AI Disclosure

The single most important thing to understand about this architecture is that the model is never asked a question it could get wrong in a way we would not notice.

Determined by code and measurement. Whether a title element exists and its length. Whether a canonical URL is present and where it points. Whether robots.txt is reachable and what it contains. Whether a sitemap resolves and how many addresses it lists. Which structured data types are present and whether they parse. Heading hierarchy and where it breaks. HTTP status codes and redirect chains. Which security headers are present. Transport certificate summary. Public DNS records including MX, SPF, DMARC and CAA. Nameserver consistency. Performance measurements and Core Web Vitals from Google PageSpeed Insights. Link counts, image attributes, word counts.

Interpreted by the model. Whether the website makes its business comprehensible. Whether services are defined clearly enough for a generative system to represent them. Whether the positioning is distinctive. Whether the content is genuinely useful to somebody with the underlying problem. Whether entity signals are coherent. Whether the site reads as trustworthy. What matters most commercially, and in what order. How to explain a technical finding to somebody who is not technical.

The first list is a set of facts. The second is a set of judgements. Asking a model to determine the first would be substituting a probabilistic answer for a deterministic one, which is a poor trade when the deterministic one is trivially available.

A structured evidence bundle: the observations gathered during the analysis, in a defined shape. Extracted text content, metadata, heading structure, structured data types, DNS and email findings, header presence, performance measurements and the deterministic findings already computed.

What is not sent:

• your name, email address or any contact detail;
• anything you typed into an enquiry form;
• credential material, breach records or stealer-log content — none of which is processed anywhere in the system;
• raw page markup, which is parsed and reduced first.

The provider receives the evidence for the purpose of producing your report. It is not used to train models. The provider is isolated behind a typed interface, so it can be replaced or self-hosted without touching anything else in the pipeline.

Model output is never rendered as it arrives. Between the response and your report there are three stages:

• Schema validation. The response is parsed against a strict schema. Every field is typed, severity and confidence are restricted to fixed values, scores must be integers within range, and unrecognised fields are discarded. A response that does not conform is rejected outright rather than partially salvaged.
• Claim filtering. The prose is checked for categories of statement the service will not make. A finding containing one is either rewritten or dropped.
• Evidence anchoring. Findings reference the evidence they were derived from. A finding that cannot be tied back to something observed does not survive.

The filtered categories exist because they are the specific ways a fluent model overclaims. Nothing in a report will assert guaranteed rankings, guaranteed AI citations, guaranteed traffic growth, that a site has definitely been penalised without evidence of it, that a vulnerability is exploitable, that a business is fraudulent, or that an exposure record proves an active compromise. The last is the most consequential: an email address appearing in a third-party breach is a fact about that third party, and saying otherwise would be alarming and wrong.

The analysis completes anyway. A deterministic interpreter built from the same rule set produces the summary, orders the findings and writes the explanations from prepared language keyed to each finding type.

The result is less fluent and less specific to your business, and the report tells you which interpreter produced it rather than quietly degrading. Every factual finding is identical either way, because the facts never came from the model.

This also means the service is genuinely useful without any model at all. The interpretation layer improves the explanation; it does not constitute the analysis.

The free snapshot is automated end to end. Nobody reviews it before you see it, and it is labelled accordingly.

Paid reports are reviewed by a person before delivery. That review corrects mischaracterisations, removes findings that are technically accurate but commercially irrelevant, reorders priorities against what the business is actually trying to achieve, and adds context no automated system could have: what a competitor is doing, what a particular market rewards, why an apparent problem is a deliberate decision.

This is the substantive difference between the two, and it is why we do not describe the automated snapshot as an audit.

• Generating content for clients. IXSEO does not produce mass AI-written pages. Content work is written by people who understand the subject, because the alternative produces exactly the undifferentiated material that GEO assessments correctly penalise.
• Writing this website. The pages you are reading were written for this project rather than generated from a template.
• Deciding what is factually true about a site. Covered above, and worth repeating.
• Making decisions about people. No automated decision-making with legal or similarly significant effect takes place anywhere in this service.

Language models are confident about things they have inferred. The constraints above reduce that risk substantially and do not eliminate it. Where an interpretation rests on weaker evidence, the finding carries a lower confidence rating, and that rating is worth reading.

Interpretation is also not perfectly reproducible. Running the same analysis twice may produce the same findings expressed differently, or a slightly different ordering of priorities. The underlying evidence is deterministic; the prose describing it is not.

If a finding in your report seems wrong, tell us through the contact page. Reports that are corrected improve the rule set for everyone, and we would rather know.

Interpretation is enabled by supplying OPENAI_API_KEY and, optionally, OPENAI_MODEL. Keys are held server-side only and are never exposed to the browser. Without a key, the deterministic interpreter runs and the site remains fully functional — which is deliberate, and is how a deployment can operate with no third-party model involvement at all.