A simple scan. Expert context.
Samtaro Security runs a quick, passive scan of your public website and email domain: HTTPS, security headers, trackers before consent, your privacy notice, exposed files, SPF/DKIM/DMARC and local SEO basics. The checks are simple and honest. The value is what comes with each finding: what it means for a Qatar or GCC business, why it matters in plain language, a practical fix, and a link to the official law or standard.
Automated scan of publicly visible website signals. Not legal advice, not a security audit or penetration test. Domains you own or are authorised to scan only.
Every finding comes with context
What it means
The finding in plain language, for a Qatar or GCC SME, not a security engineer.
Why it matters
The business impact: customer trust, email spoofing, regulator expectations, lost bookings.
Practical fix + official source
What to ask your developer or host to change, with a link to the official law text or standard (our sources).
Why this matters now
Qatar is enforcing the PDPPL
The National Data Privacy Office at NCSA has issued binding decisions after breaches. One, against an e-commerce company, concerned consent, data protection measures, data accuracy and oversight of processors (Qatar Tribune, Mar 2025). A second, against a sports company, followed in February 2026 (Qatar Tribune, Feb 2026).
Guidance is getting more specific
NCSA publishes a growing library of PDPPL guidelines and tools for regulated entities, covering privacy notices, breach notification, DPIAs, direct marketing and, since May 2026, a Personal Data Sharing Checklist (NCSA guidance hub for regulated entities).
EU customers bring the GDPR
Expanding to Cyprus or the EU means GDPR and national laws such as Cyprus Law 125(I)/2018. The Cyprus Commissioner reported 299 decisions and €1.561 million in fines over the GDPR's first six years (Cyprus Mail).
What we check, passively
Transport & headers
HTTPS, HTTP→HTTPS redirects, HSTS, Content-Security-Policy, clickjacking protection, MIME sniffing, Referrer-Policy and Permissions-Policy.
Cookies & trackers before consent
Cookies set on first load, and Secure, HttpOnly and SameSite flags. We also look for analytics and ad pixels such as Google Analytics, Meta and TikTok that load before a visitor has chosen anything.
Privacy notice signals
Is there a reachable privacy notice? Does it cover what the PDPPL and GDPR Articles 13 and 14 expect: who you are, why you process data, who receives it, and how people can exercise their rights?
Email spoofing protection
SPF, DMARC and common DKIM selectors on your domain. These records decide whether criminals can send convincing email that appears to come from you.
Exposure basics
Paid reports only, and only after you verify ownership: we check for accidentally public files such as .git or .env, server version disclosure, and security.txt.
Local SEO hygiene
Title and meta description, a single H1, canonical tags, mobile viewport, LocalBusiness structured data and Open Graph tags. These are the basics that help Doha customers find you.
Three ways to start
Mini-scan
QAR 0
An instant automated check of HTTPS, security headers, first-load cookies, visible trackers, privacy-notice link, SPF and DMARC.
Run free scanFull Scan Report
QAR 250 / ~€60 one-off
A full automated passive scan of up to 10 pages, delivered as a PDF report with plain-language findings within 3 business days.
See what's includedMonthly monitoring
QAR 99 / ~€24 per month
Monthly re-scans, change alerts when headers, trackers or DNS records change, and a short monthly summary.
Monitoring detailsWhat you can rely on
Transparent method
Every finding names the check, the evidence (for example, the exact response header) and the standard it relates to: OWASP Top 10:2025, PDPPL articles, GDPR articles or the QFC Data Protection Regulations 2021.
Passive only
No exploitation, no login attempts, no brute force, no load testing. Free scans read only what any browser receives from your homepage, plus public DNS records.
Minimal data handling
We keep scan results and your contact details only for as long as needed to deliver the service. We don't sell data. See our privacy notice.
Honest scope
We are not a law firm or a security consultancy, and not accredited by NCSA. Where a finding needs a licensed lawyer or a qualified security professional, the report says so.
Built for Qatar and GCC SMEs, ready for Cyprus and the EU
Restaurants, lounges, hotels, clinics, retailers, agencies and professional firms in Doha now take bookings, payments and enquiries online, often through a mix of website builders, booking widgets, WhatsApp links and ad pixels. Each one can collect personal data. Our guides explain the rules in plain language:
Find out what your website reveals
Run the free passive mini-scan in under a minute, or ask for a quote for the full report.