Privacy · GDPR · HIPAA · Accessibility compliance audits

Find privacy risks before regulators do.

We read your privacy policy, terms, cookie and health notices side by side, quote the exact language that creates risk, and hand you corrected wording plus a clear 2026–2027 roadmap. You also get updated privacy policy and terms pages that fix the gaps we find, styled to match your website and ready to upload in minutes, with no heavy editing. Need a new site too? Our $2,000 option adds a fully redesigned, accessible website with built-in privacy, terms and cookie pages.

[01] Audits

Six lenses on every engagement.

Every engagement ends in a Privacy Snapshot: what your documents actually say, where they contradict each other, and exactly what to change.

01

CCPA & US state privacy audit

CCPA/CPRA and its 2026 regulations, Texas TDPSA, Colorado, Virginia and other state laws: notices at collection, rights requests, “sell/share,” ad tech and Global Privacy Control.

02

GDPR & UK GDPR audit

Lawful bases, Article 13/14 transparency, retention, processors and international transfer mechanisms, plus cookie consent for European users.

03

HIPAA & health data audit

Notice of Privacy Practices, BAA references, tracking pixels on health pages and state consumer health data laws such as Washington’s MHMDA.

04

Conflicts & 2027 roadmap

Where your policy, terms and notices disagree, with exact replacement language and an 8-step plan for laws taking effect in 2026 and 2027.

05

WCAG / Section 508 accessibility audit

Section 508 and WCAG 2.1/2.2 AA review of your site and forms, covering ADA Title II and III, EN 301 549 and the European Accessibility Act, with a prioritized remediation list.

06

Website upgrade (optional)

A redesigned, accessible, privacy-compliant website with consent banner, policy pages and accessible forms built in. Delivered in 5 business days with up to 2 rounds of revisions.

17+

years of DoD & federal experience

4

audit types: US privacy, GDPR, HIPAA, accessibility

8

step prioritized fix roadmap

2026 to 2027

current and upcoming law coverage

[02] Review

Clause-by-clause review.

Our privacy policy audit checks every footer document line by line: dates, rights, transfers, health data, cookies. Items that pass are ticked; items that fail are quoted and flagged so nothing is left to interpretation.

Get my full report — $1,000 ↗

[03] Workflow

From flagged clause to fixed clause.

Each finding moves through the same path: locate the document, isolate the non-compliant sentence, then write replacement wording you can hand to counsel.

See sample engagements ↗

[04] Scan · illustrative sample

Out-of-date policies, surfaced.

A sample of how a scan sweeps your documents for stale dates and outdated legal references. Numbers below are an illustrative demo, not client data.

[05] Sample engagements · illustrative

Sample engagements

Illustrative scenarios showing the kinds of gaps a Privacy Snapshot is built to find. These are examples, not client case studies, and include no client names or results.

Illustrative scenario

Healthcare SaaS: HIPAA / BAA gap

A health tech platform says it is HIPAA compliant, but its Privacy Policy never mentions Business Associate Agreements and its marketing pages load ad pixels near appointment forms.

  • Typical findings: missing BAA reference, pixels on health pages, NPP vs. Privacy Policy conflict
  • Deliverable: quoted language, corrected wording, roadmap
Illustrative scenario

AI startup: GDPR transfers

An AI product serves EU users and routes prompts to US model providers, but its notice names no transfer mechanism and its terms reserve broad rights to train on customer content.

  • Typical findings: no SCC/DPF basis stated, training-use conflict between policy and terms, unclear retention
  • Deliverable: transfer language, aligned AI-use clause, 2027 readiness steps
Illustrative scenario

Marketplace: undated policy

A marketplace’s Privacy Policy promises a “last updated” date that never appears, while its checkout notice says data is never shared and ad tags run on that same page.

  • Typical findings: missing effective date, checkout vs. policy conflict, no opt-out link or GPC support
  • Deliverable: dated policy, aligned notices, Do Not Sell/Share fix
Get my full report — $1,000

[06] Checklist

What every Privacy Snapshot checks

The same nine-point website privacy audit runs on every engagement, including an ad tracker and pixel audit of what loads in the background, so nothing slips between documents.

0%0 / 9 checks
  1. Every footer policy, terms page & notice collected
  2. Effective / last-updated dates verified
  3. Cross-document conflicts identified
  4. Cookies, pixels & trackers vs. disclosures
  5. Global Privacy Control & opt-out links
  6. Sensitive & health data handling (HIPAA / BAA)
  7. GDPR lawful basis, rights & transfers
  8. Accessibility: Section 508 / WCAG 2.1 AA checks
  9. Corrected wording + 8-step 2026–2027 roadmap
Risk meter: HIGH RISK

0 of 6 sample findings addressed

Demo only

[Demo] Try it · interactive

Watch the risk drop as you fix things.

Click each sample finding to check it off as addressed. The demo resets itself 10 seconds after your last click. This is an illustrative demo of how a Privacy Snapshot roadmap moves you toward compliance, not a score of your site.

[07] Who we help

Built for teams that move fast.

Healthcare & health tech

Clinics, telehealth and health apps balancing HIPAA, state consumer health data laws, and marketing tools.

AI & SaaS

Products whose AI features, integrations and data retention have outgrown the policy written at launch.

Marketplaces & e-commerce

Businesses running ad pixels, payments and user accounts across many US states and the EU.

Professional & confidential services

Law firms, med spas and private practices, CPAs, wealth advisors and other businesses trusted with sensitive client data.

Founder

Security-cleared discipline, applied to privacy.

CerteCerto was founded by a privacy and security professional with more than 17 years of Department of Defense and federal experience, where handling sensitive information carefully is the job.

  • 0117+ years DoD and federal service
  • 02TS/SCI security clearance
  • 03CompTIA Security+ (DoD 8570 IAT Level II)
  • 04DoD Foreign Disclosure Officer certification
  • 05Section 508 certified

[SAMPLE] What you receive

See what a Privacy Snapshot looks like.

Every finding quotes the problem language word for word, explains why it matters, and gives you the exact language that should be there, plus a step-by-step roadmap.

This sample is for a fictional company, and every quote in it is invented.

FAQ

Privacy & compliance audit questions

What does a CerteCerto privacy audit review?

Your public-facing privacy policy, terms, cookie and health notices, plus observable site behavior such as third-party ad trackers, pixels, cookies, tags and network requests that load in the background. We do not review your internal data handling, internal systems or internal practices.

Which laws and standards does it cover?

CCPA/CPRA and other US state privacy laws, GDPR and UK GDPR, HIPAA and state consumer health data laws, and accessibility under Section 508 and WCAG 2.1/2.2 AA.

What do I receive?

A full Privacy Snapshot report by email: each finding quotes the problem language, explains why it matters, gives the exact language that should be there, and ends with an 8-step 2026–2027 roadmap. You also receive updated privacy policy and terms pages that fix the gaps found, styled to match your website and ready to upload in minutes. With the $2,000 option you also receive a fully redesigned, accessible website with an accessible-site toggle and built-in privacy, terms and cookie pages, plus up to 2 rounds of revisions requested by email; additional changes are not included.

How much does it cost, and do I need a call?

There are two one-time options paid through Stripe, with no subscription: the $1,000 Full Privacy Report (report plus updated privacy policy and terms pages, delivered within 1 business day), or the $2,000 Report + New Website (everything in the report option plus a fully redesigned, accessible website with an accessible-site toggle and built-in privacy, terms and cookie pages). No calls or meetings are required; you give us your company name and email, and everything is delivered by email.

Is this legal advice?

No. The report is informational only and not legal advice. You can hand the corrected wording to your counsel.

[08] Get started

Choose your option.

Tell us your company name and the best email, then pay securely through Stripe. That’s all we ask for.

Option 1 · Full Privacy Report — $1,000

  • One-time payment of $1,000. No subscription.
  • Full report delivered by email within 1 business day.
  • Includes updated privacy policy and terms pages that fix the gaps found, styled to match your website and ready to upload in minutes, with no heavy editing.
  • No calls or meetings required.
Choose the $1,000 report

Option 2 · Report + New Website — $2,000

  • Everything in Option 1.
  • A fully redesigned, accessible website built with WCAG 2.2 and Section 508 in mind, including an accessible-site toggle.
  • Built-in compliant privacy policy, terms and cookie pages.
  • Includes up to 2 rounds of revisions to the new website, requested by email; additional changes are not included.
  • Report delivered within 1 business day; new website delivered within 5 business days.
  • One-time payment of $2,000. No calls or meetings required.
Choose report + new website
Option

We use your details only to process your order and deliver your report (and, if you checked the optional box, to send occasional updates). Every marketing email includes an unsubscribe link, and you can opt out anytime by emailing Brianna@certecerto.com. We never sell or share your information.

You’ll be taken to Stripe’s secure checkout for the option you chose. Card details go to Stripe, not to us.

Taking you to secure checkout…
If nothing happens, email Brianna@certecerto.com.

Privacy Policy

Effective date: October 12, 2026

This Privacy Policy explains how CerteCerto (“we,” “us”), a privacy compliance company based in Texas, USA, handles personal information collected through this website, certecerto.com. Questions: Brianna@certecerto.com.

1. What we collect

Only what you type into the signup form: company name and email address, plus whether you checked the optional marketing box and the date and time of your submission. If you email us, we receive what you send. We do not ask for, and ask you not to send through this form, health information, payment details, or other sensitive data.

Our hosting provider automatically processes standard technical data (such as IP address, browser type, and request time) in server logs to deliver and secure the site. We do not use these logs to profile you.

2. Cookies, tracking and analytics

This site uses no analytics, advertising pixels, session recording, or other non-essential cookies or trackers, and loads no third-party scripts or fonts. Because of that, there is no cookie banner. If this ever changes, we will update this policy and ask for consent where the law requires it before any non-essential cookie is set.

3. Why we use it, and our legal bases

PurposeDataGDPR / UK GDPR lawful basis
Respond to your audit request, confirm scope, and send a proposalCompany name, emailSteps taken at your request before entering into a contract (Art. 6(1)(b))
Send occasional privacy-law updates and service newsEmail, company nameYour consent, only if you check the optional box (Art. 6(1)(a)). Withdraw anytime.
Keep records of consent and opt-outs; protect the site and prevent abuseSubmission record, server logsLegal obligation (Art. 6(1)(c)) and legitimate interests in security and proving compliance (Art. 6(1)(f))

We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.

4. Who processes it for us

We do not sell your personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We use these service providers (processors), who may handle data only on our instructions:

We may also disclose information if required by law, to protect our rights, or as part of a business sale or reorganization, subject to this policy.

5. International transfers

We are based in the United States, and our providers may process data in the US or the EU. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or the provider’s certification under the EU-US Data Privacy Framework, where available.

6. How long we keep it

7. Your rights

Everyone: you can ask us to access, correct or delete your information, or to stop sending marketing, by emailing Brianna@certecerto.com. Every marketing email includes a working unsubscribe link, and we honor opt-outs promptly (within 10 business days, as CAN-SPAM requires).

EEA/UK residents (GDPR / UK GDPR): rights to access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interests; to withdraw consent at any time without affecting earlier processing; and to complain to your local data protection authority (in the UK, the ICO).

US state residents (including California, Texas, Colorado, Virginia, Connecticut, Oregon and other states with comprehensive privacy laws, where they apply to us): rights to know/access, correct, delete, obtain a portable copy, and opt out of sale, targeted advertising and profiling. We do not sell or share personal information or engage in targeted advertising, so there is nothing to opt out of, but you may still send a request. We will not discriminate against you for exercising your rights.

How to submit a request: email Brianna@certecerto.com with the subject “Privacy Request.” We will verify your request by confirming control of the email address involved and respond within the legally required time (generally 45 days under US state laws and one month under GDPR, which may be extended where allowed). You may use an authorized agent where the law allows. If we deny your request, you may appeal by replying with the subject “Appeal”; we will answer within the time your state law requires, and if you are not satisfied you may contact your state attorney general.

8. Global Privacy Control

We honor Global Privacy Control (GPC) and similar browser opt-out signals as a valid request to opt out of sale and sharing. Because we do not sell or share personal information, the practical effect is that we will never begin doing so for a browser sending that signal.

9. Security

We use reasonable administrative, technical and physical safeguards, including HTTPS encryption in transit and access limited to people who need it. No method of transmission or storage is perfectly secure. If a breach affects your personal information, we will notify you and regulators as applicable law requires.

10. Children

This site is for businesses and is not directed to children under 16. We do not knowingly collect children’s personal information. If you believe a child has submitted information, contact us and we will delete it.

11. Changes

We will post any changes here with a new effective date. If we make a material change, we will notify people on our list by email before it takes effect.

12. Contact

CerteCerto, Texas, USA · Brianna@certecerto.com · certecerto.com

This policy describes our own practices. Nothing on this site is legal advice.

Terms of Use

Effective date: October 12, 2026

These Terms of Use govern your use of certecerto.com (the “Site”), operated by CerteCerto (“we,” “us”). By using the Site or submitting the signup form, you agree to these Terms. If you do not agree, please do not use the Site.

1. Not legal advice

CerteCerto is a privacy compliance company, not a law firm, and does not provide legal advice. Content on the Site and in any Privacy Snapshot or other deliverable is informational and is not a substitute for advice from a licensed attorney. No attorney-client relationship is created. You should have counsel review any changes before you adopt them.

2. Orders and payment

Purchase. A Privacy Snapshot costs a one-time fee of $1,000 (USD), paid through Stripe. Your report, along with updated privacy policy and terms pages written to fix the gaps found and styled to match your website (ready to upload in minutes, with no heavy editing), is delivered by email to the address you provide within 1 business day of payment. The Report + New Website option costs a one-time fee of $2,000 (USD), paid through Stripe, and adds a fully redesigned, accessible website with built-in privacy policy, terms and cookie pages, delivered within 5 business days (the report itself arrives within 1 business day), and includes up to 2 rounds of revisions to the new website requested by email; additional changes are not included. No calls or meetings are required. Refunds: If you email Brianna@certecerto.com with a refund request within 24 hours after your report is delivered, we will refund 50% of the fee. Requests made more than 24 hours after delivery are not eligible for a refund. For the $2,000 Report + New Website option, if you email Brianna@certecerto.com with a refund request within 2 business days after your new website and report are delivered, we will refund 50% of the fee. Requests made after that window are not eligible for a refund. Prices may change for future orders. Audits review only public-facing policies and observable site behavior as of the review date, including third-party ad trackers, pixels, cookies, tags and network requests that load in the background and aren’t visible on the page. We do not review your internal data handling, internal systems, or internal practices, and we don’t access private systems or internal data; laws and your practices change, and we do not guarantee that any document is or will remain compliant.

Updated policy pages. The updated privacy policy and terms pages we provide are informational only and not legal advice. You should have your own counsel review them before publishing them on your website.

3. Your submissions

You agree to provide accurate information, to submit only on behalf of a company you are authorized to represent, and not to submit sensitive personal data, protected health information, or confidential third-party information through the form. Our handling of your information is described in the .

4. Acceptable use

Do not misuse the Site, including by attempting unauthorized access, interfering with its operation, scraping it at scale, submitting spam or malicious code, or using it for anything unlawful.

5. Intellectual property

The Site’s content, design and text are owned by CerteCerto or its licensors. You may view and share the Site for your own business purposes but may not copy or republish substantial portions without permission. Fonts are used under the SIL Open Font License.

6. Third-party links

The Site links to third-party services, such as our payment processor, Stripe. Their own terms and privacy policies apply, and we are not responsible for them.

7. Disclaimers

THE SITE IS PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, TO THE FULLEST EXTENT PERMITTED BY LAW.

8. Limitation of liability

TO THE FULLEST EXTENT PERMITTED BY LAW, CERTECERTO WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES ARISING FROM YOUR USE OF THE SITE, AND OUR TOTAL LIABILITY RELATING TO THE SITE WILL NOT EXCEED ONE HUNDRED U.S. DOLLARS ($100). Some jurisdictions do not allow these limits, so they may not apply to you. Nothing in these Terms limits rights you have as a consumer that cannot be waived by law.

9. Governing law

These Terms are governed by the laws of the State of Texas, without regard to conflict-of-law rules. Disputes will be resolved in the state or federal courts located in Texas, except where your local law gives you the right to bring a claim in your home courts.

10. Changes

We may update these Terms by posting a new version with a new effective date. Continued use of the Site after that means you accept the updated Terms.

11. Contact

Brianna@certecerto.com · CerteCerto, Texas, USA

Privacy Choices

No sale or sharing. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of here. We honor Global Privacy Control signals.

No non-essential cookies. This site sets no analytics, advertising or tracking cookies, so there is no cookie banner.

Marketing emails. Use the unsubscribe link in any email, or email Brianna@certecerto.com with the subject “Unsubscribe.”

Access, correction, deletion and other rights. Email Brianna@certecerto.com with the subject “Privacy Request.” See the for details.

← Back to home

Sample Privacy Snapshot

SAMPLE REPORT · FICTIONAL COMPANY · ILLUSTRATIVE

CerteCerto · Privacy Snapshot

Northwind Health Apps (sample company)

northwind-health.example · reviewed Oct 2026 · Privacy · GDPR · HIPAA · Accessibility

Overall riskHIGH RISK
4Critical
2Conflicts
4Warnings
22027 items

0 of 8 findings addressed

Audited sources (fictional)
  • Privacy Policy (undated)
  • Terms of Service and Clinic Terms
  • Cookie banner and checkout page (live scan)
  • Help Center: symptom checker

Findings

1. Privacy Policy carries no effective or last-updated date

CRITICAL

PrivacyCal. Civ. Code §1798.130(a)(5)11 CCR §7011

Problem language (invented sample) · Privacy Policy · footerThis Privacy Policy may be updated from time to time. Please check back often.

Why it matters: Visitors and regulators can’t tell which version applied when data was collected. California’s CCPA regulations expect a privacy policy to state the date it was last updated.

Exact language that should be there

Last updated: [Month Day, Year]. We will post any change here and update this date. For material changes we will notify you by email or in the app before the change takes effect.

2. Global Privacy Control (GPC) signals are ignored

CRITICAL

PrivacyCal. Civ. Code §1798.13511 CCR §7025

Problem language (invented sample) · Privacy Policy · Your choicesWe do not currently respond to browser “do not track” or similar signals.

Why it matters: In California, an opt-out preference signal such as GPC must be treated as a valid request to opt out of sale or sharing. Several other states have similar rules.

Exact language that should be there

We treat a Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of your personal information for that browser and any account you are signed in to.

3. Checkout promise conflicts with ad pixels and session replay on the same page

CRITICAL

PrivacyFTC Act §5Cal. Civ. Code §1798.120

Problem language (invented sample) · Checkout page · under the Pay buttonYour information stays with us. We never share your details with anyone.

Why it matters: Sample scan: an advertising pixel and a session-recording script load on the checkout page. An absolute “never share” promise that the site doesn’t keep can be treated as a deceptive statement.

Exact language that should be there

We share limited checkout information with our payment processor to complete your order and with analytics and advertising partners as described in our Privacy Policy. You can opt out at Your Privacy Choices.

4. No Business Associate Agreement (BAA) is referenced for clinic customers

CRITICAL

HIPAA45 CFR §164.502(e)45 CFR §164.504(e)

Problem language (invented sample) · Clinic Terms · DataClinics are responsible for their own compliance with any health privacy laws.

Why it matters: The sample app hosts patient messages for clinics, which makes it a business associate under HIPAA. A BAA is required before it handles protected health information (PHI), and the terms should say so.

Exact language that should be there

When we create, receive, maintain or transmit protected health information on behalf of a covered entity, we do so under a signed Business Associate Agreement, which governs if it conflicts with these Terms.

5. No legal basis is stated for sending EU data to the US

WARNING

GDPRGDPR Art. 13(1)(f)GDPR Arts. 44–46

Problem language (invented sample) · Privacy Policy · International usersYour data may be processed anywhere we or our vendors operate.

Why it matters: GDPR requires telling people when their data leaves the EEA and which safeguard covers it, such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

Exact language that should be there

When we transfer personal data from the EEA, UK or Switzerland to the United States, we rely on [the EU–US Data Privacy Framework / Standard Contractual Clauses]. You can request a copy of the relevant safeguards by contacting [email].

6. Cookie banner fails contrast and keyboard access

WARNING

AccessibilityWCAG 2.2 SC 1.4.3, 2.1.1, 2.4.7Section 508 / ADA (general)

Problem language (invented sample) · Live site · cookie bannerLight-grey “Reject” text on a white button (about 2.1:1); the banner can’t be reached or closed with the Tab or Esc keys.

Why it matters: Keyboard and low-vision users can’t make a consent choice, so consent isn’t freely given for them and the banner is an accessibility barrier in its own right.

Exact language that should be there

Reject and Accept buttons with equal visual weight, text contrast of at least 4.5:1, a visible focus outline, reachable by Tab and closable with Esc.

7. Retention period is open-ended

WARNING

PrivacyCal. Civ. Code §1798.100(a)(3)GDPR Art. 13(2)(a)

Problem language (invented sample) · Privacy Policy · RetentionWe keep your information for as long as necessary.

Why it matters: Both CCPA and GDPR expect a retention period, or the criteria used to set one, for each category of data.

Exact language that should be there

We keep account data while your account is open and for 24 months after closure; support messages for 12 months; payment records for 7 years as required by tax law.

8. Symptom checker makes automated triage suggestions with no notice

WARNING

2027CCPA ADMT regulations (Jan 1, 2027)Wash. My Health My Data Act

Problem language (invented sample) · Help Center · Symptom checkerOur smart triage tool tells you how urgently you should be seen.

Why it matters: California’s automated decisionmaking technology (ADMT) rules take effect January 1, 2027. They will require a pre-use notice and, in many cases, an opt-out or appeal when such tools help make significant decisions such as access to healthcare.

Exact language that should be there

Before you use the symptom checker: it uses automated logic to suggest how urgently to seek care. It does not diagnose. You can skip it and contact a clinician directly, and you can ask how a suggestion was made at [email].

Conflicts between documents

2027 implications

Roadmap

  1. Step 1Add a dated policy headerNow (2026): put a “Last updated” date at the top of the Privacy Policy and keep a change log, fixing Finding 1.
  2. Step 2Honor GPC sitewideWithin 30 days: treat Global Privacy Control as an opt-out of sale/sharing, suppress ad tags when it’s on, and update “Your choices” (Finding 2).
  3. Step 3Fix checkout notice and tagsWithin 30 days: remove the ad pixel and session replay from checkout, or disclose them and replace the “never share” promise (Finding 3, Conflict 1).
  4. Step 4Sign BAAs and align clinic termsWithin 60 days: sign Business Associate Agreements with partner clinics and drop “HIPAA-ready” unless terms back it up (Finding 4, Conflict 2).
  5. Step 5Document EU transfer safeguardsWithin 60 days: name the transfer mechanism (DPF or SCCs) and how to request a copy (Finding 5).
  6. Step 6Rebuild the cookie banner to WCAG 2.2Within 90 days: equal-weight Reject/Accept, 4.5:1 contrast, visible focus, Tab and Esc support (Finding 6).
  7. Step 7Set retention schedulesBy end of 2026: publish a retention period or criteria for each data category and automate deletion (Finding 7).
  8. Step 8Prepare ADMT notice for 2027Before Jan 1, 2027: add a pre-use notice, skip/opt-out and “how was this decided” contact for the symptom checker, and start the risk assessment (Finding 8).

2027 Readiness Finish Line

What they do well

Caveats

This sample is based on invented public-facing documents and a scan of a fictional website. CerteCerto reviews only public-facing policies and observable site behavior, including third-party ad trackers, pixels, cookies, tags and network requests that load in the background and aren’t visible on the page. We do not review a company’s internal data handling, internal systems, or internal practices, and we don’t access private systems or internal data. Informational only, not legal advice.

SAMPLE REPORT · FICTIONAL COMPANY · Every quote is invented sample language. Informational only, not legal advice.

One-time $1,000 · delivered by email · no calls required.