Skip to main content
Code auditCheck every pull request for privacy riskWebsite auditCatch scripts and vendors that appear in productionInth AgentAsk what changed and follow the answer to its sourceCookie consentFast consent that lives in your codebase
AboutHandbookBlogOSS
AI feature reviewsFundraising Due DiligencePrivacy impact reviewsEnterprise customer reviewsCookie and tracking audits
Pricing
Sign inRun a free scan
Run a free scan
A note from the founderInth / 2026

I started Inth because privacy should live with the product.

Policies and contracts say what a product should do. The codebase and production show what it does. Inth keeps those two things from drifting apart.

Written by
Christopher Burns

Founder, Inth · Author, c15t

Christopher Burns speaking on stage in a c15t T-shirt
Founder / InthProduct privacy

Christopher Burns

Founder, Inth · Author, c15t

The founder

Cookie banners showed us the bigger problem.

I started with c15t because cookie banners were the most visible part of a broken system. Developers were loading a blocking third-party script into their product, then handing control of the experience to a dashboard they did not own.

Once c15t lived inside the application, the larger gap became obvious. A banner can record a choice, but it cannot tell you whether a new SDK, vendor or AI feature made your policy untrue.

Inth is what we are building around that gap. It follows change from pull request to production and keeps the people, reasoning and outcome attached.

Explore c15t

The mission

The privacy record should change when the product changes.

Code shows what the product intends to do. Production shows what happened. Inth keeps the decision and review with the change.

  1. 01 / 03Intent

    Code shows intent

    Controls, policy logic, consent state, and data handling should be versioned and reviewed beside the product they govern.

  2. 02 / 03Reality

    Production shows behaviour

    Runtime behavior shows whether scripts, vendors, domains, and data flows still match the intent expressed in the codebase.

  3. 03 / 03Evidence

    People make the call

    The source, reviewer, rationale, fix, and verification become one durable product record instead of scattered paperwork.

What we stand for

Principles for how we build Inth

  1. 01

    Put privacy in the product

    Privacy is product behavior. It belongs in the same systems teams use to build, review, test, and operate software.

  2. 02

    Prefer open infrastructure

    Critical controls should be inspectable and portable. Open foundations create more trust than opaque scripts and locked dashboards.

  3. 03

    Follow change, not checklists

    A current product record is more useful than a periodic reconstruction. Start from what changed and keep the evidence with it.

  4. 04

    Keep human judgment visible

    Systems can find changes and assemble context. People still make the decision, and their reasoning should remain reviewable.

  5. 05

    Treat performance as trust

    Privacy controls should not punish the user experience. Infrastructure earns adoption when developers are proud to ship it.

Put privacy where the product lives

Keep product intent, production behaviour and human decisions in the same record.

Start for freeTalk to us
Inbox - Inth
Inbox

Open

9 items

Reviewing evidence
  • PII in request logs

    4m

    api-gateway forwards email addresses to the logging vendor.

    P0Code scan·Project finding
  • Script calls new domain

    22m

    cdn.thirdparty.io detected in production before consent.

    P1Website activity·Project finding
  • New tracker: pixel.js

    1h

    Marketing category script added without a vendor record.

    P1Website activity·Project finding
Inbox - Inth
INInthPro
Search⌘ K

Products

Inbox
OpenResolvedDismissedAccepted risk
Agent
Audit
Consent
Billing
Settings
Getting started
Help
AMAlex Morgan

Open

9 items

  • PII in request logs

    4m

    api-gateway forwards email addresses to the logging vendor.

    P0Code scan·Project finding
  • Script calls new domain

    22m

    cdn.thirdparty.io detected in production before consent.

    P1Website activity·Project finding
  • New tracker: pixel.js

    1h

    Marketing category script added without a vendor record.

    P1Website activity·Project finding
  • New SDK: analytics-node@4

    5h

    Adds a data flow to Segment. Policy v9 has no match.

    P2Code scan·Project finding
P0Code scan·Open

PII in request logs

Summary

The API gateway forwards email addresses to a logging vendor without an approved data flow.

Evidence

Open scan report →
src/logging/request.ts:42-44
42
43
44
logger.info({
  email: request.user.email,
});

Recommended action

Remove the email field or replace it with a non-identifying internal user ID.
Inbox item resolved

New agent

Privacy agent

Research privacy requirements and turn guidance into practical next steps.

Ask anything about privacy…
Research

Legal information grounded in curated guidance, not legal advice.

Notes from building privacy into the product

Notes from building Inth. Sent occasionally.

Inth connects what your company promised to what engineers just shipped.

Platform

  • Code audit
  • Website audit
  • Inth Agent
  • Consent banner
  • Pricing

Use Cases

  • Privacy Impact Review
  • AI Feature Reviews

Company

  • About
  • Blog
  • Open source
  • Contact

Resources

  • Documentation
  • GitHub
  • Cookiebench
  • Status

© 2026 Inth. All rights reserved.

  • Contact us
  • Privacy
  • Cookies
  • Terms