Render

1. warn

   Observed vendors not named in policy

   The policy names some third parties but omits these observed vendors. Undeclared: Google Tag Manager, Google AdSense, GrowthBook, LinkedIn, Segment, Segment.

   
               Google Tag Manager
   Google AdSense
   GrowthBook
             

   how we detected this →
2. warn

   Named third parties significantly underrepresent actual vendor ecosystem

   The privacy policy names only three third parties: Stripe, Google LLC, and Google Analytics. However, the observed tech stack includes at least 22 distinct third-party domains across analytics (Segment), sales/recruitment (Ashby, Salesloft), testing/personalization (GrowthBook), support (Inkeep, HubSpot), and content management (Sanity). While some (Segment, Google) act as aggregators/pipelines to other vendors, the policy provides no visibility into this more complex data-sharing ecosystem. Users cannot assess all entities with data access.

   
               Policy named parties: Stripe, Google LLC, Google Analytics
   Observed domains: sanity.io (65 hits), googletagmanager.com, osano.com, salesloft.com, segment.com, ashbyhq.com, hsforms.com, inkeep.com, growthbook.io, and 13 others
             

   how we detected this →
3. note

   Google Tag Manager loaded (tag_manager)

   Observed 5 time(s) on the page.

   
               inline: window.dataLayer=window.dataLayer||[];function a(){dataLayer.push(arguments)}
   inline: pt\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"window.dataLayer=window.dataLayer||[];function a(){dataLayer.push(arguments)}
   <iframe> src: https://www.googletagmanager.com/ns.html?id=GTM-N644GXSK
             

   how we detected this →
4. note

   Google Analytics loaded (analytics)

   Observed 1 time(s) on the page.

   
               CSP: https://*.google-analytics.com
             

   how we detected this →
5. note

   Google AdSense loaded (advertising)

   Observed 1 time(s) on the page.

   
               CSP: https://pagead2.googlesyndication.com
             

   how we detected this →
6. note

   GrowthBook loaded (ab_testing)

   Observed 1 time(s) on the page.

   
               CSP: https://cdn.growthbook.io
             

   how we detected this →
7. note

   LinkedIn loaded (social)

   Observed 1 time(s) on the page.

   
               CSP: https://*.linkedin.com
             

   how we detected this →
8. note

   Segment loaded (analytics)

   Observed 1 time(s) on the page.

   
               CSP: https://*.segment.com
             

   how we detected this →
9. note

   Segment loaded (analytics)

   Observed 1 time(s) on the page.

   
               CSP: https://*.segment.io
             

   how we detected this →
10. note

    Ashby (recruitment platform) integration not disclosed

    Ashby HQ is loaded on the homepage but not mentioned in the privacy policy's third-party disclosures. This suggests HR/recruitment data collection (e.g., job application funnels, candidate tracking) that isn't explicitly acknowledged. Users visiting the careers page or interacting with job listings may have data shared with Ashby without clear notice.

    
                ashbyhq.com detected with 1 hit in tech stack
    No mention of Ashby in policy third-party section
              

    how we detected this →
11. note

    Segment used as data aggregator but not explicitly named in policy

    Segment.com and Segment.io are detected (2 hits combined) but not named in the policy's third-party disclosures. Segment typically acts as a customer data platform routing events to multiple downstream vendors (analytics, advertising, CRM). The policy's claim to share with 'Analytics providers' and 'Advertising Partners' may flow through Segment, but this intermediary role is opaque to users.

    
                segment.com and segment.io detected in tech stack
    Policy mentions generic 'Analytics providers' and 'Advertising Partners' but not Segment by name
              

    how we detected this →
12. note

    No observable cookies set on initial page load despite cookie policy claims

    The policy explicitly claims use of 'Essential Cookies, Functional Cookies, Performance/Analytical Cookies, Retargeting/Advertising Cookies,' but the observation shows zero cookies set. This may reflect lazy-loading or post-interaction cookie setting, but it means the cookie consent/notice flow (if any) is not evident from the initial page state, limiting user ability to make informed consent decisions upfront.

    
                cookies_set: [] in observation
    Policy claims: 'We use the following types of Cookies: Essential Cookies, Functional Cookies, Performance/Analytical Cookies, Retargeting/Advertising Cookies'
              

    how we detected this →
13. info

    Google Analytics: disclosed in policy

    The policy names this vendor explicitly, matching what was observed.

    how we detected this →
14. info

    Google AdSense (advertising) detected but policy frames advertising vaguely

    googlesyndication.com (Google AdSense) is loaded, confirming programmatic advertising. The policy discusses 'third-party ad networks' generically and reserves the right to serve 'interest-based advertisements' but does not name Google AdSense or explain how user behavioral data informs ad targeting on the site itself.

    
                googlesyndication.com detected (1 hit)
    Policy states: 'We may serve advertisements, and also allow third-party ad networks... to serve advertisements through the Services' without specific vendor identification
              

    how we detected this →

hsts

yes

csp

yes

server

cloudflare

Every audit on this site is reproducible. Install stackpeek and run the same check against https://render.com from your own machine — the tool is MIT-licensed and runs locally.

pip install stackpeek
stackpeek audit https://render.com

source on GitHub · methodology · cli docs