Website Data Leak Audit
Know what your
website sends.
Find out which tools receive data from your forms and pages, with technical findings for your team and counsel.
First property $9,500Planned two weeks after written authorization, access and scope are agreed.
One request.
Three things to inspect.
Synthetic excerpt · no actual network request
No patient data or client incident
Illustrative network record
POST /collectA host: analytics.example payload page_path:B /appointment-request form_step: contactC Excerpt only. No submitted form values are shown.
- A Destination
- Which tool receives the request, and who controls its configuration?
- B Field and value
- A path name identifies a page. It does not, by itself, establish disclosure of patient information.
- C Missing context
- What consent state, triggering action and other fields accompanied this request? They are not established here.
How to read the findings
From record to report
Keep the observation
separate from the conclusion.
ObservedThe example includes a path and form-step label.
To establishActual values, destination, trigger and configuration in the authorized workflow.
For counselAssess the information and context against applicable requirements.
Field names alone do not confirm a leak. This example is not a legal determination, certification or evidence of a live incident.
The work you are buying
Evidence. Priorities.
A separate repair quote.
Evidence report
The tested workflow, destinations, fields and configuration questions.
Prioritized findings
Findings tied to the tests performed, with limits and uncertainty stated.
Remediation quote
Use the report with your team or agree implementation with us.
Week one Interviews, inventory and authorized synthetic sessions.
Week two Findings, priorities, remediation quote and walkthrough.
Access delays or scope changes can change the schedule. The audit is not a warranty that your site has no issues.
The boundary
is written first.
- First property
- $9,500
- Each additional agreed property
- $2,800
- Cap for the agreed property and test scope
- $24,500
- One-week rush, subject to availability
- +$3,000
- Remediation
- Quoted separately
The cap covers only the properties, representative pages, workflows, access levels and test rounds in the signed scope. Additional scope requires a separate written quote.
Discuss the audit scope
Which workflows concern you?
Tell us which public domains and workflows concern you. We follow up to agree the audit scope.
Business inquiries only. Please do not include patient names, dates of birth, medical details, passwords or other patient information in this form.
Questions about the audit.
What does a website data leak audit actually check?
We inspect network requests from representative pages and workflows agreed in writing, using authorized synthetic test sessions. The report records observed destinations, fields and configuration issues. Patient records, real visitor sessions and unsolicited access are outside the base scope. Your team and counsel assess the findings in context.
How much does the audit cost?
The first property is $9,500 and each additional agreed property is $2,800. The $24,500 cap covers only the properties, representative pages, workflows, access levels and test rounds named in the signed scope. It does not buy unlimited properties or testing. Additional scope needs a separate written quote. Rush delivery is subject to availability and adds $3,000; remediation is separate.
How long does it take?
Planned delivery is two weeks after written authorization, access and scope are agreed. Week one covers interviews, inventory and authorized synthetic test sessions. Week two documents findings, prioritizes fixes and prepares a remediation quote, followed by a walkthrough. Access delays or scope changes can change the schedule.
Is this a compliance certification?
No. The deliverables are technical findings, a prioritized fix list and an evidence report for your team and counsel. This is not a legal opinion, certification, attestation or warranty that the site has no issues.
Why do tracking pixels create legal risk?
Tracking can disclose page, form or account data to third parties. Whether HIPAA or another law applies depends on the information, organization and use. HHS published tracking guidance in 2022 and revised it in 2024. A federal court partially vacated that guidance in June 2024 as to an IP address combined with visits to certain unauthenticated public health pages. Your counsel assesses the legal implications of the observed data flows.
See HHS tracking guidance and its court-order notice. A public-page visit alone does not establish a HIPAA violation; your counsel assesses the information and context.