AEO audit for a B2B payments and AP automation company

The company

In a G2 survey of 1,076 B2B software buyers (March 2026), 51% said they start research in an AI chatbot more often than in Google, and 45% said citations from software review sites are the most confidence-inspiring signal in an AI answer. In a TrustRadius survey of 1,862 technology buyers, 63% used AI during their purchase, and 94% of those fact-check its answers at least some of the time (July 2026). Both publishers run review platforms, and neither survey is specific to payments software.

The questions buyers ask assistants

The panel follows AEO HQ's measurement design: 40 buyer intents, each written three ways (120 unbranded prompts), plus 20 branded prompts. Each prompt runs three times a week on each of the four assistants the audit measures (ChatGPT, Perplexity, Gemini, and Google AI Overviews), in a new chat with a clean session; the ten most important prompts run eight times a week. Results are reported as rates with error ranges, because ChatGPT and Google's AI returned the same list of brands less than once in 100 repeated runs (vendor study; 2,961 runs). The branded prompts also test the facts that carry legal weight: deposit insurance, licenses, and security reports. The table shows 13 of the 140 prompts; competitors appear as placeholders.

How the assistants reach the company

An assistant can cite a page through search only after its search system has crawled and indexed it. The diagrams show the documented routes; how AI assistants find and cite sources has the details.

• AI Overviews and AI Mode link to pages that are indexed and eligible for a snippet, and Microsoft says Bing and Copilot "rely on the same core crawling, indexing, and ranking foundation as traditional search".
• Sites that block OAI-SearchBot "will not be shown in ChatGPT search answers," and GPTBot, OpenAI's training crawler, is a separate setting. Claude-SearchBot and PerplexityBot are the search crawlers for Claude and Perplexity.
• A help center or trust portal on a subdomain has its own rules, because the robots.txt standard places the file at the top of each host.

Third-party pages carry much of the weight in software answers. In 680 million citations studied by a visibility-tracking vendor, G2 was among the ten most-cited domains on ChatGPT and Perplexity, and Gartner on Google AI Overviews and Perplexity (August 2024 to June 2025). In an SEO agency's study of about 1,000 decision-stage prompts, Reddit appeared in about 62% of responses, and "X vs. Y" pages and listicles were the most-cited formats (early 2026). Both publishers sell related services.

What the audit checks

Which rules apply

The audit first records which regimes govern the company's marketing, as working assumptions for counsel to confirm.

The claims register

The audit lists every claim on the site, in help docs, on review profiles, and on comparison pages, with the evidence each needs. Four kinds carry the most risk.

• Deposit insurance. A statement by a company that is not a bank is treated as omitting material information if it does not clearly and conspicuously name the insured bank or banks, say that the company is not an FDIC-insured bank and that insurance covers only the bank's failure, and say that pass-through coverage depends on conditions. The audit checks that these disclosures sit beside the claim, since an assistant may quote one sentence without the rest of the page (our inference).
• AI and accuracy claims. The FTC says there is "no AI exemption from the laws on the books", and its proposed order against Evolv prohibits misrepresenting "any material aspect of its performance, including the use of algorithms, artificial intelligence, or other automated systems". A "99.5% accuracy" claim needs its test: sample, document types, scoring method, and date. For claims like "tests prove," the FTC expects "at least the advertised level of substantiation" (1984; in force).
• Security and compliance claims. The AICPA's SOC logo is for organizations that received a SOC 1, SOC 2, or SOC 3 report from a licensed CPA; a SOC 2 is an auditor's report, so "SOC 2 certified" misdescribes it (our reading). In January 2025 the FTC alleged that GoDaddy misled customers by representing that it "deployed reasonable security".
• Comparisons, testimonials, and reviews. FTC policy encourages naming competitors but "requires clarity, and, if necessary, disclosure to avoid deception" (1979; in force). The Endorsement Guides say a consumer endorsement about a key attribute will likely be read as representative of what consumers generally achieve; the audit applies the same test to business customers' quotes (our reading). A rewarded reviewer's connection must be disclosed clearly and conspicuously. The FTC's guidance on its review rule does not say how the rule applies to reviews by business customers.

Pages, access, and facts

• Every host. robots.txt, firewall rules, and index coverage are checked for the main site, help center, developer docs, and trust portal.
• Facts in HTML. In Vercel's December 2024 data, none of the major AI crawlers rendered JavaScript, and Microsoft advises against relying on PDFs for core information. ERP details, payment timing, and currencies must be in page text.
• Pricing. In a survey by a search-marketing software company, 27% of U.S. B2B professionals who use AI said its vendor recommendations don't reflect real pricing or contract structures (519 respondents). The audit checks whether the pricing model is published.
• Entity. Organization markup with legalName and sameAs, and partner banks named the same way everywhere.
• Profiles. G2, Capterra, Gartner Peer Insights, and ERP marketplace listings are compared with one fact sheet.

Measurement setup

GA4 has a default AI Assistant channel, and ChatGPT adds utm_source=chatgpt.com to its links, but links from Claude's app carry no referrer. The audit checks that the demo form asks "How did you hear about us?" with AI assistants as options and stores the answer in the CRM. In one agency's records, first-touch attribution credited AI with 28 of the 189 leads who named an AI tool (single firm; weak).

Sample findings

These are sample findings for the hypothetical company, showing the form a finding takes. They describe no real company, and nothing in them was measured.

The deliverable

The report has nine parts, followed by a readout call.

1. Summary. Scope, dates, assistants tested, and the ten fixes to make first.
2. Method. The full panel, session controls, run counts, matching rules, and statistics.
3. Baseline measurement. For each assistant: mention rate, citation rate, share of voice against named competitors, and accuracy on branded prompts, each with a 95% interval. Accuracy on deposit insurance, licenses, security reports, and fees is reported separately. No pooled score and no rank.
4. Crawler access and indexing. A table by user agent and host, index coverage in Google and Bing, and the rendering check.
5. Claims register. Each claim, where it appears, the rule, the evidence on file, and suggested wording for counsel's review. AEO HQ flags; it gives no legal or compliance advice.
6. Third-party profiles. Fact mismatches across review sites and ERP marketplaces, and the domains assistants cite.
7. Content gaps. Each intent mapped to a page or marked as a gap.
8. Priority fix list and measurement plan. Every finding with impact, effort, owner, and evidence, and the plan below.
9. Run log. Every answer and citation from the baseline, as a spreadsheet.

Measurement plan

The plan follows how to measure AI visibility: rates use Wilson intervals, which suit small samples, and a change counts only when the interval for the difference excludes zero.

Engagement timeline

The pricing page gives the audit's current delivery time; this example assumes about two weeks from completed intake.

What this example does not show

• Results. No rates, citations, traffic, or pipeline figures, because the company does not exist. No study has measured how long changes like these take to show up in AI answers.
• Real prompts. A real panel comes from sales calls, support tickets, and Search Console queries.
• Legal conclusions. The scoping table records working assumptions, not rulings. Counsel decides, and state money transmission laws differ.
• Evidence specific to payments. The buyer surveys cover B2B software in general, and the citation studies come from companies that sell related services.
• Every assistant. Runs cover four assistants. Copilot and Google AI Mode appear only through Microsoft's and Google's reports, and Claude only through logs and referrals.

Next step

The audit's current scope, price, and delivery time are on the pricing page. The fintech industry page covers AEO for financial companies more broadly, and the methodology page gives the full measurement design.