Scan. Flag.Patch.
You built it with AI. Patch checks what the AI didn't: cookie consent, your privacy policy, exposed keys, security headers and SEO. Then he helps you fix it.
Everything the AI forgot to mention.
The rules that apply depend on where your visitors are, not where you're hosted. Patch works out which ones apply to you.
Legal & privacy
Security
SEO
Accessibility
- Images without alt text
- Colour contrast
- Keyboard navigation and focus
- Form labels
- Page language and headings
Paste a link. Patch does the rummaging.
Paste your URL
No signup. Patch starts at your homepage and follows every link he can find.
He visits like your users do
From the EU, the US and the UK. He accepts and rejects your cookie banner, and records every request your site makes either way.
You fix it, with his notes
Copy ready-made fix prompts into Lovable, Bolt or Cursor, follow the plain-English steps, or let Patch open the pull requests on GitHub.
Your privacy policy says one thing. Your site does another.
Patch compares every service your site talks to with what your privacy policy admits to, and tells you exactly what's missing.
- Google Analyticsgoogletagmanager.comFires before consent
- Meta Pixelconnect.facebook.netNot in your policy
- Hotjarstatic.hotjar.comNot in your policy
- Stripejs.stripe.comMentioned
- Resendapi.resend.com · signup formNot in your policy
The AI didn't mention the fines either.
Every one of these is a real legal maximum, with the law it comes from. Patch shows the ones that apply to your site on every finding, free.
- Legal & privacyTrackers load before consentUp to £17.5m or 4% of turnoverUp to £17.5m or 4% of worldwide annual turnover, whichever is higher (for breaches since 5 February 2026)UK PECR · PECR reg. 31 and Sch. 1, as amended by the Data (Use and Access) Act 2025 (opens in a new tab)
- Legal & privacyPrivacy policy doesn't mention services the site usesUp to £17.5m or 4% of turnoverUp to £17.5m or 4% of worldwide annual turnover, whichever is higherUK GDPR · UK GDPR art. 83(5)(b); DPA 2018 s.157 (opens in a new tab)
- Legal & privacyNo ImpressumUp to €50,000Up to €50,000 for a missing, wrong or incomplete ImpressumGermany’s DDG · DDG § 33 (opens in a new tab)
- AccessibilityImages without alt textUp to €100,000 in GermanySet by each EU country. In Germany, up to €100,000 for an online shop or service that is not accessibleGermany’s BFSG · BFSG § 37 (opens in a new tab)
Legal maximums, not predictions: real fines depend on the business, the harm and how fast it's fixed. Not legal advice.
Works with sites built in
See the damage free. Pay to fix it.
Free scan
$0- Score and grade
- Every issue, with its severity
- Full detail on your top 3
- A score card you can share
Full report · per site
$19 one-off- Everything in the free scan
- Evidence and fix steps for every issue
- Fix prompts to paste into Lovable, Bolt or Cursor
- The rules and sources behind each finding
- Fix it for me on GitHub: +$9 one-off
Patrol
$29 a month- Everything in the full report, for up to 3 sites
- +$7 a month for each extra site
- Daily re-scans, plus a re-scan on every deploy
- Email alerts when a new tracker or issue appears
- Fix prompts for every report
- Automatic fix pull requests on GitHub
Renews monthly until you cancel. Cancel any time from your Patrol dashboard.
ShipPatrol is not a law firm, and reports are not legal advice. Every legal check names the guidance it's based on, such as the UK ICO, the European Data Protection Board or California's privacy regulator, and the date we last reviewed it.