Technical white paper · v1.0
Digital Audit: forensic SEO and advertising reports from evidence alone
How twelve evidence-gathering phases and a single, tightly boxed model call turn a business name into a PIN-protected report an owner can forward to their web vendor.
01Executive summary
Many small Australian businesses pay a monthly fee for web and search work they cannot easily judge. Digital Audit examines what a business's website and search presence are actually achieving and produces a report the owner can understand, and discuss with whoever looks after their website.
The system gathers evidence in twelve phases (technical SEO, publishing cadence, live Google positions, AI search visibility, advertising activity for the business and its competitors, third-party listings, and public social presence). Then one model call writes the report from that stored evidence and nothing else. The model never browses; it can only describe what was measured.
02The problem and the rules
The method began as a hand-run runbook in June 2026, executed by an AI assistant with browsing tools. It worked, but depended on whoever ran it. The standalone application, begun in July 2026, turned the runbook into a repeatable pipeline. Five rules carried across.
| Rule | What it means |
|---|---|
| Unmeasured is not zero | If a value could not be measured, the field is omitted. A report never shows 0 or none found for something that was simply out of reach. |
| Evidence only | The writer receives stored findings. No search volumes, revenue estimates or claims of absence are invented. |
| Passive only | It reads what a business publishes and what paid data sources return. It never logs in, submits forms or guesses hidden addresses. |
| Public social only | No authenticated access to social platforms. |
| Plain Australian English | Reports follow the Australian Government Style Manual. |
03Twelve phases, one writer
Each phase is its own module that stores structured findings and a cost. A failed phase is recorded and the run continues, with one exception: if the business's own website cannot be read at all, the audit stops, because writing a confident report about nothing is worse than no report.
Phases run in a worker pool that claims queued jobs from the database, so two audits can run side by side without colliding. Progress streams live to the operator's screen; a reconnecting browser sees current state without replaying history.
04Three report types
| Type | Input | Output |
|---|---|---|
| Audit, Part A | A business with a website, plus the questions a customer would search | Full forensic report on site, search, ads and presence |
| Audit, Part B | A business with only a name | The competitor picture and what a credible presence would look like |
| Prospecting | An industry and a suburb | Businesses found through mapping data, each scored 0 to 100 for web weakness (higher means more room to improve). One click promotes a prospect to a full audit. |
| Sector brief | An industry and a state | Regulatory obligations and the cyber threat picture, each claim cited to its source. Briefs are general information, not legal advice. |
A site that cannot be reached is marked unreachable, never scored as weak. A business with no website at all is the strongest lead signal. Prospect scanning uses no paid search quota, so it is cheap enough to run speculatively.
05Delivering a report safely
The finished report is a single self-contained page: no external fonts, one script, screenshots embedded, print-clean and Okavyx-branded in a case-file style with data set in monospace. It is stored whole, so deleting the audit that produced it never breaks a link already sent.
Links expire on their own and can be revoked at any time. The operator sees whether and when a report was opened, so they know the report has been read.
06Security and ethics
- The operator wall. Everything except the health check, sign-in, and public report pages sits behind passkey sign-in with an allow-list check. Every route’s access rule is tested.
- Outbound fetches are bounded. A single fetch routine caps size and time, refuses private and internal addresses, and re-checks every redirect hop.
- Unguessable report addresses built from random bytes, with throttling on PIN attempts.
- Secrets stay out of code. They are read from files first, environment second, and are never written to logs.
- Deliberate limits. It is not a due-diligence tool for judging a business on someone else's behalf, and not an outreach tool: it finds and audits, and it does not send messages to anyone.
07Honest failure
Two early incidents shaped the design. In the first, a disguised browser identity that had drifted eighteen versions out of date made one audited site's firewall refuse the screenshot, and the report then critiqued a 403 Forbidden page as if it were the homepage. The fix was to stop pretending: the browser now reports its true version, checks the response status, retries once as itself, and the writer is told to say plainly that a block occurred and keep it out of its conclusions.
In the second, a one-word property mismatch meant competitor websites had never been successfully fetched across every audit run to date: zero of 28. The report simply left the section out, which hid the fault. Tests now assert the section exists whenever its data does.
08Lessons
- Separate collecting from writing. A writer limited to stored evidence cannot hallucinate beyond it.
- Never let a failure look like a finding. Omit what you could not measure.
- Tell the truth to the network. An honest identity outperformed a disguise.
- Iterate without spending. Real report bodies were captured as fixtures so the design could be reworked at zero cost.
- Settle the design on real samples. Layout and typeface were agreed on full-length samples before any further build.
09Appendix: facts and figures
| Item | Value |
|---|---|
| Method first run by hand | June 2026 |
| Standalone application begun | 19 July 2026 |
| Stack | Node.js with Express, a Svelte single-page front end, PostgreSQL, headless Chromium for rendering and PDFs |
| Cost per full audit | A few US dollars in data and model calls; a sector brief roughly 60 to 90 US cents |
| Report lifetime | Time-limited access per PIN entry; links expire and can be revoked |
| Tests | 335 passing at last verification |
Our work is always evolving, and so are the AI vendors and their products. Nothing described here is set in concrete. Each paper describes its system as it stood in October 2026, when it was written; the date shown is when the app was first built.