The disclaimer page also makes it clear that they don't analyze anything that requires interactions like signing in. Together with the subdomain policy, I suspect for any business where the landing/marketing site and the core business offering differ in technologies used (which is especially common for SaaS products), they will only pick up the marketing site. They also seem to allude to some sort of webmaster self-reporting mechanism though, not really sure what that means.