Security & Data Integrity

01

Deterministic analysis, no AI model

Every check is ordinary code: the HTML each page returns is parsed, and fixed rules score it. Nothing you scan is sent to an AI service, and nothing is used to train a model.

The same HTML always produces the same score and the same Fix Kit, so a re-scan measures your change, not a model’s mood.

02

Non-intrusive requests

Each page is fetched with a single HTTP GET, exactly as a non-rendering AI crawler would fetch it. There is no headless browser, so none of your JavaScript runs.

It never logs in, submits a form, sends cookies or changes anything on your site. A page behind a login is simply recorded as unreachable.

Audits run only when someone asks for one: at most 40 pages, 4 connections at a time, and a hard 45-second limit.

03

An identifiable crawler you can opt out of

Every request carries the CrawlableBot user agent and a link to the page describing it. It does not rotate user agents or pretend to be a browser.

A robots.txt group naming CrawlableBot with Disallow: / stops every audit of your site before any page is fetched; the only request made is for robots.txt itself.

A wildcard Disallow does not stop it, and it does not apply Crawl-delay: seeing what happens to a site that blocks crawlers is the diagnosis, and an audit is a short, on-demand burst, not a recurring crawl.

The user agent every request sends:

CrawlableBot/1.0 (+https://usecrawlable.com/bot; AI-readability auditor)

To opt out, add this to your robots.txt:

User-agent: CrawlableBot
Disallow: /

04

Short retention, payments off our servers

Free scan reports are deleted 30 days after the scan, by a job that runs daily.

Paid reports are kept for 24 months so you can compare before and after, and are deleted on request at any time.

Payments are handled by Lemon Squeezy as merchant of record. You enter card details on their checkout, so they never reach our servers.