What SCADABLE is

We read your code and tell you what your privacy policy gets wrong. Your policy is a set of factual claims about where your users' data goes, and those claims drift the moment somebody adds a dependency. We compare the two on every push and show you the disagreements, each one citing the file in your repository and the sentence in your published document that contradicts it.

What problem is this actually solving?

A privacy policy is not a legal document in the way people assume. Most of it is a set of factual claims about your system: who receives personal data, where it is stored, how long it is kept, whether automated decisions are made.

Those claims go stale silently. An engineer adds an analytics SDK on a Tuesday and the policy that says you use no third-party analytics is now false, in public, on your own website. Nobody is notified, because nobody is watching the two things at once.

Every tool in this category handles that half by asking you and believing the answer. A questionnaire, once a year, answered by whoever has time. We check instead.

How is that different from a compliance platform?

Their product is a to-do list for you. Ours is the absence of one.

Vanta, Drata, Secureframe and the rest connect, monitor, flag, and hand you a checklist plus your own labour. Look at any of their dashboards and the information architecture tells you who they think does the work: a percent-complete ring and a queue of jobs assigned to the customer.

That is the honest org chart of a product, and theirs says you are the worker.

What does it actually check?

The free tier runs a deterministic scan on every push. No model, no guessing, no network: it reads your dependency manifests and config, resolves them against a closed registry of vendors whose packages necessarily send data to a third party, and compares that against the text your published policy actually contains.

It finds the gap where your code says one thing and your document says another. An LLM SDK present with no AI processor disclosed. A payment processor, an email vendor or an analytics library in the manifest and absent from the page.

It deliberately does not guess. When it is unsure, it produces nothing. A false finding tells you your lawyer-reviewed document is wrong when it is not, and that costs more than a missed one.

What do I get for free, and what do I pay for?

Free tells you. Paid keeps it right.

Free is the diagnostic: your documents drafted, hosted at a permanent address, and scanned against your code on every push forever. When something disagrees, we say so, with receipts.

Paid is the therapeutic: an agent reads what your code actually does with data, which is the half no scanner can see, and proposes the revision. You approve a diff. Your published policy tracks reality.

The action on a free finding is to upgrade, not to go and fix it yourself. If we ever hand you remediation steps and call it a feature, we have become the thing described two sections up.

Is this legal advice?

No, and it is not sold as any. We report what your code says and what your document says, and where the two disagree. What that means for your obligations is a question for a lawyer, and we never claim otherwise.

We also never say "compliant". A document that matches your system is a document that matches your system.

Frequently asked

Do you need write access to my repository?
No. Reading is read-only. The one thing we ever write is a pull request landing the integration snippet, and you merge it or you do not.

What happens to my documents if I stop paying?
They keep serving, permanently. Your website links to that address, and taking a legal document offline over a subscription would turn a billing event into your outage. Cancelling stops the updating. It never stops the serving.

Does my code leave my repository?
Part of it does, and the Trust section says exactly which part, where it goes, and who else sees it. That page exists because we would fail our own scan if it did not.