Know what your website
says about your firm.
A digital risk assessment for South African law firms, covering LPC conduct rules, POPIA, security, SEO and whether AI tools mention your firm. Join the waitlist and we'll tell you when it opens.
How the digital risk
assessment works
No consultants, no back-and-forth. An automated pipeline produces the report, and a person checks it before it reaches you.
Enter Your URL
Enter your firm's website. No installation, no credentials, just a URL.
AI Analysis Runs
Seven pillars are assessed in parallel: discovery, conduct alignment, POPIA, security, SEO, AI visibility and path to action.
Report Generated
A branded PDF structured pillar by pillar, with findings, risk scores, and POPIA/LPC citations.
Action Plan Delivered
Prioritised remediation roadmap, quantified risk exposure, and competitive benchmarking.
What each pillar
actually checks
Each pillar runs a dedicated AI pipeline - not a checkbox assessment. Real browser simulation, real LLM probing, real regulatory citations.
Discovery
Phase 0Fingerprints your technology stack, subdomains, and the third-party scripts loading on your site, before a single assessment check runs.
- ▸12 third-party scripts fire pre-consent
- ▸WordPress 6.4 - 3 unpatched CVEs found
- ▸2 exposed admin panels: /wp-admin, /phpmyadmin
LPC Conduct
Phase 1Cross-references your website copy against LPC Conduct Rules, flagging superlative claims, missing disclaimers, and qualification assertions.
- ▸"Leading firm in SA" - flagged against the LPC Code of Conduct publicity rules
- ▸"Award-winning attorneys" - no citation
- ▸Missing jurisdiction disclaimer on 4 pages
POPIA
Phase 2Playwright-powered consent simulation: intercepts network requests, maps pre-consent tracking, reviews privacy policy completeness.
- ▸Meta Pixel fires 340ms before consent
- ▸Contact form submits PII without privacy notice
- ▸No data retention schedule published
Security
Phase 3Review of TLS configuration, HTTP security headers, exposed admin paths, and whether chatbot endpoints are exposed - observed from outside, without touching your systems.
- ▸CSP header absent - XSS unmitigated
- ▸HSTS not enforced on HTTPS connections
- ▸Chatbot discloses system instructions on prompt
SEO
Phase 4Lighthouse Core Web Vitals integration, structured data validation, schema markup analysis, and on-page signal extraction.
- ▸LCP: 4.8s - target is under 2.5s
- ▸Missing LocalBusiness schema markup
- ▸0 of 12 practice area pages indexed in AI
AI Readiness
Phase 5Citation probing across ChatGPT, Claude, and Google's AI Overviews and AI Mode. Measures citation frequency, sentiment, and cross-model consistency - AI Affinity Score (0–100).
- ▸ChatGPT: 0 citations across 12 queries
- ▸Google AI Overview cites competitor 7×, your firm 0×
- ▸AI Affinity Score: 14 / 100
Path to Action
Phase 6Traces the route from landing page to enquiry at desktop and mobile widths - contact routes, form reachability, and whether a phone number can actually be tapped.
- ▸No contact action above the fold at 390px
- ▸Enquiry form is three clicks from the homepage
- ▸Phone number rendered as an image - not tappable
A report you can
hand to a partner
Not a CSV export or a generic checklist. A PDF structured pillar by pillar, carrying your firm's branding, specific POPIA section references, LPC rule citations, and prioritised remediation actions.
Each Pillar Protects
Something Real
Findings identify observed gaps and practical next steps. Priority scores are internal indicators, not quantified probabilities of loss or enforcement.
Checks a generic
scanner does not run
Four proprietary analysis modules that go far beyond standard scan checks - turning your website into a measurable, revenue-generating asset.
Real phones. Real failures.
Research suggests the majority of legal queries are made on mobile. A button that's 2mm too small, a form that doesn't scroll, or a hero image that hides the phone number - these are conversion killers that only appear on real device viewports.
- Tests 4 device profiles - a small and a large iPhone, an Android phone and an iPad
- Measures touch target sizes against 44×44px WCAG minimum
- Detects horizontal scroll breakage, viewport overflow, and font legibility
- Maps each failure to a conversion impact score
Your Website Is a
Regulated Asset
Gaps in digital readiness carry real financial and professional consequences - and most law firms have no idea what's exposed.
Privacy controls need context
Tracking behaviour, collection notices and transmission safeguards are useful starting points. A public website review cannot determine the lawfulness of all processing or predict regulatory action.
LPC Disciplinary Risk
Publicity claims need context and support. The LPC Code permits specialist claims based on qualifications or experience, subject to the Council’s powers. Observations are questions for review, not findings of misconduct.
AI Search Invisibility
More than half of consumers now use or would use AI for legal questions (Clio, 2025). Without GEO optimisation and structured authority signals, your firm risks being invisible to the next generation of clients.
Competitive Disadvantage
Reviewing privacy, publicity and AI visibility together can reveal useful connections. An assessment can help prioritise improvements; it does not predict regulatory attention.
Built for SA Regulated Professionals.
Not Adapted for Them.
Generic assessment tools check for cookie banners. getohdit benchmarks against POPIA Section 18 requirements, LPC advertising guidelines, and whether Gemini cites your firm.
SA RAG Knowledge Base
Findings are LLM-generated over POPIA Act 4 of 2013, LPC Conduct Rules, and Legal Practice Act. Citations are verifiable, not boilerplate.
Browser Simulation
We simulate real users: detecting pre-consent tracking, intercepting network requests, filling forms, and capturing screenshots.
Chatbot Exposure Review
Checks whether a chatbot is reachable without protection and whether it gives legal answers without a disclaimer - undisclaimed legal advice via chatbot creates direct professional liability.
Multi-Model AI Visibility
We probe ChatGPT, Claude, and Google's AI Overviews with real queries. Results include citation frequency, sentiment, and an AI Affinity Score (0–100).
Commercially-Calibrated
Action points are detailed enough to demonstrate authority, calibrated to convert to implementation engagements.
Branded PDF Report
Your firm's logo extracted and incorporated into a professionally-designed report, organised pillar by pillar. Signals quality from the first scroll.
getohdit|Law - Roadmap
The intelligence report is Phase 0. Three Law-specific products follow - built for South African legal practices that want readiness posture as a permanent operating state, not a one-off exercise.
Monitor
An assessment is a snapshot. Sites change, and so do the rules. Monitor watches your firm’s public site every month and tells you what moved - a monthly delta report, score drift alerts, and LPC or POPIA changes that affect you.
- POPIA & LPC conduct monitoring
- Monthly readiness delta report
- Alerts on regulatory changes
- Track your score over time
Law Firm Website & Redesign
Websites built from the ground up for the South African legal market - POPIA-aligned, LPC-conduct-safe, AI-visible, and equipped with intake automation and readiness-safe copy from day one.
- Readiness-first design & copy
- AI search presence built in
- POPIA-ready consent flows
- SA legal market positioning
SA Law Knowledge System
A curated, AI-powered knowledge base of South African legal regulations, LPC conduct rules, POPIA precedents, and regulatory guidance - queryable by any subscribing firm. Built for practitioners, not theorists.
- SA-specific regulatory corpus
- LPC & POPIA case precedents
- AI-queryable regulatory guidance
- Continuously updated as law evolves
Not sure which product fits? Tell us about your firm.
Join the Waiting List →What this is, and what it is not
If you are signing this off on behalf of the firm, these are the answers you will be asked for.
In scope
- Publicly accessible pages on the domain you nominate
- Publicity wording reviewed against the LPC Code of Conduct, Part II paragraph 7
- POPIA consent behaviour observed in a real browser session
- Passive security posture: TLS, headers, exposed paths, cookies
- Search and AI visibility, benchmarked against comparable firms
Not in scope
- No authenticated areas, client portals or matter management systems
- No internal networks, email, or anything behind a login
- No active or offensive security testing - that is a separate engagement, scoped and authorised in writing
- No legal advice, and no legal opinion on your compliance position
- Not a formal audit or assurance engagement under any auditing standard
Governance
- Client assessments require authorisation for the named site; this does not authorise access to private areas or active security testing
- Contracting entity is Akkord (Pty) Ltd, registration 2026/467847/07
- getohdit is not a law firm and is not registered with the Legal Practice Council
- Automated checks and delivery gates are used; any human review is limited to the scope expressly agreed
Data handling
- Reports are not published without permission; content may be processed by AI, hosting and delivery providers as described in our Privacy Policy
- Personal information encountered is processed only to produce the report
- Ask us to confirm applicable processing terms and providers before sharing sensitive material
- Information officer: privacy@getohdit.co.za
You can share the report with your advisers or your professional indemnity insurer if you choose; how they treat it is up to them. It is informational and does not constitute legal advice, and it is not a formal audit. If you need a scoped engagement or a DPA in place first, talk to us - we reply within one business day.
Law firm digital risk assessment: common questions
What is a law firm digital risk assessment?
A review of what a law firm's public website shows, checked against the rules that apply to it: the LPC Code of Conduct, POPIA, website security, search visibility and how AI assistants describe the firm. It reads only the public site, needs no logins, and ends in a ranked list of what to fix first.
Does my law firm's website need to comply with POPIA?
POPIA can apply to personal information collected through a law firm website. Duties depend on the processing and circumstances, not simply the firm’s size. A public-site assessment cannot establish overall compliance, the applicable lawful ground or internal safeguards. Discuss findings with your Information Officer or qualified adviser.
What LPC conduct rules apply to a law firm website?
Paragraph 7 of the LPC Code addresses approaches and publicity, including misrepresentation, comparisons and naming clients, subject to its exceptions. Paragraph 8 permits specialist claims based on specialised qualifications or experience, subject to the Council’s powers. Public wording alone cannot establish the underlying facts; our observations are questions for review rather than findings of misconduct.
How is a getohdit assessment different from a general website check?
A general check looks at page speed and keywords. Ours cross-references your site against LPC Rule 7 clause by clause, simulates POPIA consent flows, probes AI assistants (ChatGPT, Claude, Gemini, Grok) for how your firm is cited, and runs security header analysis - producing evidence-backed findings specific to South African legal practices.
How long does the assessment take to complete?
Timing depends on site access, available data, external services and review. We confirm delivery arrangements before accepting an engagement. A report link is sent to your nominated email address; treat it as confidential and do not forward it publicly.
What is an AI Affinity Score?
A 0–100 score measuring how frequently and accurately your firm is cited by AI assistants when we ask them practice-area and location-specific questions. A low score means your firm did not surface in those answers - an increasingly common way prospective clients research attorneys.
Is getohdit a law firm or does it give legal advice?
No. getohdit is a technology platform, not a law firm, auditor, or regulated professional services provider. Reports are informational and evidence-based but do not constitute legal advice. Firms should consult their own attorney or compliance officer to act on findings.
Do you need access to our website's admin or hosting account?
No. The analysis covers your publicly accessible digital footprint only - the same content any visitor, prospective client, or regulator can see. No credentials, admin access, or backend data are required.
Can I see a sample report before purchasing?
Yes. A full illustrative report for a fictional firm, Van der Merwe & Partners, is available at getohdit.co.za/samples, along with worked examples. The firms and findings are invented and written to show the format and depth of a report.
Further reading: the sample report · LPC Rule 7 vs your website · POPIA and client data · the law firm website checklist
From our October field reports: law firm website mistakes · why your website isn't getting enquiries · law firms on Google Maps · all articles
Ready to Know Your Score?
Tell us about your firm and what you need reviewed. We’ll be in touch as soon as we open access.
Join the Waitlist →