The buyer’s checklist · 18 October 2026
How to choose an AI visibility tool
Ask for evidence, not a bigger score. A useful AI visibility tool should make its measurements, costs and responsibilities easy to inspect.
Trace the measurement
One figure. Its original answers. The same dated sample.
Know the commitment
The total cost, limits, renewal and exit terms.
Check the responsibility
A real operator, clear data practices and specific security evidence.
Not every team needs SSO, a public status page or every possible engine. Judge the tool against the intended use, and ask for evidence of the claims it actually makes. A missing feature is not proof of misconduct.
01
Measurement: is the data real?
Request a sample report and trace a headline figure back to its original answers.
- Which engines are tracked by name, and which are included on each plan? Is the actual consumer answer engine being measured, rather than a substitute model?
- Does it explain whether readings use live web search or built-in knowledge, and keep different modes separate?
- Does it distinguish being mentioned from being recommended, rather than blend them into one score?
- Can you inspect the exact question, answer, engine, sources and capture date behind each figure?
- Are sample sizes and denominators visible? Do pages agree when they refer to the same dated reading?
- Does it keep no answer, not mentioned and namesake confusion separate, without crediting another business's recommendations?
- Are at least some questions asked without the brand name, as a buyer would ask them? Who chooses the questions and markets?
- Is the methodology dated and its limits clear? If confidence ranges or industry averages are claimed, are their calculations and comparison samples explained?
02
Pricing: are there surprises?
Request the total checkout amount, renewal terms and a link to the cancellation and refund rules.
- Are prices, VAT treatment, billing currency and included brands and seats stated before checkout?
- Are credits, question limits, refresh frequency, engine add-ons and extra charges explained? Flat pricing can still have usage limits.
- Can you inspect a real example or try a free report without supplying a payment card?
- Is there a written refund policy saying who qualifies, the time limit and how to request it?
- Can you cancel online? What happens to access and data after cancellation?
- Are automatic renewal, annual commitment, renewal pricing and the cost of adding or removing brands clear?
03
Accountability: who is behind it?
Match the legal identity in the terms with the checkout and invoice. Verify the company in its official register.
- Is there a named legal company, registration number, registered address and country?
- Are the operator and support arrangements identifiable, rather than an anonymous website?
- Can you reach support and raise privacy or security concerns through published contact details?
- Who is the contractual seller and who issues the invoice? Is a merchant of record involved, and is tax treatment explained?
04
Privacy: what happens to the data?
Ask for the privacy notice, relevant processing agreement and an up-to-date list of subprocessors and AI services.
- Where consent is required, are optional cookies and tracking off until agreement, with a genuine reject option and a way to change the choice?
- Does the privacy notice identify who controls the data, what is collected, why it is used and the applicable UK or EU GDPR rights?
- When the vendor acts as a processor, is an appropriate data processing agreement available?
- Which hosting, analytics, payment and AI services receive data? Are subprocessors and international-transfer safeguards disclosed?
- Where is data stored and processed, including onward AI processing? Are retention and backup-deletion periods explained?
- Can you export useful records and request deletion? What is retained for legal obligations, and what cannot be deleted immediately?
- Are AI training, provider retention, resale and confidential-input rules explicit, rather than covered by a blanket 'private' claim?
05
Security: are the claims specific?
Ask which organisation holds each certification, its scope and current date. Infrastructure certification is not product certification.
- If SOC 2 or ISO 27001 is cited, who holds the report or certificate and does its scope cover the service being used?
- Are payments handled by a payment provider with documented PCI compliance, without the tool storing full card details?
- Are encryption in transit and at rest documented, along with who can access customer data?
- Are account protection, access roles, seat permissions and access removal appropriate for the team? Is two-factor sign-in or SSO available if required?
- Is there a published security contact or vulnerability-reporting process, with a clear incident-notification approach?
- Can the vendor provide service-status information, backup and recovery arrangements, or relevant service commitments?
06
Website tracking: is the snippet safe?
Request the snippet's data fields and inspect an example request before installing it. This section applies only if tracking is offered.
- What does the snippet send: full URLs, query strings, IP addresses, device signals or identifiers? Does it avoid collecting unnecessary personal data?
- Does it use cookies or browser storage, and is any required consent obtained? Cookie-free does not automatically mean personal-data-free or consent-free.
- Are claimed AI crawler visits verified beyond a user-agent label, and are unknown or unverifiable visits labelled honestly?
- Is the script lightweight and removable, with no hidden third-party tracking? Is a no-snippet measurement option explained?
07
Red flags: promises instead of proof
One missing document is a question to resolve, not proof of misconduct. Repeated evasive answers are a reason to pause.
- Guaranteed '#1 in ChatGPT' rankings or guaranteed recommendations, without control over the answer engines.
- Precise uplift statistics, scores or industry averages with no traceable source, dates, sample or method.
- Testimonials, reviews or customer logos that cannot be traced or independently checked.
- Artificial urgency, unexplained renewal charges, or unwillingness to provide terms and a named seller before payment.
- A small-business product with no clear price or limits. Bespoke enterprise pricing is different: request a written quote and scope.
Apply the same standard to Seenford
Start with the documents. Then inspect a real report.
Seenford publishes its measurement method, pricing and terms, and provides a no-sign-up example workspace. Those are evidence to inspect, not a claim that every security or compliance requirement has been independently verified.
If procurement needs a processing agreement, a named subprocessor list, current infrastructure assurances or a detailed deletion schedule, request the relevant documents before purchase. This guide is not a compliance certificate or legal advice.
Questions buyers ask
How do I know if an AI visibility tool is legitimate?
Check a dated sample report, trace its numbers to original answers, verify the legal operator and read the pricing, privacy and cancellation terms. A polished site or a large visibility score is not proof. Ask the vendor for the missing evidence before committing.
Is AI visibility tracking GDPR compliant?
It depends on what personal data is processed, the parties' roles, lawful bases, contracts, consent where required, retention and international transfers. Tracking public brand answers does not exempt account data or website tracking from privacy law. A privacy policy alone is not proof of compliance.
Which AI engines should an AI visibility tool track?
Start with the engines the audience actually uses. Common services include ChatGPT, Google Gemini, Google AI Overviews, Perplexity, Microsoft Copilot and Anthropic Claude. Ask exactly which service is sampled, whether web search is used and how location and question selection affect results. More engines do not automatically mean better evidence.
Can an AI visibility tool guarantee recommendations?
No vendor can guarantee how independent answer engines will respond. A credible tool can record a baseline, identify evidence gaps and compare later readings, while explaining variation and the limits of attribution.
Does SOC 2 infrastructure mean the tool itself is certified?
No. A hosting provider's assurance report covers the provider and a defined scope, not every application built on it. Ask for the exact organisation, report or certificate, scope and date. SOC 2 is an assurance report, not a blanket product certification.