Platform Audit
The Question
What is actually true about this company, and how would I know?
A proper platform audit takes a specialist a week. Most of what gets sold as an "audit" is a scanner run through a template — a list of findings nobody validated, graded by severity, which is not the question anyone is really asking. The question is whether what a company says about itself survives contact with the sources those claims rest on, and then whether the gaps can be fixed at all.
What I Built
Three layers, built over about four months.
The instrument. A nine-domain scoring engine — security, SEO, AI visibility, performance, content, UX, technical, POPIA, email security — that runs deterministically and writes a branded report. It runs in production behind autoalphaadvisory.co.za/audit and is the shared backend for two other products.
The orchestration. The engine is one input, not the audit. A run fires the engine, opens an evidence archive, and fans four research legs out to parallel agents: regulatory and securities position, on-chain and contract verification, claims verification, and the competitive field. The technical, visibility and design reads stay in the primary session, because those carry judgment and the cost of being wrong. Four to six hours end to end for a hundred-route property.
The instrument register. The part I'd defend hardest, and the part that took longest to earn. Every tool in the stack has a documented failure mode, each one an error actually observed rather than imagined. Headless browsers returning plausible accessibility counts for what was really an error page. A framework catch-all route answering 200 on every path, so a 200 on a sensitive file proves nothing until you diff it against a deliberately fabricated control. Per-page counters that accumulate across a crawl and overstate a number by twenty-six times. A DNS record checked at the subdomain when it lives at the apex.
The rule that came out of all of it: a failed measurement must never be recorded as a finding. A login overlay scoring 3/100 is not a bad score, it is no score, and it gets written down as unmeasured.
What I Learned
Findings sort better by fixability than by severity. A critical issue fixed in ten minutes and a critical issue only a regulator can resolve are not the same object, and grouping them by how bad they are hides the only distinction that matters. Four classes: copy and configuration, engineering, needs a decision or a third party, and not remediable at all.
That last class is a fact about the business rather than the website, and counting it decides what the audit even is. If it's empty, a remediation engagement is honest work. If it's material, the honest move is to decline the remediation and hand over the finding — being paid to improve the marketing of something that may not survive a regulator is not work worth having. Point the same classification the other way and it becomes the investor product, because unfixable facts are exactly what someone writing a cheque is paying to find.
Status
Live, and running. Three engagement shapes off the one engine: an audit and remediation track, an investor due diligence memo, and a competitive position audit that reads a company's named competitors on the same instruments, on the same day, to the same contract.