Compliance Check Disclosures

1. What the compliance scan actually does

When you run or schedule a compliance scan, SREmonitor fetches the publicly available pages of the site you've asked us to check — primarily its privacy policy, cookie notice, and related pages that are linked from the site itself. We extract the text of those pages and pass it to an AI language model (OpenAI's GPT-4o mini), along with instructions to assess it against common UK GDPR and Data Protection Act 2018 concepts — for example, whether a lawful basis for processing is stated, whether data subject rights (like erasure and portability) are addressed, whether retention periods are specified, and how third-party sharing and cookies are disclosed.

The model returns a score out of 100 and a list of specific issues, each labelled critical, warning, or info, with a plain-language recommendation for how to address it.

2. Limitations you should know about

• It's an AI-generated assessment, not a legal opinion. Like any AI system, it can occasionally misread context, miss nuance, or generate an inaccurate or incomplete recommendation.
• It only reviews what's publicly published and linked.It can't see internal data-handling practices, contracts with processors, security controls, or anything not reflected in the text of your public pages.
• It doesn't audit your actual data practices.A page can score well because it says the right things, even if what actually happens behind the scenes doesn't match — and vice versa.
• Pages behind logins, or that require JavaScript rendering our scanner doesn't execute, may not be picked up, which can produce an incomplete or artificially low score.
• It doesn't replace a Data Protection Impact Assessment, a solicitor, or a qualified Data Protection Officer. For anything with real legal or regulatory weight, get advice from a qualified professional before relying on the result.

3. Core Web Vitals checks

Core Web Vitals (Largest Contentful Paint, Cumulative Layout Shift, Interaction to Next Paint, First Contentful Paint, and Time to First Byte) are measured by loading your page in an automated headless Chromium browser from our monitoring infrastructure, roughly once an hour for actively monitored sites. This is a "lab" measurement from a single vantage point at a single point in time — it can differ from the real-world "field" data Google shows in Search Console or the Chrome UX Report, which reflects your actual visitors across many devices, locations and network conditions.

4. Uptime and latency checks

Uptime and latency are measured by an automated request to your site roughly every 5 minutes from our monitoring infrastructure. A short outage that starts and ends between two checks may not be captured, and checks run from a limited set of vantage points rather than a global network, so results are a strong indicator of availability rather than an exhaustive record of every moment your site was reachable.

5. No guarantee of a regulatory outcome

A high compliance score, or the absence of a flagged issue, is not a guarantee that a site complies with any law, or that a regulator such as the UK Information Commissioner's Office would reach the same conclusion. Similarly, a flagged issue doesn't necessarily mean a site is in breach of the law — it means our automated check identified something worth a closer, human look.

6. Questions

If you're unsure how to interpret a result, or want to understand how a specific score was reached, contact us at legal@sremonitor.io. See also our Terms & Conditions and Privacy Policy.