Vendor security monitoring
If you have seen requests from GDS-Monitor in your logs, they came from us. The scanner reads publicly available information about how an organisation’s internet-facing systems are secured, so that our clients can assess the suppliers they rely on. It collects only what those systems make publicly available, and it never tries to get past a login or exploit a weakness.
Why it exists
GDS Analytics provides data protection officer and information security services to schools and businesses. Under Article 28 of the UK GDPR, our clients must use only processors that provide sufficient guarantees about the security of personal data, and many of them assess those suppliers through a data protection impact assessment.
The scanner gives those assessments a dated, consistent view of each supplier’s external security, and tells us when something changes. A qualified data protection officer reviews what it finds before any client sees it.
What it collects
The scanner looks only at the organisation’s main domain and the hosts that serve its public website.
| Area | What we look at | How |
|---|---|---|
| Email security | SPF, DMARC, DKIM, MTA-STS, TLS reporting and BIMI records, for example _dmarc.example.com | Public DNS lookups |
| Website and encryption | Certificate validity and expiry, which TLS versions are accepted, the redirect to HTTPS, and HSTS | Standard TLS connections and ordinary HTTPS requests |
| Security headers | Response headers and cookie flags on the home page | One ordinary HTTPS request per host |
| Domain settings | DNSSEC, CAA records, registration expiry and registrar lock | Public DNS and RDAP registration data |
| Exposed services | Services visible on the organisation’s public addresses, and the software versions they report | Shodan’s index, and scans we ask Shodan to run on the organisation’s public addresses (see below) |
| Published documents | Privacy notice, data processing terms, sub-processor list, certifications mentioned and security.txt | Links followed from the public home page |
Third-party data
Some of our findings about exposed services come from Shodan, an independent search engine that continuously records what internet-connected systems make publicly visible. GDS Analytics holds a commercial licence to use this data, and our results say when a finding is based on it.
Most of this data comes from Shodan’s routine coverage of the whole internet. Once a week, we also ask Shodan to refresh its view of the public addresses that belong to the organisations we assess. Shodan runs these scans from its own systems: they connect to common service ports and record the information each service presents to any visitor, such as its name and version. They do not attempt to log in, guess passwords or exploit anything, and because they come from Shodan they do not carry the GDS-Monitor user agent.
Questions about Shodan’s routine scanning should go to Shodan. If you think a finding we have drawn from Shodan data is out of date, tell us and we will review it in the same way as any other finding.
We may add further licensed data sources over time. When we do, we will name them on this page, and the limits below will apply to the scanner and to every scan we request.
What it never does
These limits apply to the scanner and to any scan we ask Shodan to run. They keep our work within the Computer Misuse Act 1990 and within what any organisation exposed to the internet can reasonably expect.
/privacy and /.well-known/security.txtHow results are used
Results are shared only with GDS Analytics clients who use, or are considering using, the organisation concerned, and only after our review. Each result is tied to the date of the scan and to a published scoring method, so it can always be explained.
Where we publish a summary assessment of a supplier on our website, it contains our own commentary and the date of the assessment. We do not publish scores.
If this is your organisation
Correct a finding
If a finding is inaccurate or out of date, write to us with the domain and the finding concerned. We will review it and reply within 10 working days, and correct our records where you are right. You are also welcome to send evidence, such as a certification or a published policy, for us to take into account.
Opt out
Ask us and we will stop the scanner sending requests to your systems, and stop requesting Shodan scans of your addresses, within 5 working days. Our clients may still need to assess you as a supplier, so we may continue to rely on information you publish and on licensed data sources such as Shodan.
Personal data
The scanner is not designed to collect personal data, but public records and licensed data sometimes contain it, such as a named contact in domain registration data or an individual’s email address in a DNS record. We keep only what an assessment needs, rely on legitimate interests under Article 6(1)(f) of the UK GDPR, and keep results only for as long as a client’s assessment relies on them.
Our privacy notice explains your rights, including the right to object. Write to dpo@gdsanalytics.co.uk to exercise them.
© 2026 GDS Analytics. All rights reserved.