What is recorded, separated by protocol layer, before any finding or verdict is derived.
Observation is not interpretation
25 protocols · 51 checks · 7 layers
Direct artifacts, derived observations, findings, remediation instructions, and later verification are separate records. That separation is what makes the result inspectable — by you, by your client, and by your finance team.
Allowed, disallowed, no matching rule, no policy file, or indeterminate
Required versus informational profile status
Site-declared x-robots-tag AI tokens and TDM reservation headers, read from the captured responses
Opt-out signals in the captured document and headers: meta robots opt-out tokens, X-Robots-Tag directives, and the TDM-Rep reservation, recorded as declared
The /ai.txt policy file: presence, bounded byte length, media type, and a shape verdict under the declared convention
One HTTP probe per documented AI actor carrying its vendor-published user agent
Status, byte counts, classification, the literal request user agent, and the measurement vantage
Per-actor content extraction on the rendered page: word counts, SHA-256 hashes, and material divergences, one view per product token
Statement that a divergence report never changes the verdict and that providers took no part in the observation
The boundary of what a synthetic probe can say about crawler identity, recorded instead of a verification claim
Explicit statement that a request from our scan address cannot confirm a vendor crawler operating from its own network
Layer 4
10 checks
Representation and extraction evidence
Protocols: Raw and rendered representation · Main-content extraction · PDF text layer · Site robots coverage · Web Bot Auth key directory · AIPREF signals · CDN default-block observation
Raw HTTP artifact
Browser-rendered DOM artifact
No-JavaScript DOM artifact, with missing capture reported as incomplete
Mechanical hash and byte comparisons
Raw, rendered, and no-JavaScript main-content extraction outcomes and word counts
Heading, list, and table tag counts from the rendered document
Structure fingerprints: empty headings, headings introducing no content, and repeated heading texts
Heading order (level-skip) violation count
Canonical tag presence and self-consistency
Same-hostname link counts
Structure counts only — these protocols record tag, heading, and link counts plus the canonical URL; they never record page text
Layer 7
5 checks
Date evidence
Protocols: Machine-readable dates
Strict ISO date and timezone validation
Supported meta, JSON-LD, time-element, and HTTP header sources
Contradictory and out-of-range declarations
No stale/fresh grade
No defect inferred from an undated page
Where page text is kept
Most observations above are counts, statuses, and hashes. The audit also retains bounded excerpts of fetched content — plain text, at most 400 characters per excerpt, never rendered as HTML — inside the sealed evidence bundle and the PDF report, so the extraction itself can be inspected. These excerpts are retained with the evidence bundle and reports until you delete your account; raw fetched page content is purged 30 days after the scan. The full retention terms are in the privacy policy.
