Frequently asked questions

No. This is an automated scan of publicly visible website signals. It is not legal advice, and not a security audit or penetration test. We run technical checks on your website and email set-up and compare what we find with published requirements and guidance. We are not a law firm. For legal interpretation, speak to a lawyer qualified in Qatar, the QFC or the relevant EU country.

No. Our checks are passive: we request public pages as a browser would and read public DNS records. We do not attempt logins, run exploits, brute-force anything or load-test your server.

No. You must own the domain or be authorised by its owner. Paid reports also require a DNS TXT record or file to verify ownership before we start.

No. A website scan covers part of the picture: what your site shows and sends. Compliance also depends on your internal processes, contracts, records and how you handle requests. Our report shows website-level gaps and fixes; it is not a certificate.

Samtaro Security is a service of Samtaro Group, operated by Samtaro group Artificial Intelligence Solutions W.L.L., registered in Qatar (C.R. 252253). We use the same passive scanning and compliance-checking tooling Samtaro Group uses on its own products.

After we agree scope, we send a fixed-price invoice payable by bank transfer in QAR or by PayPal invoice. Monitoring is invoiced monthly or annually. You pay before work starts on a one-off report.

Three business days (Sunday–Thursday) after ownership is verified and payment received.

The report includes a prioritised fix list your developer or hosting provider can act on. We can re-scan once after your fixes at no extra cost within 30 days.

Yes. We serve businesses across the GCC, and companies in Cyprus or elsewhere in the EU, or GCC companies expanding there. For EU clients the report checks against GDPR and ePrivacy expectations.

Reports are in English for now. Arabic is planned. Tell us if you need it and we will let you know when it's ready.

For the free scan, we keep the domain scanned, time, country and any email you give for up to 12 months. For paid reports we keep the report and your contact details for the engagement and our accounting records. See the privacy notice.

No. We are not accredited, licensed or endorsed by NCSA, the QFC Data Protection Office, the Cyprus Commissioner or any regulator, and we are not affiliated with OWASP. We reference their published guidance and standards.