Sample report on a fictional listing. The product, seller and every quote are invented to show what a report looks like. This is not an audit of a real product.

Listing audit

Brightwell Contract Agent

Sold by: Brightwell Legal Systems, Inc
Type: SaaS contract, AI agent or tool
Read: 8 Oct 2026

New audit

Hard to buy from

Key readers cannot find what they need on the page.

Buyer questions answered: 1 of 12
Agent facts extractable: 50%
Findings: 7

Sum of 7 dimension scores, 19 of 70. The band is Nimbuy's reading of the scale, not a percentile and not an AWS measure.

Why the score is 27

The two weakest dimensions are technical clarity (1/10) and security signals (1/10). The model answers yes, partly or no for each criterion and quotes your page. Code verifies each quote and computes every score. The model never writes a number.

AI discoverability3/10
Biggest gap: Says what it does, for whom
Technical clarity1/10
Biggest gap: Names AWS services and integrations
Deployment clarity3/10
Biggest gap: Time to first result is stated
Security signals1/10
Biggest gap: Data location and region choice
Pricing clarity5/10
Biggest gap: Overage and limits explained
Private-offer readiness4/10
Biggest gap: Dimensions can be counted and ramped
Protocol and category fit2/10
Biggest gap: MCP / A2A declared

Who can read your listing, and who cannot

Buyers evaluate your page in different roles. AI search tools and agents read it too, and they only see what is written on the page.

Buyer readability

The 12 questions a buyer team asks before it replies.

1/12

answered on the page

Security reviewer

Where is customer data stored: which AWS regions, and can the customer choose?Not on the page
Missing: Where customer data is stored and whether the customer can choose.
Add: State the AWS regions used and whether they are selectable.
- Not on the page
  Searched the whole listing for AWS region, data residency, us-east-1 and found none.
Which certifications or reports can you share (SOC 2 Type II, ISO 27001, and so on)?Not on the page
Missing: Any certification or audit report.
Add: Name each certification and how a buyer obtains the report.
- Not on the page
  Searched the whole listing for SOC 2, ISO 27001, HIPAA, FedRAMP and found none.
How long is customer data kept, how is it deleted, and (AI products) is it used to train models?Not on the page
Missing: Retention, deletion, and whether contracts are used to train models.
Add: Add a one-sentence data-handling statement.
- Not on the page
  Searched the whole listing for retention, deletion, train and found none.

Procurement

What exactly is one pricing unit, in plain words?Partly
Missing: What a seat is.
Add: Define a seat in plain words.
- From the pricing
  “Platform subscription, 5 seats”
What happens if we go over what we bought?Not on the page
Missing: What happens above five seats.
Add: State the overage rule.
- Not on the page
  Searched the whole listing for overage, additional seats, exceed and found none.
What support and SLA come with this price (hours, response times, uptime)?Partly
Missing: Response times and any uptime commitment.
Add: Add response-time targets for each severity.
- From the support
  “Email support is available Monday to Friday.”

Technical evaluator

How is it deployed, and what do we need in place first?Not on the page
Missing: How it is set up and what must exist first.
Add: List prerequisites and setup steps.
- Not on the page
  Searched the whole listing for prerequisite, onboarding, set up and found none.
Which AWS services and third-party tools does it connect to, by name?Partly
Missing: The names of the tools and AWS services.
Add: Name each integration.
- From the long description
  “It connects to the document tools your team already uses.”
How long from subscribing to the first working result?Not on the page
Missing: Time from subscribing to a first working result.
Add: State it in hours or days.
- Not on the page
  Searched the whole listing for go live, time to value, first result and found none.

AI search

In one sentence, what does it do and for whom? (Test: the first 20 words of the short description)Partly
Missing: The answer is in the long description. The first 20 words of the short description say nothing concrete.
Add: Move the plain statement into the short description.
- From the long description
  “reads agreements for your team, flags risky clauses against your playbook, and drafts redlines for attorney review”
Which specific use cases does it solve, named in buyer words?Answered
Add: Repeat it in the title area and first highlight.
- From the long description
  “review inbound NDAs and vendor agreements faster”
What evidence backs the claims: numbers with a source or date, named customers, reviews?Not on the page
Missing: No named customer, no sourced number, no date.
Add: Add one named customer or one measured result with its source.
- From the long description
  “trusted by leading enterprises”

AI-agent readability

What an AI agent can extract from the page to recommend or call your product.

50%

extractable

8 facts an agent needs. A fact the seller states counts 1, one an agent must guess counts 0.5, one that is missing counts 0.

What it doesExtractable
Reads contracts, flags risky clauses against a playbook and drafts redlines for attorney review.
Who it is forExtractable
Legal operations teams.
Named use casesExtractable
Reviewing inbound NDAs and vendor agreements.
Integrations and AWS servicesMissing
An agent would find nothing for this on the page.
How it is deployedGuessable
A SaaS subscription. No setup path stated.
Security and data handlingMissing
An agent would find nothing for this on the page.
What one pricing unit isGuessable
A platform subscription for 5 seats. A seat is not defined.
How to call itMissing
An agent would find nothing for this on the page.

The three changes that move the most

Ordered by how many readers they unblock. Each one is tied to evidence from your own page.

1
A security reviewer finds nothing to clear.
Nimbuy heuristicHigh severityNeeds a fact from you
Legal teams handle confidential agreements. Without certifications, data location and retention on the page, the listing is dropped before a conversation starts.
The fix
Add one security paragraph with certifications and how to obtain the report, AWS regions, retention and deletion, and the model-training statement.
Evidence from your page
Not on the page
Searched the whole listing for SOC 2, ISO 27001, HIPAA, FedRAMP, AWS region, data residency, retention and found none.
2
The short description is brand language.
Nimbuy heuristicHigh severity
It is the text buyers and AI search read first. It names no use case, so it matches no search.
The fix
Rewrite the first 20 words as what it does, for whom, and the main use case.
Evidence from your page
From the short description
“reimagines how modern legal teams unlock the power of their agreements”
3
Pricing unit and integrations are undefined.
Nimbuy heuristicMedium severityNeeds a fact from you
Procurement cannot define what is being bought and engineering cannot judge fit.
The fix
Define a seat in plain words and name each integration and AWS service.
Evidence from your page
From the pricing
“Platform subscription, 5 seats”
From the long description
“It connects to the document tools your team already uses.”

What a rewrite looks like

Rewrites are generated on demand and only use facts from the listing page.

Title

25 chars

Brightwell Contract Agent

Short description

167 / 350 chars

AI agent that reviews inbound NDAs and vendor agreements for legal operations teams. Flags risky clauses against your playbook and drafts redlines for attorney review.

Highlights (3 of 3 allowed)

Flags risky clauses against your own playbook
Drafts redlines ready for attorney review
Connects to [CONFIRM: named document systems and AWS services]

Long description

656 chars

Contract work is slow because the answers are buried in documents. Brightwell Contract Agent reads agreements for your team, flags risky clauses against your playbook, and drafts redlines for attorney review. Who it is for: legal operations teams reviewing inbound NDAs and vendor agreements. Security and data handling: [CONFIRM: certifications and how to obtain the report, AWS regions used, data retention and deletion, and whether customer data trains any model]. Pricing: a platform subscription for 5 seats. [CONFIRM: what one seat is, and what happens above five seats]. Support: email support Monday to Friday. [CONFIRM: response-time targets].

Keywords

58 / 250 chars

contract review agent, NDA review, vendor agreement review

Measured checks

PASSShort description length: 167 characters (AWS limit 350).
PASSHighlights: 3 highlights (AWS displays up to 3).
PASSKeywords: 3 keywords, 58 characters (AWS: up to 3 keywords, 250 characters).
PASSStandard ASCII only: Dashes, curly quotes and bullets were converted to plain characters.
PASSNo unsupported adjectives: None found.
PASSNumbers, certifications and integrations are on your listing: Everything checkable in the rewrite traces to your listing or the facts you confirmed.

Confirm before you paste

Certifications held. Security reviewers look for them first
AWS regions used. Answers where customer data is stored
Security certifications. Not on your listing.
named document systems and AWS services. Placeholder in the rewrite. Replace it with a real fact or delete the sentence.
certifications and how to obtain the report, AWS regions used, data retention and deletion, and whether customer data trains any model. Placeholder in the rewrite. Replace it with a real fact or delete the sentence.
what one seat is, and what happens above five seats. Placeholder in the rewrite. Replace it with a real fact or delete the sentence.
response-time targets. Placeholder in the rewrite. Replace it with a real fact or delete the sentence.

Listing Optimize

Want it done and checked by a person?

$500 introductory price, 3 business days. A four-reader check, a rewritten listing and a co-sell kit or handover note. You approve every change and you click Submit.

Get Listing Optimize

Every criterion, with its evidence

Open a dimension to see how each criterion was judged and the exact text it rests on.

3AI discoverabilityThe short description is brand language: a buyer or an AI search tool cannot tell from it what the product does. The lon...

The short description is brand language: a buyer or an AI search tool cannot tell from it what the product does. The long description does name NDAs and vendor agreements, but that is buried and no claim has a source.

Says what it does, for whomweight 2Not on the page
- From the short description
  “reimagines how modern legal teams unlock the power of their agreements”
Names concrete use casesweight 2Partly
- From the long description
  “review inbound NDAs and vendor agreements faster”
Use cases are front-loadedweight 1Not on the page
- From the short description
  “delivering a seamless, next-generation intelligence layer for every contract”
Claims have evidenceweight 1Not on the page
- From the long description
  “trusted by leading enterprises”

Recommended action

Rewrite the first 20 words of the short description as: what it does, for whom, and the main use case.

Related findings: The short description says nothing a buyer can search for; Claims have no evidence behind them.

Field limits come from AWS. Judging use-case phrasing for AI search is a Nimbuy heuristic: AWS publishes no ranking weights.

1Technical clarityAn engineer cannot judge fit. No AWS service, no named integration, no description of what runs where.

An engineer cannot judge fit. No AWS service, no named integration, no description of what runs where.

Names AWS services and integrationsweight 2Not on the page
- From the long description
  “It connects to the document tools your team already uses.”
Explains how it worksweight 2Not on the page
- Not on the page
  Searched the whole listing for architecture, data flow, runs in and found none.
States interfaces and accessweight 1Not on the page
- Not on the page
  Searched the whole listing for REST API, SDK, webhook and found none.

Recommended action

Name the document systems and AWS services it connects to, and say how it is called.

Related findings: Integrations are described but never named.

3Deployment clarityThe delivery method is stated by AWS's own field, but nothing says what a buyer needs in place or how long until the fir...

The delivery method is stated by AWS's own field, but nothing says what a buyer needs in place or how long until the first result.

Delivery path is explicitweight 2Partly
- From the delivery method
  “Software as a Service (SaaS)”
Prerequisites are statedweight 1Not on the page
- Not on the page
  Searched the whole listing for prerequisite, requirements, permissions and found none.
Time to first result is statedweight 2Not on the page
- Not on the page
  Searched the whole listing for onboarding, go live, time to value and found none.

Recommended action

State the setup path in numbered steps with a realistic time to first result.

Related findings: No setup path or time to first result.

1Security signalsThe only security statement is a claim with no content. A security reviewer gets no certification, no data location, no ...

The only security statement is a claim with no content. A security reviewer gets no certification, no data location, no retention or training policy, and no access model.

Data location and region choiceweight 2Not on the page
- Not on the page
  Searched the whole listing for AWS region, data residency, us-east-1 and found none.
Certifications with evidenceweight 2Not on the page
- Not on the page
  Searched the whole listing for SOC 2, ISO 27001, HIPAA, FedRAMP and found none.
Retention, deletion and model trainingweight 2Not on the page
- Not on the page
  Searched the whole listing for retention, deletion, train and found none.
Access model and subprocessorsweight 1Not on the page
- Not on the page
  Searched the whole listing for subprocessor, access control, encrypt and found none.

Recommended action

Add data location, certifications with how to obtain the report, retention and deletion, and whether customer data trains models.

Related findings: No certification, data location, retention or model-training statement.

AWS requires data-handling disclosure through documentation or on request, not on the listing. What a security reviewer looks for on the page is a Nimbuy heuristic.

5Pricing clarityOne platform dimension described as '5 seats'. A procurement reader cannot tell what a seat is, what happens above five,...

One platform dimension described as '5 seats'. A procurement reader cannot tell what a seat is, what happens above five, or what support comes with the price.

Pricing unit defined in plain wordsweight 3Partly
- From the pricing
  “Platform subscription, 5 seats”
Overage and limits explainedweight 1Not on the page
- Not on the page
  Searched the whole listing for overage, additional seats, exceed and found none.
Support and SLA tied to priceweight 1Partly
- From the support
  “Email support is available Monday to Friday.”

Recommended action

Define a seat in one plain sentence, say what happens above five seats, and add response times.

Related findings: The pricing unit is '5 seats' with no definition.

4Private-offer readinessThe pricing is a single fixed bundle, so a ramped multi-year private offer has no dimension to ramp. The one description...

The pricing is a single fixed bundle, so a ramped multi-year private offer has no dimension to ramp. The one description is short and does not explain the unit.

Dimensions can be counted and rampedweight 2Not on the page
- From the pricing
  “Agent Platform”
Dimension descriptions are usableweight 2Partly
- From the pricing
  “Platform subscription, 5 seats”
Custom terms path is clearweight 1Partly
- From the listing page
  “Request private offer”

Recommended action

Split the platform fee into countable dimensions a buyer can be quoted a volume of, and describe each in full.

A Nimbuy judgement of readiness, not an AWS requirement. AWS allows custom durations and private-only dimensions in private offers.

2Protocol and category fitIt is listed as an agent but never says how an agent or another system calls it: no protocol, no inputs and outputs.

It is listed as an agent but never says how an agent or another system calls it: no protocol, no inputs and outputs.

MCP / A2A declaredweight 2Not on the page
- Not on the page
  Searched the whole listing for MCP, A2A, Model Context Protocol, Agent2Agent and found none.
Category is preciseweight 1Partly
- From the categories
  “AI Agents & Tools”
Agent capability is distinctweight 2Not on the page
- Not on the page
  Searched the whole listing for inputs, outputs, can be asked and found none.

Recommended action

Describe what the agent can be asked to do, what it takes in and returns, and declare MCP or A2A if it supports them.

Related findings: Agent listing with no declared interface.

AWS marks MCP and A2A declaration as optional. Scoring it is a Nimbuy heuristic.

7 findings, most serious first

Each is labelled by where its authority comes from, so you can tell an AWS rule from Nimbuy's judgment.

HighThe short description says nothing a buyer can search forNimbuy heuristic

Buyers and AI search tools match literal use-case phrases. 'Reimagines how modern legal teams unlock the power of their agreements' contains none, so the listing is hard to retrieve for 'NDA review' or 'vendor contract review'.

Fix: Open with what it does and for whom: 'AI agent that reviews inbound NDAs and vendor agreements for legal operations teams, flags risky clauses against your playbook and drafts redlines.'

From the short description
“reimagines how modern legal teams unlock the power of their agreements”

HighNo certification, data location, retention or model-training statementNimbuy heuristic

A security reviewer cannot clear this listing from the page. The only statement is 'built with security in mind', which a reviewer cannot act on. Legal teams handle confidential agreements, so these questions come first.

Fix: Add one security paragraph: the certifications held and how to obtain the report, the AWS regions used, retention and deletion, and whether customer data trains any model.

Not on the page
Searched the whole listing for SOC 2, ISO 27001, HIPAA, FedRAMP, AWS region, data residency, retention and found none.