail for you HTTP headersGenerate HTTP security header config for Apache, nginx, Caddy, Cloudflare, Netlify or IIS, with warnings on the settings that can break a site.
You needYour domain, and which web server you run Content Security PolicyBuild a Content-Security-Policy from what your site actually loads, or paste an existing one and have it explained in plain English.
You needWhat your pages load, or a policy you already haveYou bring a file your own systems already produce. You leave knowing something you did not know when you opened it, and none of it is uploaded.
See which crawlers fetch your site, what they waste time on and what fails for them. Reads Apache and nginx logs in your browser. No upload, no account, no line limit.
You needAn access log from your server, gzipped is fine Access governanceRun the quarterly access review an auditor asks for. Drop in a user export from Google Workspace, Microsoft 365, GitHub, Okta or AWS, decide on each account, and export dated evidence. Nothing is uploaded.
You needA user export from Workspace, Microsoft 365, GitHub or AWS Access governanceSee which third-party apps hold Gmail access, full Drive or directory write, and how many staff granted them. Reads an export from your admin console in the browser. Nothing installed, nothing uploaded.
You needA connected apps export from your admin consoleYou bring what is already in your head. You leave with the document a customer, an auditor or a bad afternoon is going to ask you for.
Answer a dozen questions and get a one-page incident response plan you can save, print and hand to an auditor. Runs entirely in your browser.
You needFifteen answers, and about ten minutes ProcessList every vendor that touches your customer data, track which have signed DPAs, and export as CSV or Markdown. Runs entirely in your browser.
You needThe list of who touches your data, or the start of one ProcessBuild the GDPR Article 30 record of processing from a library of common activities rather than a blank spreadsheet. Nothing is uploaded.
You needWhat you do with personal data, and who you send it to AnswerKeep your standard security answers once, drop in a customer's questionnaire, and get it filled with the gaps flagged. Reads Excel in your browser. Nothing is uploaded.
You needThe questionnaire a customer sent you, as it arrived PublishTurn your security answers into a trust page you host on your own domain. One HTML file, no account, no subscription. Built in your browser and never uploaded.
You needYour answer library, and somewhere on your domain to put it