SaaS Ranking

Our crawler

We identify ourselves. If you would rather we did not fetch your site, say so and we will stop.

How to recognise us

SaaSRankingBot/1.0 (+https://saas-ranking.com/bot)

What we fetch

A short list of well-known addresses on your own domain: your pricing page, your legal pages, your security or trust page, your status page, and /.well-known/security.txt. We also load your front page once in a browser to count third-party requests before any interaction.

example.com Data processing agreement 8 addresses Subprocessor list 7 addresses Data location stated 7 addresses Status page with history 3 addresses Public pricing 5 addresses Certifications named 6 addresses Uptime SLA with a figure 6 addresses HTTPS enforced with HSTS 2 addresses No third-party tracking before consent the front page, once, in a browser security.txt (RFC 9116) 1 address Notice before subprocessors change 8 addresses Named privacy contact 7 addresses
Every address is derived from the vendor's domain; the only other host we try is the vendor's status page at statuspage.io. We follow no links, we do not log in, and we do not submit forms.
Show every address, per criterion
Data processing agreement
/legal/dpa /dpa /legal/data-processing-agreement /data-processing-agreement /legal/data-processing-addendum /legal/gdpr /trust/dpa /privacy/dpa
Subprocessor list
/legal/subprocessors /subprocessors /sub-processors /legal/sub-processors /trust/subprocessors /privacy/subprocessors /legal/subprocessor-list
Data location stated
/security /trust /legal/privacy /privacy /privacy-policy /compliance /legal/privacy-policy
Status page with history
https://status.example.com/ /status https://example.com.statuspage.io/
Public pricing
/pricing /pricing/ /plans /en/pricing /pricing-plans
Certifications named
/security /trust /trust-center /compliance /legal/security https://trust.example.com/
Uptime SLA with a figure
/legal/sla /sla /legal/service-level-agreement /trust/sla /uptime /legal/uptime-sla
HTTPS enforced with HSTS
http://example.com/ /
No third-party tracking before consent loaded once in a browser, third-party requests counted
/
security.txt (RFC 9116)
/.well-known/security.txt
Notice before subprocessors change
/legal/subprocessors /subprocessors /sub-processors /legal/dpa /dpa /legal/data-processing-agreement /trust/subprocessors /legal/sub-processors
Named privacy contact
/legal/privacy /privacy /privacy-policy /legal/privacy-policy /legal/privacy-notice /trust/privacy /datenschutz

We do not crawl your whole site, we do not log in, we do not accept NDAs and we do not submit forms. That is deliberate: the thing we measure is what you show to someone who has not talked to your sales team yet.

How often

At most one request every 2 seconds to the same host, and we honour a longer Crawl-delay if your robots.txt asks for one. If your server answers 429, we back off and try once more, later.

How to exclude us

User-agent: SaaSRankingBot
Disallow: /

If you do that, we will not rank you at all. You will not get a bad score for it: your entry says that your robots.txt excludes us. The same applies if your firewall blocks us, which we cannot always tell apart from a real absence, so we treat it as “not measured”.

Something is wrong

If we report a document as not found and it exists, tell us where it is. A correction moves that vendor into our next nightly run. That run reads the same fixed addresses we check for every vendor, not the address you send. If the document is at one of those addresses, or one of them redirects to it, the run reads it with the same rule as for every vendor, and the vendor page shows the result once the run is published. Anywhere else, our crawler does not find it.