Scanner Methodology & Evidence Standards
A transparent breakdown of how the xFlow AI Opportunity Scanner inspects public web infrastructure, extracts verifiable on-page citations, calculates feasibility scores, and handles client data with strict privacy safeguards.
Multi-Page Crawler & SSRF Security Protection
When a user requests a scan, our crawler initiates an automated inspection of the specified public hostname. To prevent abuse, SSRF (Server-Side Request Forgery), and internal network probing, every request undergoes strict defense-in-depth:
DNS & IP Verification
We resolve the hostname before connecting and immediately block loopback addresses (`127.0.0.1`), private networks (`10.x`, `192.168.x`, `172.16-31.x`), and cloud metadata APIs (`169.254.169.254`).
Safe Redirect Verification
HTTP redirects are followed manually up to a maximum of 4 hops. Each redirect target is independently checked against our IP firewall before the next hop is fetched.
Evidence Standards: Facts vs. Inferences
Every AI opportunity identified by the scanner must be tied directly to observed characteristics of your website. We enforce a strict 3-tier taxonomy to maintain absolute honesty:
Actual sentences, return policy terms, shipping timeframes, or form labels directly extracted from your HTML. When displayed, these are enclosed in quotation marks and link directly to the source page where the text resides.
Logical deductions derived from technical architecture. For example, detecting a Shopify checkout with cash-on-delivery options allows our engine to deduce an RTO risk, even if your site does not explicitly write the words "RTO loss."
Information that cannot be observed from public HTML—such as your actual monthly order volume, internal CRM workflows, or courier contracts. The scanner explicitly marks these as unobserved and never fabricates mock numbers.
Scoring Rubric & Metric Definitions
The scanner evaluates each candidate opportunity across four standardized dimensions:
| Metric | Meaning | Evaluation Criteria |
|---|---|---|
| Potential Impact | Expected business leverage if deployed. | High: Replaces 50%+ of manual inquiries or directly reduces cash leakage. Medium: Enhances convenience or speeds up secondary workflows. |
| Feasibility | Ease of integration with standard toolsets. | High: Standard APIs available (Shopify Admin API, WhatsApp Cloud API, Google Calendar). Medium: Requires custom webhook transformations or bespoke CRM integrations. |
| Estimated Effort | Time to build and deploy production MVP. | Typically ranges from 1–2 weeks for focused agents to 3–4 weeks for complex multi-system orchestrations. |
| Confidence | Reliability of the observation. | High: Supported by multiple verified on-page passages. Medium: Deduced from partial pages or navigation hints. |
Data Privacy & Zero Model Training Standard
We treat every scanned website with enterprise data confidentiality:
Zero Persistent Retention
Scan data is processed ephemerally in memory during request execution. We do not store scraped customer pages in permanent databases.
No Model Training
We contractually and technically ensure that inference calls do not contribute to public foundation model training datasets.
Run an Evidence-Based Scan on Your Domain
Find out what autonomous agents can automate in your operations in under 30 seconds.
