40T Secure AI applies its own detection engine to its own public website — the same capabilities it runs against customer sites — and publishes the result in full. For the period of November 2026, the assessment returned a 100/100 compliant verdict with zero findings across every assessed control domain and jurisdiction.

40T sets no marketing cookies, no third-party trackers and no AI analytics scripts. Authentication (Clerk) and payments (Stripe) run through server-side integrations that inject no client-side tracking. A consent banner is therefore not strictly required; one is nonetheless provided, with symmetric Accept / Reject and Global Privacy Control honored.

This is a first-party self-assessment: 40T’s engine observes www.40tsecure.ai from the outside, read-only, the way a regulator’s investigator would — no privileged access, no agents, no credentials. Findings are evidence-gated (a high/critical verdict requires captured behavioral evidence) and each maps deterministically to the statute and control that governs it.

It is a self-assessment, not an independent third-party audit. Every finding is reproducible and backed by sealed evidence. Full detection methodology →

Assessed against the frameworks 40T cites for customers. No findings in any.

If the score ever drops below 100, we remediate before the next cycle and publish the delta so you can see exactly what changed. Most compliance tools never scan themselves — if we can’t pass our own audit, why would you trust us with yours?