About

Security scanning that MSPs can actually afford.

ComplianceLayer exists because the cyber insurance industry changed the rules, and the existing tools were built for the wrong audience.

Why ComplianceLayer exists

In 2025, cyber insurance carriers stopped accepting self-reported security questionnaires. They started requiring evidence — scan reports, configuration screenshots, proof that DMARC was enforced, ports were closed, and SSL certificates were valid.

The tools that provide this evidence — BitSight, SecurityScorecard, UpGuard — charge $15,000 to $30,000+ per year. They're designed for Fortune 500 procurement teams, not for an MSP managing 50 SMB clients who each need a scan before their insurance renewal.

ComplianceLayer fills that gap. A single API call scans any domain across 16 security modules and returns an A–F graded report in under 60 seconds. No agents to install, no sales calls, no annual contracts. Plans start at $0.

Built by an infrastructure engineer

RC
Robert Capel
Founder · ComplianceLayer

30 years of infrastructure engineering experience. Built ComplianceLayer because the MSPs and small security teams he worked with couldn't justify enterprise pricing for something that should be a simple API call.

What we scan

Every scan covers 16 security modules, weighted to reflect what cyber insurers and compliance frameworks actually check:

SSL/TLS
Certificate validity, cipher suites, protocol versions
HTTP Headers
HSTS, CSP, X-Frame-Options, Referrer-Policy
DNS & Email
SPF, DMARC, DKIM, MX, CAA records
Open Ports
100+ ports scanned, RDP/SSH/Telnet flagged
Cookie Security
HttpOnly, Secure, SameSite flags
DNSSEC
DNSSEC chain validation
WAF Detection
Cloudflare, Akamai, AWS WAF identification
JavaScript Audit
Vulnerable JS libraries, inline script risks

Contact

Support: support@compliancelayer.net · Average response time: < 4 hours

API Status: compliancelayer.net/status

Documentation: compliancelayer.net/docs

Get started

Start scanning your first
domain in 60 seconds.

No credit card. No sales call. No setup. Free tier is permanent.

10 free scans per month, foreverAPI key in 30 secondsCancel anytime

All scans are passive and external — we never access your servers, install agents, or require credentials. View our security practices, live system status, or browse domain reports.