Skip to main content

OsanoBot

OsanoBot is the web retrieval agent operated by Osano, Inc. It fetches publicly accessible web pages on behalf of Osano products and their customers — primarily Osano's compliance monitoring, which scans websites at the request of the site's own organization to verify privacy compliance: cookie and tracker behavior, consent-banner function, and honoring of privacy signals such as Global Privacy Control.

OsanoBot's traffic is customer-directed. If OsanoBot visits your site, it is almost always because your organization (or its privacy team) uses Osano to monitor that site.

Identifying OsanoBot​

OsanoBot identifies itself two ways on every request:

  • User-Agent containing the token OsanoBot, with a link back to this page.
  • A Signature-Agent: "https://bots.osano.com" header plus Signature/Signature-Input headers carrying a cryptographic signature (Web Bot Auth, RFC 9421).

OsanoBot does not publish an IP address list, and its traffic should not be identified by IP. Verification is cryptographic and works from any network.

Verifying OsanoBot traffic​

Every OsanoBot request is signed with an Ed25519 key. The matching public keys are published in OsanoBot's key directory:

https://bots.osano.com/.well-known/http-message-signatures-directory
  • Each request's Signature-Input names the signing key by keyid — the RFC 7638 thumbprint of a key in that directory — with tag="web-bot-auth" and a bounded validity window.
  • The directory response is itself signed by every key it lists, proving possession of the private keys. Only public keys are published; private keys are held in a hardware security module and are not exportable.
  • Keys rotate by overlap: a new key is published in the directory before use, and old keys remain until retired. Always verify against a freshly fetched directory rather than a pinned key.

If your site is behind Cloudflare or Akamai, this verification happens automatically at their edge: OsanoBot is a registered verified bot. How verified bots are treated is up to your bot-management configuration — for example, Cloudflare's Allow verified bots setting (or a WAF rule matching verified bots) and Akamai Bot Manager's actions for known bots. If your configuration challenges or blocks bots broadly, allow OsanoBot — or verified bots generally — there.

Crawl behavior​

  • Scans run on schedules configured by the monitored site's organization; OsanoBot does not crawl the open web or discover new sites on its own.
  • A scan fetches a bounded set of pages and renders them in a real browser, the way a visitor would, to observe cookie and consent behavior.
  • Request rates are modest and spread out; OsanoBot honors robots.txt and crawl directives.
  • Retrieved content is used solely to produce compliance reports for the site's organization. It is not used to train AI models, build search indexes, or republish content.

Controlling OsanoBot​

  • Preferred: scanning is configured by your own organization — the person who set up monitoring can change its scope or schedule in Osano.
  • Block or allow OsanoBot by name in your WAF's verified-bot rules (Cloudflare and Akamai both support this), or via robots.txt using the OsanoBot user-agent token.

Contact​

Questions or issues with OsanoBot traffic: help@osano.com.