Open source · Apache-2.0 · Self-hosted
Monitor SSL + GDPR compliance for every website you own
SSL expiry, privacy policy, Impressum, cookie banners and trackers, checked on a schedule across every site you own. Run it on your own server.
Nabu Watch is a project you deploy yourself. There is no hosted service.
→ Cookie banner lacks a visible reject/decline button. Users must be able to reject non-essential cookies as easily as accepting them (GDPR Art. 7).
→ No Impressum page found. It is legally required for commercial websites in DE/AT/CH under TMG §5 and must include company name, address, and contact info.
→ 2 third-party trackers detected (Google Analytics, Meta Pixel) but not disclosed in the Privacy Policy. GDPR Art. 13 requires listing all data recipients.
→ Content quality score: 82/100. Privacy Policy and Terms of Service are well-structured and cover the required GDPR disclosure elements.
Sample output with made-up domains.
Features
Everything you need for compliance
One tool to monitor your websites' legal and security compliance, running on your own infrastructure.
SSL Monitoring
Get alerts before your SSL certificate expires. Never let a lapsed cert take your site offline.
Legal Document Detection
Automatically finds Privacy Policy, Terms of Service, Impressum, and more across your site.
Cookie Banner Compliance
Verifies GDPR-compliant consent banners with working accept and reject options.
Optional AI Content Analysis
Add your own Claude or Gemini API key to let the scanner verify legal pages and cookie banners with AI, and a Gemini key for fix suggestions on security findings. Everything else works without them.
Screenshot Evidence
Visual proof of compliance status, timestamped and stored in your own object storage for audit trails.
Multi-Region Support
13 regions with native-language keyword detection for localised compliance checking.
Status Override
Manually accept scan results you consider valid. Future scans with the same result inherit your decision.
Security Audit
7 security checks, gated by ownership proof
An audit suite on top of compliance monitoring. The checks are owner-triggered and gated by DNS-TXT ownership proof, so nobody can point them at a site they do not control.
Verified-only · DNS-TXT ownership check
Security Headers
CSP, HSTS, X-Frame-Options and friends. Audit the full browser-hardening set.
Exposed Files
Probes .env, .git, backup archives and 20+ other leak-prone paths.
TLS Grade
Protocol version, cipher suite and certificate chain, graded SSL Labs style.
DNS Hygiene
SPF, DMARC, DKIM and CAA records: email-spoofing and misissuance exposure.
Open Ports
TCP probe of FTP, SSH, database and alt-HTTP ports that should not be public.
JS Library CVE
Scans third-party scripts against known-vulnerable versions (jQuery, Bootstrap, Lodash and more).
Typosquat Watch
Permutes your domain and flags registered look-alikes that could be used for phishing.
Every scan requires an active DNS-TXT verification on the domain. No way to weaponise it against a third party.
These checks never run on a schedule. They go off only when the verified owner clicks Run scan.
The source code is public, so you can read exactly what runs against your domain.
How It Works
Up and running in minutes
- 1
Deploy it
Clone the repository and start the Docker Compose stack, then run the scanner worker on the host.
- 2
Add your websites
Enter each URL and pick a target region. The scheduler queues scans automatically.
- 3
Review the results
See compliance status, fix issues, and keep screenshot evidence for your records.
Self-host
Run it on your own server
The whole stack is open source and ships as a Docker Compose file.
$ git clone https://github.com/SNebiyev/nabu-watch.git
$ cd nabu-watch
$ cp .env.example .env
$ docker compose -f docker-compose.prod.yml up -dThe Go scanner worker runs on the host next to Chrome, outside Docker. See the architecture page for how the pieces fit together.
Architecture Docs overview Source
Use it responsibly. Read the responsible use guidelines before scanning sites you do not own.
At a glance
13
Regions
8
Monitor types
7
Security checks
Apache-2.0
License
Ready to secure your compliance?
Nabu Watch is free and open source (Apache-2.0). Clone it, self-host it, and make it yours.
FAQ
Common questions
Is there a hosted version of Nabu Watch?
No. Nabu Watch is open source (Apache-2.0) and self-hosted only. You run the API, UI, database and scanner worker on your own server.
What do I need to run it?
A Linux host with Docker Compose for the stack (reverse proxy, UI, API, PostgreSQL, Redis, MinIO). The Go scanner worker runs on the host as a systemd service because it needs a Chrome binary. The docs describe the full setup.
Which regions and laws does it cover?
GDPR (EU/EEA), Germany TMG §5 (Impressum), UK GDPR + PECR, Switzerland nDSG, and ePrivacy variants across DE / FR / ES / IT / NL / PL. SSL checks are region-agnostic.
How are cookie banners scanned?
The worker loads the page in a real browser, accepts and rejects the banner programmatically, and verifies that no third-party cookies are dropped before consent. It recognises the most common consent platforms such as OneTrust, Cookiebot, Usercentrics and Iubenda.
Where is my data stored?
On your own infrastructure. Scan results live in your PostgreSQL database and screenshots in your MinIO bucket. If you enable the optional AI analysis, page text is sent to the AI provider you configured (Claude or Gemini) with your key.
Can I export findings or hook them into my own tooling?
Yes. Outbound webhooks fire for scan results and status changes, so you can feed compliance data into Slack, PagerDuty, Linear or your own dashboard.
How accurate is the AI policy review?
The AI is a guide, not a lawyer. It flags clauses that are missing or vague and points you to the relevant GDPR / TMG article. Run material findings past your privacy counsel before publishing changes.