Gevox

Free. No signup for the score.

Scan any website against the DPDP Act.

The same deterministic engine that runs inside every Gevox client workspace. Twenty-two checks on every scan across notice, consent, security safeguards, processors, privacy contact and cross-border transfers, each finding cited to its section. Five more run on a site that serves children, where Section 9 applies. The same site gets the same answer, every time.

What is examined

Twenty-two checks run on every scan. Three more appear when there is something to report, such as a cookie that outlives a year or a form asking for a government identifier. Five more run on a site that serves children, where Section 9 applies and prohibits targeted advertising outright.

Notice and consentSection 5, Rule 3, Section 6
Withdrawal as easy as givingSection 6(4)
Cookies, with their lifetimes and flagsSection 6, Section 8(7)
Storage that is not a cookieSection 6(1)
Device fingerprintingSection 6(1)
Session recording and keystroke captureSection 6(1)
Security safeguards and headersSection 8(5), Rule 6
Processors receiving dataSection 8(2)
Privacy contact publishedSection 8(9)
Rights routes a visitor can useSections 11 to 14
Cross-border transfersSection 16
Children's data, where it appliesSection 9, Rule 10

Deterministic

No language model decides a finding. Same inputs, same findings, same wording, every run. A scanner that refines with AI cannot promise that.

Cited to the section

Every gap names the provision of the Act it sits under and the Schedule band that applies.

It watches the page run

Most scanners read the markup. This one records the cookies, storage, fingerprinting and keystroke listeners a page actually uses.