Editorial policy

Our guides are written for owners of small businesses who don't have an IT department, so every page has to be accurate and easy to follow. This policy explains how we make sure it is.

How are CyberVigil guides written?

Our guides are drafted with AI assistance, then edited and fact-checked by people. A human is responsible for every page we publish.

Editing covers more than tone. We check each instruction against the provider's current documentation, and each DNS record example against the standard that defines it. If a step can't be confirmed, it doesn't go in.

Every guide shows an updated date. We revisit pages when providers change their menus or when standards and guidance change, and we update the date when we do.

How do we choose sources?

We rely on primary sources, meaning the organizations that set the standard or run the service.

• Government guidance comes from NIST, the FTC, CISA, and the FBI's Internet Crime Complaint Center (IC3).
• For internet standards, we go to the RFCs published by the RFC Editor, such as the specifications for SPF, DKIM, DMARC, HSTS, and CAA.
• Setup steps follow the official documentation from the providers small businesses use, like Google, Microsoft, Cloudflare, GoDaddy, and WordPress.
• Where a sector authority applies, we cite it, such as HHS for HIPAA topics and the American Bar Association for law firm topics.

Every statistic is quoted exactly as the source states it, linked to the source, and listed in the sources section at the bottom of the page. If we can't verify a number on the original source, we don't use it. We don't use statistics to frighten people into acting.

How are compliance and legal topics reviewed?

Some pages touch on regulations, insurance, or legal duties, like HIPAA or cyber insurance requirements. A qualified expert reviews these pages, and they stay unpublished until that review is done.

Even after review, these pages are general information, not legal advice. CyberVigil can't tell you whether your business is compliant with any law, standard, or policy. For decisions about your obligations, talk to your attorney, compliance advisor, or insurance broker.

How do we handle corrections?

We want to hear about mistakes. If you find an error in a guide, email hello@cybervigil.ai with the page address and what you believe is wrong. A link to a source helps us move faster.

We review every report. When we confirm an error, we fix the page and update its date. When a correction changes the advice itself, not just a typo, we add a short note on the page explaining what changed.

The same address works for problems in a scan report. Our methodology page explains how each check works if you want to compare first.

Are CyberVigil guides independent?

We don't accept payment to mention, rank, or recommend any product or provider. When a guide names a company like GoDaddy, Google Workspace, or Cloudflare, it's because many small businesses use it and the steps are specific to it.

We do mention our own products. That includes the free check and our Monitoring and Guided Help plans, which are opening soon. When we mention them, it's clear they're ours, and our pricing page lists what each one includes.

How do we use AI?

We use AI in two places: drafting guides and writing report summaries.

AI helps us draft guides. People edit each one, verify every fact and step, and decide what gets published.

The summary at the top of a scan report may be written by an AI model, using only that report's scan results. When it is, it's labeled "AI-powered insights". When it isn't, it's labeled "Your summary" and comes from a written template.

The score and the individual findings in a report never come from AI. They come from fixed rules, which are published on our methodology page along with the guardrails we put on the AI summary.

Who can I contact about this policy?

Questions about how we write, review, or correct our content are welcome at hello@cybervigil.ai. You can also learn more about CyberVigil and the principles behind it.