What we access — and what we never touch

• Public pages of your website only — the pages any member of the public can open. We respect robots.txt by default and crawl politely (a few requests per second, like a search engine).
• We never sign in, submit forms, or bypass anything. Client portals, intranets and anything behind a login are invisible to us by design.
• No client data, ever. We monitor your marketing website, not your practice. Nothing we process is confidential or privileged material.
• Evidence we keep — page excerpts and screenshots — is stored privately against your account and shown only to your signed-in users.

On customer scans, an AI model (Anthropic's Claude) re-reads the public page text behind certain findings to reduce false alarms. It is deliberately constrained:

• It sees public page text and our detector's findings — nothing else.
• It can soften a finding, or confirm a check as clear only with a verbatim quote we verify against the page. It can never invent a problem.
• It never runs on the free public preview, and it is disclosed in our methodology and privacy policy.

FirmProof runs on a small set of established providers:

Full processing detail, retention periods and your rights are in the privacy policy and data processing addendum.

• All traffic is HTTPS with HSTS; security headers (CSP, frame-ancestors) are enforced site-wide.
• Sessions use httpOnly cookies; sign-in is via Google, Microsoft or email with strong-password rules. Firm ownership is verified before any scan runs.
• Payment details are handled entirely by Stripe.
• We are a small, founder-run company. We don't yet hold ISO 27001 or SOC 2 certification — if your procurement process needs a questionnaire completed instead, email us and we'll complete it.