Twenty seconds, public records only. We read your DNS, your homepage and Shodan's public index the way a regulator, an insurer or a phisher would, and grade it against what the FTC Safeguards Rule expects of auto dealers, tax preparers and mortgage brokers.
Passive external check only: no login attempts, no port scanning, nothing inside your network. This is not the written risk assessment or the six-month vulnerability assessment the rule requires; it is the outside view a regulator or insurer starts from.
Not checked: logins, internal systems, staff devices, your DMS or CRM, port scans. Those belong to the written risk assessment and the six-month vulnerability assessment the rule requires. Certificate expiry and legacy TLS acceptance are checked in the monthly report, not here.
Most of what fails here is two DNS records. We give you the exact ones for your mail provider, walk them to enforcement over eight weeks so nothing legitimate breaks, and re-check the public surface every month.
Checkout opens shortly. Leave your email and we send the records for this domain the day it does; nothing else, no list.
SPF, DMARC policy and reporting, DKIM on the common selectors, MTA-STS. Missing DMARC is the single most common failure and the first thing a phisher uses to impersonate the store to its own customers.
Whether HTTPS actually works on the bare domain and www, whether plain http redirects, HSTS, and whether a page that mentions a credit application is reachable unencrypted. 16 CFR 314.4(c)(3).
Open remote-desktop, database and file-sharing ports and known CVEs on your public IPs, from Shodan's pre-collected index. 314.4(c)(1), (c)(5), (d)(2). Shared hosting platforms are not blamed for their own ports.