From one web address to a finding you could hand to a regulator.

One URL becomes one definite audit subject.

Redirects followed, apex vs www resolved, regional and language twins identified, dead or parked domains rejected rather than reported as "compliant". Every later object points back to this exact subject and run, so old evidence and new content can never mix.

What exists, and what actually happens.

Discovery maps every public surface: policies, pricing pages, forms, checkout and booking flows, PDFs, sitemaps, content hidden in accordions and tabs. Forensics then renders the site as a real browser and records what it does: cookies and trackers before consent, after reject, after accept; local storage; consent-platform state; network traffic; screenshots.

Every artefact is timestamped and hashed. And absence has a denominator: "privacy policy absent" can only be said once the surface where it should live was actually captured and examined.

Who is this, and what do they actually do?

Legal entity resolved against authoritative registers (Companies House, FCA, CQC, SRA, professional registers, DHA, RERA where relevant). Sector and sub-sector classified, multi-label where the business genuinely spans estates. Activities that trigger law are identified: AI use, review widgets, subscriptions, bookings, payments, health claims.

Not "what country are you in", but every legal connection.

Establishment (where you are registered), targeting (where you intentionally market: currencies, delivery countries, language variants, geo pages; one weak signal is never enough), and reach (whose data you touch: a Dubai hotel marketing to London can engage UK rules). Then the sub-jurisdiction layer: UK nations, US states, EU member states, UAE free zones. Capture then re-runs from those market vantages, so UK law is tested against UK evidence.

Six fail-closed gates between the law universe and you.

The law catalogue holds every instrument with its provision, regulator, penalty model, evidence requirements and freshness data. The Attachment Matrix projects it across the combination space. A law binds you only when every gate passes:

Some laws depend on facts a website cannot prove: employee counts, revenue thresholds, covered-entity status. The engine never guesses, attaches and accuses. It says "this law binds subject to X; X could not be verified from public evidence", then tries to resolve X from authoritative registers.

Every attached law becomes live, measurable tests.

Law → obligation → evidence requirement → machine test → expected result → proof standard. Ten test types: presence and absence, text content, page elements, network behaviour, browser state, interactions (does Reject All actually work?), register validation, accessibility, transport security, and semantic legal-risk signals.

Six detector families do the measuring.

Consent, cookies & tracking. Pre-consent fires, ignored rejections, missing or hidden Reject, consent-state forensics, pre-consent embeds, server-side tagging.

Privacy signals & rights routes. GPC and Do Not Sell/Share across US states, subject-access and objection routes under GDPR, UK GDPR and the Gulf regimes, notice at collection, session-replay exposure, health pixels on patient pages.

Notices, identity & e-commerce. Missing policies, trading disclosures, Impressum, obsolete ODR links, distance-selling information, Arabic-language consumer information, drip pricing, was-price claims, review practices.

Accessibility & security. Automated WCAG 2.2 failures, missing statements under the European Accessibility Act, ADA Title III exposure, transport-security issues.

AI transparency. Undisclosed chatbots, unmarked synthetic content, automated-decision disclosures.

Register validation. What you claim, an SRA number, an FCA authorisation, a state bar admission, a CQC registration, a DHA or DED trade licence, checked against what that register actually says.

A result is not a finding until its evidence survives re-reading.

Independent verification re-reads the whole artefact, re-checks the hash, the test definition, the catalogue release, the coverage. Failures cause rejection, not a best-effort finding. Then adjudication tiers the result: T1 measured breach (deterministic, verified, unambiguous), T2 conditional finding, T3 legal-risk indicator, which is never called a breach.

The result set is tri-state: pass, violation, or not assessed. A blocked checkout test means "law applies, breach not assessed", never "passes". A stale law can never produce a T1 breach; staleness fails toward under-claiming.

Citations are looked up, never generated.

Each finding joins the technical fact, the evidence, why the law binds you, the exact act and section, the obligation, the regulator, comparable enforcement from a curated record, the current penalty band, business impact and step-by-step remediation. If no directly comparable public enforcement exists, it says so: that is a valid answer. Inventing one is prohibited.

Then the loop starts again.

You get the executive summary, jurisdiction-wise findings, prioritised remediation with owners and deadlines, and the evidence vault. Monitoring continues on both sides of the radar: your website's changes, and the law register's changes: proposed → enacted → effective → amended → repealed. When either side moves, affected combinations re-test and you hear about it through your agreed channels.