Trackers that never asked
An ad pixel, an analytics tag, a chat script, a session recorder. They load on the first page view, before the banner appears and before the visitor has clicked anything.
SiteTrust for agencies, advisors and consultants
Whoever built it,
you get the call.
A pixel fires before anyone is asked. A chat widget answers with AI and the page never says so. Most of it arrived after launch, from people no longer in the room. Some of these sites you built. Some you were handed and told they were fine. Nobody has looked since.
Start with your own site. Ten checks, three fields, and you will know in minutes what a stranger can see from the outside.
Then decide what to do about every other site you answer for.
Ten checks
Eight core checks decide the badge. Images and accessibility are advisory: reported in full, never blocking.
No access needed
Nothing installed, nothing changed. The scan reads what a public page does, the same way a visitor's browser does.
Every site at once
A site owner carries one exposure. You carry every site you touch, and you get the call about any of them.
What is actually running on the sites you are responsible for
Not what is in the spec, and not what anyone told you. What is loading right now, on the live page, for every visitor.
AI that never says so
A chat assistant on the contact page. An intake bot. A summarizer inside a plugin. The visitor is dealing with a system, and the page never mentions it.
A policy that describes neither
Written at launch, accurate for about a quarter, never updated when marketing added a tool. It now says one thing while the site does another, in public.
That is exposure, and it is on the record every day it runs.
It is also what the filers scan for, and it is what the demand letters are built on. We do not tell you what a court would decide. We tell you what your site did, on what date, measured how.
“It’s fine.”
Nobody has actually checked. That is true of almost every site you will be handed, and most of the ones you built. Websites accumulate, and the good shops accumulate fastest: their clients trust them enough to keep adding.
What you were told
“It's fine.”
The handover, in two words
“Analytics only.”
One tag, one purpose, allegedly
“The last shop set that up.”
Nobody still there remembers why
“The policy is on the site.”
It is. That was the question they answered.
Everything anyone can tell you about the site.
What the browser shows
An ad pixel, firing before the banner loads
Added in March. Not by you.
A chat widget answering with AI
Nothing on the page says so.
A session recorder
Arrived inside a plugin update nobody read.
A privacy policy describing none of it
Unchanged. Still answering the left column.
What a scanner reads in ninety seconds.
Nobody checked. You are the one they ask.
When a client forwards a letter, or their counsel asks what the site collects, the question lands on your desk. Not because you put it there. Because you are the one who is supposed to know.
Three parts, in the order they actually pay
Part one
Your own site
Verify on your own domain. The badge, the registry listing, the evidence report. This is win number one.
Part two
Every site you touch
The ones you have run for years, the ones you were handed last month, and the ones you want to win.
Part three
The 50 percent
The money we pay you for sending people our way. Named last, on purpose.
Part one
Your own site, handled first
Two reasons, both practical. You cannot hold a standard out to a client that you have not met yourself. And your own domain is the fastest, cheapest place to see exactly what the report looks like before you ever put it in front of a paying customer.
What Verify puts on your own domain
- ✓Consent that blocks trackers before it asks, not after
- ✓An AI disclosure that says what is running and where
- ✓An attorney-supervised privacy policy, kept current, not frozen at launch
- ✓Independent verification twice a year, with a live scan every quarter
- ✓A badge that reports the date of the last scan
- ✓A public registry listing under your name, that anyone can check
- ✓An evidence report you can hand to a client, a carrier or a lawyer
- ✓Eligibility for AI Risk Coverage
Verify starts at $70.75 a month, billed annually. Month to month is available at $85.
A static seal says someone once looked. The badge says what the last scan found, and when it ran.
That is the difference between a trust mark and a trust layer. Anyone can buy a graphic. What a client cannot buy is a dated record that keeps updating itself.
Now you know, and you have the fix path
You have a list, a date, and a method. It is also the first honest thing you can say in a client conversation: we ran this on ourselves before we ran it on you, and here is what we found.
Rarer than you would expect, and it is a credential
A clean result does not end the conversation, it starts a better one. Your listing says it in public. Then the question moves to every other site you touch, which is where it was always going.
Part two
Then every other site you touch
This is not a product to resell. It is a service you deliver, about a problem you are already blamed for, and it works on a site you have run for nine years or one you saw for the first time this morning.
Step 01
Run the scan
Three fields, their domain. Nothing installed, no access, no permission to ask for. It reads what a public page does.
Step 02
Bring them the finding
Not a verdict. A measurement, on a date, with a method. You are not accusing anyone. You are reading them their own page.
Step 03
Handle it
Consent that blocks before it asks. Disclosure that names what is running. A policy that matches. You do the work, or we do.
Step 04
Put it on a plan
Watched, verified on schedule, listed in public. It stops being a project you resell every year and becomes a line that renews.
The same ten checks, on a site you have never touched
Nothing in that sequence requires a relationship. No permission, no access, no code. That is what makes it useful twice.
Before the first pitch meeting
Run the scan on their domain.
You open with a finding on their own page. Nobody else pitching them will.
Before you agree to take a site on
Run the scan on what you are inheriting.
You find out whether it is a maintenance contract or four years of somebody else's exposure, priced as one.
No contract. No access. Just a domain.
What you actually say
“We ran ten checks on your site.”
“Six passed. Four came back with something.”
“This one has been running since March.”
“Here is what handled looks like.”
No accusation. No legal opinion. Just what the page did, and when. Site owners rarely argue with a measurement of their own page.
Every client is their own account
One client, one plan, in their name, with their own badge and their own registry listing. Not several sites parked inside one account.
Part three
And then the 50 percent. We put it here on purpose.
Most programs open with the commission, because the commission is the only thing they have. It is the third best reason on this page, so it goes third. It is still real money and it still pays every year.
Disclose
Client pays
$299 / year
from $24.92 a month, billed annually
You earn
$149.50
every year they stay
Verify
Most popular
Client pays
$849 / year
from $70.75 a month, billed annually
You earn
$424.50
every year they stay
Audit
Client pays
$1,650 / year
from $137.50 a month, billed annually
You earn
$825
every year they stay
Two Verify clients pay for your own Verify plan. $424.50 twice is $849. Your plan is $849. One flat rate on every plan, for every partner, on every account you bring. No tiers, no caps, no minimum volume.
Commission is shown annually because that is how it accumulates. A client who pays month to month pays you month to month, at the same 50 percent.
AI Risk Coverage is placed by SiteTrust as a licensed insurance agency. Partners do not sell, quote, bind or earn commission on coverage.
Your client can buy a consent banner anywhere. That is not what this is.
A banner is one control on one problem. Here is what sits around it.
A consent tool
A Trusted Site
Blocks trackers
Blocks trackers, and records what happened, on a date
A static badge, if any
A badge that reports the last scan and when it ran
Nothing anyone outside can check
A public registry listing, under the client's name
Consent only
Ten checks, including AI disclosure, opt-out, policy and legal pages
Nothing for what remains
AI Risk Coverage, with eligibility beginning at Verify
Watched. Fixed. Proven. Covered.
A note from the desk
I have run agencies and I have hired them. I know what it is to hand over a site you are proud of and watch it fill up with other people's decisions. I also know what it is to be handed one, told it is fine, and find out later what fine meant.
What is different now is that those decisions leave a record. Every tracker that fires before a visitor is asked, every AI tool answering questions with nothing on the page that says so, is observable from the outside by anyone who cares to look. People are looking. Filings are being made this month against sites doing exactly what a lot of your client sites are doing right now.
I am not going to tell you that your clients are breaking the law. That is not mine to say, and any vendor who says it to you is selling you fear instead of a record. What I will tell you is what we measure, when we measured it, and how. That is the whole business.
The reason I want agencies in this before anyone else is simple. A site owner finds out about this once, usually badly. You touch dozens of sites, so you find out dozens of times, and you are the only person in the chain who can fix it at scale instead of one panic at a time.
Start with your own domain. It costs you nothing and it takes minutes. Whatever comes back, you will know something about your own work that you did not know this morning, and you will have seen the exact report your clients would get.
Vinnie Fisher
Founder and CEO, SiteTrust
The questions agencies actually ask
Do I need my client's permission to scan their site?
No. The scan reads what a public website does from the outside, the same way any visitor's browser does. Nothing is installed, no access is needed, and no change is made to the site. The finding goes to the person who owns the site.
Am I reselling this under my own brand?
No. This is a referral relationship. The plan is the client's, in the client's name, with their own badge and their own registry listing. You are named as the partner on it and you earn 50 percent at signup and at every renewal. You keep the client relationship and the implementation work, and you carry none of the platform.
Do I have to be on a plan myself?
Yes, Verify or above. Your own registry listing is the credential. It is the one requirement in the program, and it exists so that no partner is ever recommending something they have not done to their own site.
My client already has a cookie banner. Are we done?
Run the scan and find out. Whether a banner exists is not one of the ten checks. Whether it blocks before it asks is, and so is what happens after a visitor accepts, what happens after a visitor declines, and whether any of it was written down as a timestamped record. That is four of the eight core checks, and a banner that appears after the trackers have already fired is one of the most common results we return.
Who does the fix work, me or you?
Whichever you prefer, and shops split about evenly. Some want the implementation hours and run it themselves with our consent tool and our documents. Others want the finding, the plan and the renewal without adding the work to their delivery team. Both keep the same 50 percent.
Is there a deadline I should be telling clients about?
There is a date, and it is not the reason to move. California's AB 566 takes effect January 1, 2027. The thing that matters is present tense: the site is doing what it is doing today, every day, and the record builds while the question sits. Lead a client with the date and you have handed them a reason to wait eleven months.
What does a scan actually return?
Ten checks, each coming back as a pass, a risk found, or checked and clean. The free scan gives you the summary and the counts. The evidence behind each finding, the fix path and the badge come with a plan.
How and when do partners get paid?
Monthly by ACH, 15 days after the month closes. Applications are approved in three to five business days. There is no cap on referrals and no minimum volume. Full terms, tax forms and the disclosure requirements are on the partner page.
What about insurance? Can I sell that too?
No, and no partner does. AI Risk Coverage is placed by SiteTrust as a licensed insurance agency. Partners and clients should know it exists and that eligibility begins with Verify. Quoting, binding and commission on coverage stay with the licensed agency.
Start with your own site
Ten checks, three fields, no card. See what a stranger sees, then decide what to do about every other site you answer for.
Hidden risks, handled. Trusted Site, earned. What remains, covered.
Partner program open to SiteTrust members on the Verify plan or above.