Agency Guide: Choosing a Certified AI Visibility Platform for Client Data in 2026

Key takeaways

• "Certified" is used loosely by AI visibility vendors. Ask for the actual SOC 2 report and check whether it is Type I or Type II, and whether the vendor is certified or only "working toward" it.
• Agency fit matters as much as security: per-client workspaces, pitch environments that convert into client accounts, white-label reports, and pricing that scales per client rather than per account.
• Vendors' own pages often contradict each other on plans, engines and API access. Get everything that matters in writing.
• Answers are crowded and noisy. Promptwatch Data found 47.6% of ChatGPT responses cite 10 or more domains, so a platform that reports on a handful of single prompts will mislead you.
• Typical agency platform spend is roughly $100 to $800 a month before enterprise contracts, extra domains or credits. Compare cost per active client.

Why certification matters more for agencies

When you run AI visibility for one in-house brand, a data leak is your own problem. When you run it for twenty clients, you are holding their competitive prompts, their sentiment data, their traffic and crawler logs, and sometimes their Search Console connections. A vendor problem becomes a client problem, and the client will call you, not the vendor.

That is why the platform decision for an agency is different from a brand decision. One buyer's guide put it well: if you are building AEO as a service line, the platform you choose matters more than it does for a single in-house brand. You are inheriting its security posture, its pricing model and its roadmap, and reselling all three.

There is a second reason to be careful. This category is young, and most vendors are small. Scrunch was acquired by Sitecore in June 2026. That is not necessarily bad news, but it is exactly the kind of event that changes contracts, data processors and roadmaps under you.

What "certified" actually means (and what it doesn't)

I would treat the word "certified" on a vendor's website as a claim to verify, not a fact. A few distinctions do most of the work.

SOC 2 Type I vs Type II

Type I says a vendor's controls were designed properly at a single point in time. Type II says an auditor watched them operate over a period, usually six to twelve months. For client data, Type II is the one to ask for. Type I is a reasonable early-stage milestone, but it is not the same thing.

"Compliant", "working toward" and "certified"

These are three different statuses. The seoClarity comparison of enterprise platforms flagged that in July 2026 Peec described its status as "Pursuing SOC 2 (not yet certified)". It also noted that Profound's own pages use "compliant" in some places and "certification" in others, and recommended asking for the actual report. That is sound advice for every vendor on your shortlist.

Other certifications you might see

ISO 27001 covers an information security management system. Conductor is reported to hold SOC 2, ISO 27001 and ISO 42001 (the AI management standard). Profound is reported to hold SOC 2 Type II with SSO and SCIM, and one comparison also lists ISO 27001, GDPR, HIPAA, PCI, FedRAMP and CSA STAR Level 1. Scrunch says it has completed a SOC 2 Type II audit.

Treat all of that as third-party reporting. I did not find an independent audit of any vendor's certifications, and I could not locate official trust-center pages for Peec, Profound or Scrunch. Verify directly.

A due-diligence checklist for client data

Before a contract, send every shortlisted vendor the same list of questions. The get3rd buyer's checklist is a good base, and these are the ones I would not skip:

• Can you send the SOC 2 report itself? Is it Type I or Type II, and what period does it cover?
• Which plan includes single sign-on, and which includes role-based access?
• Where is data stored, and in which regions?
• Which AI providers process our data? Does any of it train public models?
• What happens to client data when a client leaves or we cancel? Can a workspace be exported and deleted?
• Can a client workspace be fully isolated from the others, including users and API keys?
• What is the policy if the vendor is acquired?

Put the answers in a shared document and keep it. When a client's procurement team sends their own security questionnaire, you will be glad you already have it.

Agency features that separate platforms

Security gets you on the shortlist. Agency features decide whether the platform is workable across a portfolio.

Workspaces and pitch environments

Per-client workspaces are the baseline. The ones worth paying for add pitch environments, so you can pull up a prospect's AI visibility live on a sales call and promote that pitch into a full account when the contract lands. Profound's Agency Mode and Peec's 7-day pitch projects both work this way, and Promptwatch's agency plans include pitch projects too.

White-label reporting

Check whether reports can carry your branding, whether they can be scheduled, and whether there is a client portal. Some tools charge extra for this. Semrush, for example, lists white-label reports as an add-on (My Reports Pro at +$20/mo) and has no reseller margin programme. Otterly runs an Agency Partner Program with white-label reporting and centralized billing.

Integrations that save hours

Looker Studio, Slack, an API and MCP access matter if you already build client dashboards. Confirm which plans include them. Vendors' own pages frequently contradict each other here, as the seoClarity comparison pointed out, so get API and MCP eligibility in writing.

Does the platform help do the work?

A platform that only tells you a client is invisible still leaves you with the job of fixing it, which is where your hours go. Agencies that want to scale the service need something that turns findings into actions, whether that is content generation, a prioritised to-do list, or publishing into the client's CMS.

Can you trust the data?

Security is one question. Data quality is the other, and it is where I see agencies get burned.

Real interface or API

Some platforms capture answers from the consumer chat interfaces people actually use, others query APIs. User-facing answers and citations can differ from API output, so ask which one each vendor uses and in which countries.

How prompts are counted

One vendor counts a prompt once regardless of how many models it runs on. Another counts it once per model and per market. Ask every vendor to state its prompt count in the same form, otherwise a plan with 100 prompts and a plan with 150 prompts may not be comparable at all. Peec's credit system, where one credit is roughly one prompt on one model for one day, can burn through a pool quickly if you track too many models.

Answers are crowded and noisy

Promptwatch Data's report on unique domains per ChatGPT response (Sep 28 to Oct 4, 2026) found that 47.6% of responses cite 10 or more domains and 66.1% cite at least 8. Only 6% cite three or fewer. For brand-specific prompts the picture is tighter: only 21.3% cite 10 or more domains, and five is the most common count.

What that means for you: a single prompt tells you little. Look for platforms that aggregate metrics across many prompts, track position and description rather than bare presence, and show co-cited competitors. Ask how often runs are repeated too. AI models are probabilistic, and a platform that runs each question once a week cannot separate real change from noise.

Every score should also open into the underlying answers and cited sources. If you cannot click from "visibility dropped 8 points" to the answers that changed, you cannot explain it to a client.

Methodology moves quickly

Promptwatch Data's ChatGPT query fanout report shows average query length falling from about 117 characters in early December to about 53 in April, and fanouts per response shifting from 2.15 to 1.84 to exactly 1.0 in April. Tracking methods that were right in December may be wrong now. Ask each vendor how often they re-validate their methodology.

Vendor comparison for agencies

Pricing below comes from third-party comparisons published in 2026 and conflicts between sources are common. Treat it as a starting point and confirm on each vendor's live pricing page.

For Promptwatch, pricing is from its published plan structure; confirm at promptwatch.com/pricing before quoting a client.

The main contenders, briefly

Promptwatch

Promptwatch is the platform 1001 SEO Media uses, so factor in that bias. It tracks the real interfaces of ChatGPT, Google AI Overviews, AI Mode, Gemini, Perplexity and Copilot, and its agency tiers (Kick-off, Growth, Scale) include unlimited projects and prompts, pitch projects, white-label reporting and IP-verified AI crawler logs. Where it differs from monitoring-only tools is the action layer: an Action Board of prioritised tasks, a Content Agent that can publish to WordPress, Webflow or Framer, and tracking of whether each published page then gets crawled, cited and clicked. That closes the gap between report and result, which matters when you are billing for outcomes.

Profound

Profound is the heavyweight on the enterprise side, with Agency Mode, Prompt Volumes, Agents and Agent Analytics. The seoClarity comparison flagged its inconsistent language on SOC 2, and SearchEye ranks it low for white-label agency use because of the learning curve and opaque agency economics. Strong product, but ask hard questions about what an agency actually pays.

Peec AI

Peec is popular with agencies for its unlimited client seats and pitch projects. It is a monitoring tool without the optimisation side, and its security status was "pursuing SOC 2" in mid-2026. Fine for lighter-touch clients, but not if a client's security team insists on a certificate.

Scrunch

Scrunch claims a completed SOC 2 Type II audit, which is a plus. The Sitecore acquisition raises roadmap and contract-continuity questions, and the 7-day trial needs a card and auto-converts to paid, so set a reminder.

Semrush

If your clients already live in Semrush, the AI Visibility Toolkit is convenient. At $99/mo per client domain with 25 prompts each, the per-domain pricing scales badly across a big roster.

Otterly.AI

Otterly is a low-cost tracker with an agency partner programme. Reasonable for small rosters that only need monitoring and branded reporting.

Conductor

Conductor is the enterprise option for agencies serving large clients who ask about ISO 42001 and similar standards.

You can browse many more options in the GEO software directory at bestgeosoftware.com.

What other agency buyer guides say

Several agency-focused roundups appeared in 2026. They are useful, but read them with the author's incentive in mind. Yotpo's list of AI visibility tools for agencies puts its own Discover product first, and Profound's list puts Profound at the top. Both make fair points. Yotpo notes that e-commerce clients want their exact SKUs named with buy links, and that organic rankings can hold steady while referral revenue slips, backed by BrightEdge's finding that only 16.7% of AI Overview sources overlap with the organic top 10.

The get3rd checklist is the most neutral source I found, and its 14 criteria are grouped sensibly: can I trust the data, does it explain the result, can we act on it, and does it fit our company.

Pricing: compare cost per active client

Typical agency platform spend runs from about $100 to $800 a month before enterprise contracts, extra domains, credits or publisher costs. The trap is comparing sticker prices. Do the sums per active client instead:

1. Count how many clients you will realistically put on the platform in the next 12 months.
2. Work out the prompts and models each one needs. A consumer brand with a big catalog needs more than a B2B niche player.
3. Ask how credits, extra projects or additional engines are billed once you pass the plan limit.
4. Check whether pitch projects are free or count against limits.
5. Ask about annual billing. Several vendors give around 15 to 17% off.

If you are billing clients a monthly retainer for AI visibility, the platform cost is a line in your margin. A tool that is cheaper per account but needs three hours more manual work per client is the more expensive tool.

Red flags during evaluation

• The vendor will not share a SOC 2 report, or only describes it in marketing language.
• Plan limits on the pricing page do not match the ones in the sales deck or the help center.
• Recommendations that would fit any company and do not name your client's competitors, pages or cited sources.
• No way to export or delete a client workspace.
• Scores that cannot be traced back to real answers and cited sources.
• A trial that needs a credit card and converts silently.

A practical selection process

1. Write down who will act on the findings and how many hours a week they have. This decides whether you need a monitoring tool or one that helps do the work.
2. Shortlist three or four platforms based on agency features and client mix.
3. Send every vendor the same security and data-handling questionnaire.
4. Run a two-week pilot on one real client and one pitch. Compare the data, not the demo.
5. Get plan limits, API access and engine coverage confirmed in writing before signing.
6. Review at six months. Methods change fast.

If you would rather not build the AI visibility practice yourself, agencies like 1001 SEO Media offer GEO and AI search services built on this same kind of tooling.

Bottom line

Treat the word "certified" as the start of a conversation. Ask for the report, check the type and date, and confirm where client data lives. Then choose on agency fit: workspaces, pitch environments, white-label reporting, honest per-client pricing, and whether the platform helps you do the work rather than only measure it. For deeper research on how AI answers cite sources, the Promptwatch Data hub is a useful place to ground your client conversations.