---
url: "https://dfylegitscript.com/blog/where-a-certification-reviewer-looks-first"
title: "What is discoverable about your business, and who finds it"
description: "A LegitScript review compares four accounts of a business against each other, and the one applicants underestimate is the public record, because archived pages, registry filings, app listings and a staging domain nobody retired are all reachable without asking you a single question."
published: "2026-06-24T07:49:31+00:00"
modified: "2026-06-24T07:49:31+00:00"
---

# What is discoverable about your business, and who finds it

A LegitScript review compares four accounts of a business against each other, and the one applicants underestimate is the public record, because archived pages, registry filings, app listings and a staging domain nobody retired are all reachable without asking you a single question.

## Key takeaways

- The public record is the account of your business a reviewer can assemble without asking you a single question, which is exactly why it gets read first.
- Archived copies of pages you have already corrected remain reachable, so a claim removed last month is still evidence until the record around it changes.
- Your own job listings, app store entries and partner pages describe the model in words nobody in compliance approved, and they are read alongside the application.
- A staging domain, a retired brand and a registrar account nobody has audited are found with the same free tools you could point at yourself this afternoon.

Applicants prepare the answers. Almost nobody prepares for the questions that
never get asked, because the answer was already available. A review is an
investigation, and an investigation starts with what can be established without
troubling the subject.

This is not a list of anybody's methods, which nobody outside the certifier
knows. It is a list of what is discoverable about a telehealth business by
anyone competent and motivated, which is the right planning assumption.

## Your own website, including the parts you forgot

The obvious surface, read more thoroughly than most teams expect. Not the
navigation: every page reachable from anywhere, including landing page variants
still receiving traffic, quiz result screens, the shop, the terms, and the pages
that have not been touched since launch.

Also read with developer tools open. What loads on an intake page, which
analytics and advertising tags fire, whether a chat widget is present on a page
where a patient describes a condition. That is a privacy question before it is a
certification question, and it is visible either way.

## Everything the site used to say

Archived copies of web pages are trivially available. A claim removed last month
is still legible, and so is the version of the business that existed before a
pivot.

The practical consequence is not that old copy is held against you. It is that a
discrepancy between what you say now and what you said then is a question, and a
question you did not know was coming is answered badly. If your positioning has
changed, be the one who says so.

## The registrar and the DNS

Domain ownership, registration dates, name servers and the subdomains attached
to them. This is where undisclosed properties surface: the staging site that is
publicly reachable, the shortlink domain, the legacy brand from the pivot, the
regional domain registered for a market you never entered.

Every one of those should be on your own list first.
[The complete file](/blog/what-a-complete-legitscript-application-file-looks-like)
starts with the domain estate for exactly this reason, and pulling it from the
registrar rather than from the marketing team is the whole of the technique.

## Public registries and licence lookups

Corporate filings, officer records, registered agents, and the chain of
ownership where entities own entities. Professional licence lookups by state.
Pharmacy registrations and non-resident licensure. None of this requires your
cooperation.

Which is why a coverage gap is the wrong thing to hope goes unnoticed. If you
advertise into a state where no prescriber on your roster is licensed, that is
visible from two databases and a targeting screenshot.

## Enforcement and litigation records

Regulatory correspondence is frequently public. Our
[index of FDA warning letters](/research/glp-1-compounding-warning-letters)
covering compounded GLP-1 marketing exists because those letters are published,
searchable and permanent, and it keeps the tally current. Board actions, consent
orders and court filings are similarly reachable.

An open or historical matter attached to the business or a principal is not
automatically fatal. Concealing one converts a difficult disclosure into a
credibility problem that colours the entire file, which is the theme
[what disqualifies an application](/blog/what-disqualifies-a-legitscript-application)
returns to repeatedly.

## The channels you do not control but do benefit from

Affiliate and publisher pages driving into your funnel. Influencer and creator
content. App store listings and their screenshots. Marketplace profiles. Review
sites and the responses your support team wrote on them. Social accounts,
including the one an agency ran two years ago and never handed back.

All of it is part of the marketing surface, and the claims on it are read the
same way as the claims on your product page.

## What your own team publishes about the business

This is the category nobody audits, and it is often the most candid account of
the company anywhere.

Job listings describe the clinical model in plain language, sometimes more
plainly than the website does. Funding announcements name entities and
investors. Conference talks and podcast appearances describe how the intake
actually works. A founder's professional profile lists the previous venture that
the corporate filings also mention. Engineering blog posts name the fulfilment
partner.

None of that is a problem in itself. It becomes one when it describes a
different business from the one the application describes, and the usual cause
is age rather than dishonesty: a job listing written eighteen months ago
describes the model as it was then.

Before you file, read what your own company has published about itself in the
last two years, and reconcile it. It is a two-hour job and it removes an entire
category of question.

## Your partners, from the other side

The pharmacy that dispenses, the provider network that contracts your
clinicians, the platform that fulfils. Each has its own public record, and each
is describing your relationship somewhere: on its own website, in its
marketing, or in a filing.

Where those descriptions and yours differ, the difference is the finding. A
clinic describing its partner as an outsourcing facility while the partner
describes itself as a compounding pharmacy has created a discrepancy in its own
file without either party saying anything untrue.

## What to do about all of it

Run the exercise on yourself before anyone else does, and write down what you
find rather than fixing as you go.

- Search your brand, your product terms and your principals' names, and read
  three pages of results rather than one.
- Pull the domain list from the registrar and resolve each one.
- Look at archived copies of your product pages from a year ago.
- Read your own licence and registration lookups.
- Read what your partners say about you.
- Read your affiliate and creator content as though somebody else wrote it,
  because somebody else did.

Most businesses find two or three things. Almost none of them are serious, and
almost all of them would have cost a round trip during a review, which is the
arithmetic
[the rework loop](/blog/the-rework-loop-that-stalls-self-filed-applications)
is built on.

## Frequently asked questions

### Will an old version of my website be held against me?

Old copy is not the problem. An unexplained difference between what a business says now and what it said before is, because it generates a question. If your positioning or product has changed, say so in the application rather than leaving it to be discovered.

### Do I need to disclose a domain that only redirects?

A domain that merely redirects to a certified site generally does not need its own certification, but every domain the business owns should be disclosed. The distinction is between what gets certified and what gets declared, and the second list is always longer.

### Should I mention a regulatory matter that was resolved years ago?

Yes. Resolved matters are usually still discoverable, and a disclosed one is a fact with context attached. One that is found after going unmentioned is a credibility problem that affects how the rest of the file is read.

## Disclaimer

LegitScript is a trademark of LegitScript LLC. VeriScripts is an independent application-preparation service. It is not affiliated with, endorsed by, or certified by LegitScript LLC, and claims no sponsorship or partnership with it. We prepare, submit, and manage the application; LegitScript alone decides whether certification is granted. "LegitScript" is used here only to name the certification these applications are for.