Know what your website
says about your firm.
One assessment covering LPC conduct rules, POPIA, security, SEO and whether AI tools mention your firm. Enter your URL - the report is in your inbox within the hour, in plain language, with what to fix first.
From URL to Intelligence Report
in Under an Hour
No consultants, no back-and-forth. An automated pipeline produces the report, and a person checks it before it reaches you.
Enter Your URL
Enter your firm's website. No installation, no credentials, just a URL.
AI Analysis Runs
Seven pillars are assessed in parallel: discovery, conduct alignment, POPIA, security, SEO, AI visibility and path to action.
Report Generated
A branded PDF structured pillar by pillar, with findings, risk scores, and POPIA/LPC citations.
Action Plan Delivered
Prioritised remediation roadmap, quantified risk exposure, and competitive benchmarking.
What each pillar
actually checks
Each pillar runs a dedicated AI pipeline - not a checkbox assessment. Real browser simulation, real LLM probing, real regulatory citations.
Discovery
Phase 0Fingerprints your technology stack, subdomains, and the third-party scripts loading on your site, before a single assessment check runs.
- ▸12 third-party scripts fire pre-consent
- ▸WordPress 6.4 - 3 unpatched CVEs found
- ▸2 exposed admin panels: /wp-admin, /phpmyadmin
LPC Conduct
Phase 1Cross-references your website copy against LPC Conduct Rules, flagging superlative claims, missing disclaimers, and qualification assertions.
- ▸"Leading firm in SA" - flagged against the LPC Code of Conduct publicity rules
- ▸"Award-winning attorneys" - no citation
- ▸Missing jurisdiction disclaimer on 4 pages
POPIA
Phase 2Playwright-powered consent simulation: intercepts network requests, maps pre-consent tracking, reviews privacy policy completeness.
- ▸Meta Pixel fires 340ms before consent
- ▸Contact form submits PII without privacy notice
- ▸No data retention schedule published
Security
Phase 3Review of TLS configuration, HTTP security headers, exposed admin paths, and whether chatbot endpoints are exposed - observed from outside, without touching your systems.
- ▸CSP header absent - XSS unmitigated
- ▸HSTS not enforced on HTTPS connections
- ▸Chatbot discloses system instructions on prompt
SEO
Phase 4Lighthouse Core Web Vitals integration, structured data validation, schema markup analysis, and on-page signal extraction.
- ▸LCP: 4.8s - target is under 2.5s
- ▸Missing LocalBusiness schema markup
- ▸0 of 12 practice area pages indexed in AI
AI Readiness
Phase 5Multi-LLM citation probing across Claude, GPT, and Gemini. Measures citation frequency, sentiment, and cross-model consistency - AI Affinity Score (0–100).
- ▸ChatGPT: 0 citations across 12 queries
- ▸Gemini cites competitor 7×, your firm 0×
- ▸AI Affinity Score: 14 / 100
Path to Action
Phase 6Traces the route from landing page to enquiry at desktop and mobile widths - contact routes, form reachability, and whether a phone number can actually be tapped.
- ▸No contact action above the fold at 390px
- ▸Enquiry form is three clicks from the homepage
- ▸Phone number rendered as an image - not tappable
A report you can
hand to a partner
Not a CSV export or a generic checklist. A PDF structured pillar by pillar, carrying your firm's branding, specific POPIA section references, LPC rule citations, and prioritised remediation actions.
Each Pillar Protects
Something Real
Every finding maps to a quantified risk. Every recommendation protects a specific value - regulatory, reputational, or commercial.
Checks a generic
scanner does not run
Four proprietary analysis modules that go far beyond standard scan checks - turning your website into a measurable, revenue-generating asset.
Real phones. Real failures.
Research suggests the majority of legal queries are made on mobile. A button that's 2mm too small, a form that doesn't scroll, or a hero image that hides the phone number - these are conversion killers that only appear on real device viewports.
- Tests 8 real device profiles - iPhone 15 Pro, Galaxy S24, Pixel 8, and more
- Measures touch target sizes against 44×44px WCAG minimum
- Detects horizontal scroll breakage, viewport overflow, and font legibility
- Maps each failure to a conversion impact score
Your Website Is a
Regulated Asset
Gaps in digital readiness carry real financial and professional consequences - and most law firms have no idea what's exposed.
POPIA Fines Up to R10 Million
The Information Regulator has moved from awareness to enforcement. Pre-consent tracking, inadequate PII notices, and unencrypted form submissions all expose your firm to direct enforcement action.
LPC Disciplinary Risk
Superlative claims, specialisation assertions without certification, and missing jurisdiction disclaimers can all trigger LPC investigations. Defending a hearing costs more than this assessment.
AI Search Invisibility
More than half of consumers now use or would use AI for legal questions (Clio, 2025). Without GEO optimisation and structured authority signals, your firm risks being invisible to the next generation of clients.
Competitive Disadvantage
Most firms have never had their site assessed against POPIA, LPC conduct rules and AI visibility together. Knowing where you stand is the difference between fixing on your own schedule and fixing on a regulator's.
Built for SA Regulated Professionals.
Not Adapted for Them.
Generic assessment tools check for cookie banners. getohdit benchmarks against POPIA Section 18 requirements, LPC advertising guidelines, and whether Gemini cites your firm.
SA RAG Knowledge Base
Findings are LLM-generated over POPIA Act 4 of 2013, LPC Conduct Rules, and Legal Practice Act. Citations are verifiable, not boilerplate.
Browser Simulation
We simulate real users: detecting pre-consent tracking, intercepting network requests, filling forms, and capturing screenshots.
Chatbot Exposure Review
Checks whether a chatbot is reachable without protection and whether it gives legal answers without a disclaimer - undisclaimed legal advice via chatbot creates direct professional liability.
Multi-Model AI Visibility
We probe ChatGPT, Claude, and Gemini with real queries. Results include citation frequency, sentiment, and an AI Affinity Score (0–100).
Commercially-Calibrated
Action points are detailed enough to demonstrate authority, calibrated to convert to implementation engagements.
Branded PDF Report
Your firm's logo extracted and incorporated into a professionally-designed report, organised pillar by pillar. Signals quality from the first scroll.
getohdit|Law - Roadmap
The intelligence report is Phase 0. Three Law-specific products follow - built for South African legal practices that want readiness posture as a permanent operating state, not a one-off exercise.
Monitor
An assessment is a snapshot. Sites change, and so do the rules. Monitor watches your firm’s public site every month and tells you what moved - a monthly delta report, score drift alerts, and LPC or POPIA changes that affect you.
- POPIA & LPC conduct monitoring
- Monthly readiness delta report
- Alerts on regulatory changes
- Track your score over time
Law Firm Website & Redesign
Websites built from the ground up for the South African legal market - POPIA-aligned, LPC-conduct-safe, AI-visible, and equipped with intake automation and readiness-safe copy from day one.
- Readiness-first design & copy
- AI search presence built in
- POPIA-ready consent flows
- SA legal market positioning
SA Law Knowledge System
A curated, AI-powered knowledge base of South African legal regulations, LPC conduct rules, POPIA precedents, and regulatory guidance - queryable by any subscribing firm. Built for practitioners, not theorists.
- SA-specific regulatory corpus
- LPC & POPIA case precedents
- AI-queryable regulatory guidance
- Continuously updated as law evolves
Not sure which product fits? Tell us about your firm.
Join the Waiting List →getohdit across every regulated profession
Each vertical shares the same assessment engine - POPIA, Security, SEO, AI Readiness - with sector-specific conduct rules layered on top. Law is first to launch. The rest follow.
- LPC Conduct Rules
- POPIA + Consent
- Security
- SEO & AI Visibility
- Social Media
- POPIA + Consent
- Digital Marketing
- Brand AI Visibility
Interested in a vertical not yet live?
What this is, and what it is not
If you are signing this off on behalf of the firm, these are the answers you will be asked for.
In scope
- Publicly accessible pages on the domain you nominate
- Conduct wording assessed against the LPC Code of Conduct, Part III para 6
- POPIA consent behaviour observed in a real browser session
- Passive security posture: TLS, headers, exposed paths, cookies
- Search and AI visibility, benchmarked against comparable firms
Not in scope
- No authenticated areas, client portals or matter management systems
- No internal networks, email, or anything behind a login
- No active or offensive security testing - that is a separate engagement, scoped and authorised in writing
- No legal advice, and no legal opinion on your compliance position
- Not a formal audit or assurance engagement under any auditing standard
Governance
- Written authorisation is captured before anything is accessed, satisfying section 2 of the Cybercrimes Act 19 of 2020
- Contracting entity is Akkord (Pty) Ltd, registration 2026/467847/07
- getohdit is not a law firm and is not registered with the Legal Practice Council
- A person reviews the report before it is sent
Data handling
- Findings and report contents are treated as confidential and are not shared with third parties
- Personal information encountered is processed only to produce the report
- A data processing agreement is available on request
- Information officer: privacy@getohdit.co.za
Firms often share this report with their professional indemnity insurer as evidence of a proactive readiness posture. It is informational and does not constitute legal advice, and it is not a formal audit. If you need a scoped engagement or a DPA in place first, talk to us - we reply within one business day.
Questions law firms ask before an assessment
Does my law firm's website need to comply with POPIA?
Yes. Any South African website that collects personal information - through contact forms, chatbots, newsletter signups, or client intake portals - is subject to POPIA regardless of the firm's size. There is no small-practice exemption. Enforcement generally begins with an enforcement notice requiring remediation; failing to comply with that notice is what exposes the firm to an administrative fine, capped at R10,000,000 under Section 109(2)(c) of POPIA. Fines issued by the Information Regulator to date have ranged from R100,000 to R5,000,000.
What LPC conduct rules apply to a law firm website?
Rule 7 of the Legal Practice Council's Code of Conduct governs publicity in any medium, including websites and social media. It prohibits unsubstantiated specialisation claims, comparisons with other practitioners, naming clients without written consent, and anything that could bring the profession into disrepute. The LPC Conduct pillar checks your site against these clauses one by one and flags the wording that may not meet them.
How is a getohdit assessment different from a general website check?
A general check looks at page speed and keywords. Ours cross-references your site against LPC Rule 7 clause by clause, simulates POPIA consent flows, probes AI assistants (ChatGPT, Claude, Gemini, Grok) for how your firm is cited, and runs security header analysis - producing evidence-backed findings specific to South African legal practices.
How much does a law firm digital risk assessment cost?
One report, one price: Law Complete at R9,950, once-off in South African Rand, with no subscription and no added fees. All seven pillars are included, along with a passive security review, AI Affinity Score benchmarking against comparable firms and the full remediation blueprint. There is no cheaper tier that leaves findings out.
How long does the assessment take to complete?
Most law firm assessments complete in under an hour. You receive the full report via a secure link sent to the email address provided at checkout.
What is an AI Affinity Score?
A 0–100 score measuring how frequently and accurately your firm is cited by AI assistants when we ask them practice-area and location-specific questions. A low score means your firm did not surface in those answers - an increasingly common way prospective clients research attorneys.
Is getohdit a law firm or does it give legal advice?
No. getohdit is a technology platform, not a law firm, auditor, or regulated professional services provider. Reports are informational and evidence-based but do not constitute legal advice. Firms should consult their own attorney or compliance officer to act on findings.
Do you need access to our website's admin or hosting account?
No. The analysis covers your publicly accessible digital footprint only - the same content any visitor, prospective client, or regulator can see. No credentials, admin access, or backend data are required.
Can I see a sample report before purchasing?
Yes. A full illustrative report for a fictional firm, Van der Merwe & Partners, is available at getohdit.co.za/samples, along with worked examples for our law and brand verticals. The firms and findings are invented and written to show the format and depth of a report.
Ready to Know Your Score?
Tell us about your firm and what you need reviewed. We’ll be in touch as soon as we open access.
Join the Waitlist →