How to judge anybody offering to file your application

This is an awkward article to write, because we are one of the options. So take it as a checklist to use on us as readily as on anybody else, and note that the first test is the one that matters most.

The test that disqualifies fastest

Ask whether the outcome is promised.

LegitScript decides every application and publishes no estimate for how long a review takes. Nobody outside it can commit to an approval, and nobody outside it can commit to a date. A provider offering either is describing authority they do not have, and the question that follows is what else they are describing that way.

The honest version of a commitment is about the provider's own work: how long preparation and submission take, and how fast requests for information are answered. Those are promises about labour, and they are the only kind available.

The second test: what happens if you cannot be certified

Ask what they do if discovery finds a structural problem.

The application fee is charged when you apply and is not refunded whatever the reviewer decides, so filing an application that is expected to fail spends your money to learn something discovery already established. A provider whose answer is that they would file anyway is describing a business model rather than a service.

The answer worth hearing is that they would tell you before filing, and that some prospects are told to fix the model instead.

The third test: who does the website work

Most certification failures are presentation problems on the website rather than structural facts about the business, which means the claims audit is the largest piece of work in almost every engagement.

So ask specifically: do they read every page a patient can reach, including landing page variants, quiz result screens, email sequences, support macros and affiliate creative? Do they produce a fix list with owners, and a claims allowlist per product? Or does the engagement consist of completing a form from answers you supply?

A provider who does not look at your website is filing a form. That is a different and much cheaper service, and it should be priced like one.

The fourth test: correspondence

Two of the four factors LegitScript names as deciding review length are yours: how responsive you are, and whether your answers are sufficient. In a done-for-you engagement, they become the provider's.

Ask who answers a request for information, how fast, and what happens if the answer needs a document you do not have to hand. Ask whether they stay on the file until a decision, or whether the engagement ends at submission. The second model exists and it leaves you holding the part that decides the timeline.

The fifth test: what you get at the end

Certification is a state you maintain rather than a certificate you file. An engagement that ends with an approval and nothing else leaves the business exactly as able to lose it as before.

What should come back to you: the assembled document set, the claims allowlist, the fix list with anything outstanding, the state coverage matrix, and a plain statement of the maintenance obligations and their dates. All of it in a form your team can run without the provider.

Claims to treat as warnings

• A relationship with the certifier. There is no such thing to have, and claiming one is a claim about influence over a decision.
• A named approval date. See the first test.
• A published success rate. Unverifiable, and it invites the question of which applications were declined at intake to protect it.
• Fees that appear later. Ask explicitly what is included, per website, and what a second domain costs.
• No mention of your website. The strongest signal that the work is administrative.

Questions to ask about the price

Not whether it is high, but what it covers. Per website or per company. Whether the certifier's own fees are inside or outside it. What a second domain costs. What happens on a refiling. Whether expedited processing is included and whether they will tell you honestly when it is not worth buying.

What a denial actually costs is the arithmetic that makes this a smaller question than it looks, because for a business with live revenue the cost of a second cycle usually exceeds the difference between any two providers.

What to ask about how they work with your team

The engagements that go badly are rarely the ones where the provider was incompetent. They are the ones where nobody agreed who does what.

Ask who they need from your side and for how long. A provider who says they need nothing is describing a service that cannot audit your website or document your pharmacy relationship, because both require somebody in your building.

Ask what happens when the fix list needs engineering time. The answer that works is that they size and group it so it can be scheduled, rather than handing over a document of findings.

Ask how they handle a fact you would rather not disclose. Prior enforcement history, a thin state, an undisclosed domain. A provider whose instinct is to leave it out is exposing you to the worst version of the problem, since being found out converts a difficult disclosure into a credibility problem across the whole file.

When the answer is to do it yourself

A single domain, a simple catalogue, nothing blocked, no deadline, and a founder who enjoys detail: file it yourself. That case is real, and a provider unwilling to say so is selling rather than advising, which is why the honest scope of what a filing engagement is begins with what it does not cover.

The case for having it done is a multi-domain estate, a compounded or controlled category, something already blocked, or nobody who can own correspondence daily for the duration of a review.