How to vet an SEO or GEO agency: questions, evidence, red flags and contract hygiene for SaaS buyers

Hiring outside help for search is hard to judge from the outside. The work is slow to show results, the reports are easy to dress up, and since 2025 most proposals add a new line item for "GEO", "AEO" or "AI visibility". A SaaS team usually has one or two calls and a PDF to decide with.

This article is a method for that decision. It covers the questions to ask, the evidence to demand, the red flags, the contract terms, and how to read a GEO pitch. It makes no claims about which agencies are good, and it names none.

Every claim below carries one of four labels: official guidance (a platform or regulator documenting its own rules), research finding, our observation, or hypothesis. Where I describe why an agency might push a deliverable, that is incentive analysis, not a claim about anyone's motives. The Google and FTC pages were checked on 2026-10-06. Re-check them before relying on this after early 2027.

Start with what Google itself tells buyers

Google publishes a page for exactly this decision, "Do you need an SEO?" (official guidance, Google Search Central, page dated 2026-06-05, register AG-01). In short:

• No one can guarantee a #1 ranking on Google. Be wary of anyone who claims to, or who claims a special relationship with Google or "priority submit" access.
• Be careful with secrecy. If a provider won't clearly explain what they intend to do, or what they changed on your server, that is a warning.
• Link schemes, mass submissions and deceptive content break Google's spam policies and can get a site removed from the index.
• Unsolicited outreach about your "missing" search listings deserves suspicion.
• You should never have to link to an SEO as a condition of the work.
• Buying Google Ads doesn't change your organic results.
• Check references with past clients, and during an audit give only read access to Search Console.

The page lists optimizing for generative AI among the services an SEO may offer. It also asks you to have an SEO explain its recommendations, and to check AEO or GEO advice against Google's own AI optimization documentation (AG-01).

A companion page on third-party SEO tools and advice goes further (official guidance, Google Search Central, page dated 2026-06-05, AG-02). Google says it does not evaluate third-party services, so be wary of anyone who says their service is approved by Google. Third-party tools have no access to Google's internal ranking systems, and their forecasts are their own estimates. Good advice either cites Google's documentation or is clearly marked as the author's opinion from experience.

That last point is the most useful single test in this article. Ask the agency which of its recommendations come from Google's documentation and which are its own opinion. A good provider can tell you which is which.

Questions to ask before you see a proposal

These extend Google's list (AG-01) for a SaaS or B2B buyer. The extensions are our method (hypothesis, AG-11).

About your business

1. What do you need to know about our buyers, sales cycle and competitors before you recommend anything? (Google suggests checking whether the provider is interested in your business at all, AG-01.)
2. What would you count as success for us: rankings, organic sessions, trials, qualified pipeline, activation? Who signs off on that definition?
3. What would make you tell us not to hire you?

About method

4. Walk us through the first 30 days. What do you need access to, and at what permission level?
5. Which of your standard recommendations come from Google's or Bing's documentation, and which are your own experience?
6. What changes will you make to the site directly, and how will you record them?
7. If you build or buy links, describe exactly how. Are any paid, exchanged or placed on sites you control?

About evidence

8. Show us a dated report from a past engagement, redacted if needed. What was the baseline, and what did you compare against?
9. How do you separate your work's effect from seasonality, launches, ad spend and Google updates?
10. What did not work on a past engagement, and what did you do about it?

About AI search

11. Which AI surfaces do you measure, how often, and with which fixed prompt set?
12. How do you report mentions, linked citations, referral sessions and signups? Do you keep them separate?

An agency that answers these without hedging into jargon is easier to hold to account later. An agency that can't answer 5, 8 or 9 is asking you to trust it rather than check it.

Evidence to demand: baselines, denominators and dates

Most misleading SEO reports are not false. They leave out the number you need to judge them. Three things fix most of it (our method, hypothesis, AG-11):

A baseline written down before work starts. Search Console clicks and impressions for the pages in scope, key events in analytics, and qualified leads from the CRM, with the date range stated. Without it, every later number is a story.

A denominator for every rate and count. "We won 40 AI citations" means nothing without "out of how many prompts, run how many times, on which engines, on which dates". "Rankings up 300%" needs the number of keywords tracked, how they were chosen, and whether the list changed. Search Console shows at most 1,000 rows in its table and drops rare, anonymized queries once you filter by query, so filtered totals are estimates (official guidance, M1-15). A report built on filtered totals should say so.

A date on every claim. AI answers are volatile. In a study by SparkToro and Gumshoe.ai (fieldwork late 2025, published January 2026), repeated runs of the same brand-recommendation prompts almost never returned the same list twice (research finding, RQ1-10; the authors disclose a tie to an AI-tracking vendor). A single screenshot of your brand in an AI answer is one sample from a moving distribution. Ask for the prompt set, the run count and the dates.

A control. Pages or query groups the agency did not touch, measured over the same windows. A before/after chart on its own does not show cause, because launches, seasons and Google updates move traffic too.

When you look at case studies, ask the same questions. If a case study shows a traffic curve with no y-axis, no date range and no comparison, treat it as marketing. If it shows qualified leads or revenue, ask how they were attributed.

Red flags, with the rule behind each

Red flag	Why it matters	Source
Guaranteed rankings or "page one in 90 days"	Google says no one can guarantee a #1 ranking	official guidance, AG-01
"Approved by Google", "Google partner for SEO", special access	Google says it does not evaluate third-party SEO services, and tools have no access to its ranking systems	official guidance, AG-02
Secret methods or a private network you're not allowed to see	Google says be careful if a provider is secretive or won't explain its changes	official guidance, AG-01
Paid or exchanged links that pass ranking credit, link packages, links "from our network of sites"	Google's link spam policy covers buying or selling links that pass ranking credit, excessive link exchanges, automated link building and links in low-quality directories or widgets. Paid links marked rel="sponsored" or nofollow are allowed	official guidance, spam policies, AG-03
A requirement to link to the agency from your site	Google says you should never have to link to an SEO	official guidance, AG-01
Hundreds of templated location, "alternative" or query-variation pages	Doorway abuse and scaled content abuse policies; Google's AI guide names pages built for every query or fan-out variation	official guidance, M1-01, M1-02, M1-13
Cloaking, hidden text or sneaky redirects	Named spam practices	official guidance, AG-04
"AI citation guarantees" or guaranteed inclusion in AI Overviews or ChatGPT	Google says meeting the requirements does not guarantee being crawled, indexed or shown in AI features; no tool has access to its AI systems; answers vary run to run	official guidance, M1-13, AG-10; research finding, RQ1-10
Reviews or testimonials for sale: "we'll get you 50 five-star reviews", review swaps, staff posting reviews	The FTC's rule bans fake reviews, reviews bought on condition of a positive sentiment, and undisclosed insider reviews. Google Maps bans paid reviews, incentivized reviews and conflict-of-interest reviews	official guidance, AG-07, AG-08
Planted mentions: seeding your brand into forums, listicles or Q&A sites through fake accounts	Google's AI guide says inauthentic mentions are not helpful. Undisclosed paid endorsements raise FTC disclosure issues	official guidance, M1-13, M1-29
A green Core Web Vitals score sold as the main deliverable	Google says CWV are used by its ranking systems, but good scores don't guarantee top rankings and there is no single page-experience signal	official guidance, page experience, AG-05
An audit with 400 "errors" and no priority, URLs or acceptance checks	A long list is easy to produce and hard to act on. Ask which items affect pages that matter to revenue	our method, hypothesis, AG-12
llms.txt, special schema or "chunked" content sold as an AI requirement	Google Search ignores llms.txt; no special markup is required for AI features; no need to chunk content. Other engines may use such files, so it's fine as a cheap extra, not as a requirement	official guidance, M1-13, M1-14

A note on reviews and liability. The FTC's Consumer Reviews and Testimonials rule took effect on 2024-10-21 and lets courts impose civil penalties for knowing violations (official guidance, FTC Q&A, AG-07). The FTC says an agency, PR firm or review broker that writes or sells fake reviews can be liable. It also says a business buying reviews should watch for warning signs, such as reviews arriving very quickly or in bulk, and that ignoring clear signs can create liability. Hiring someone else to do it does not move the risk off your company. This is US law. It isn't legal advice, so ask counsel about your markets.

Spot the protection racket in a proposal

The protection racket is a model I use for businesses that sell both the disease and the cure. In a search proposal it shows up when the same provider defines the problem, controls the measurement and sells the fix. That is an incentive pattern, not proof of bad faith, but it's worth checking for (our method, hypothesis, AG-12):

• Links in, cleanup out. The provider that builds or buys links you can't inspect also sells link audits, disavow work or penalty recovery.
• A score only they can move. A proprietary "AI visibility score" or "authority score" that they calculate and they improve. Google says third-party tools have no access to its ranking or AI systems (AG-02, M1-13). Ask what the score is made of and how it maps to Search Console, analytics or the CRM.
• Fear first. An unsolicited audit with a red banner and a monthly fix-it retainer attached. Google already tells buyers to be wary of unsolicited outreach (AG-01).
• Retainers tied to activity, not to agreed outcomes. Twenty articles a month and twenty links a month create work that can always be billed again. Ask what would make the work stop.

The test is simple. Could you check the agency's results with tools it doesn't control: Search Console, your analytics and your CRM? If not, the agency is marking its own homework.

How to read a GEO pitch

Some practitioners argue GEO is ordinary SEO with a new label. Others treat it as a separate discipline. For Google's own AI features the documentation is clear (official guidance, AI optimization guide, page dated 2026-07-10, M1-13, AG-10):

• AI Overviews and AI Mode rest on Google's core ranking and quality systems. A page must be indexed and eligible for a snippet.
• There's no special file, markup or chunking to add, and no ideal page length.
• Google suggests checking third-party AEO or GEO advice against its own documentation before you hire for it.

Other engines document less. ChatGPT search relies on third-party search providers plus its own crawler; Perplexity runs its own crawler (official guidance, RQ1-05 to RQ1-07). They pick different sources from Google and from each other (research finding, RQ1-09). So a GEO pitch can be legitimate, but it should be specific. Read it with these questions (our method, hypothesis, AG-11):

1. Which engines, which prompts, how many runs, on what dates? A pitch built on one screenshot is a sample of one.
2. What will change on our site or off it, and why? The answer should be things like clearer product facts, pages that answer real buyer questions, earned coverage, and fixing crawl or rendering problems. It shouldn't be special files or a prompt-hacking trick.
3. What happens to Google search? Google's guidance warns against building a page for every query variation (M1-13). A GEO plan that is really a page-volume plan carries the same risk as any other.
4. How will mentions, citations, referral sessions and signups be reported? They are four different numbers. A report that adds them together can't be checked.
5. What's the claim made of? Under US law, objective advertising claims need a reasonable basis before they are made, and a claim like "studies show" needs the level of support it implies (official guidance, FTC substantiation statement, 1984, AG-09). Ask for the study, its sample and its date.

Contract and scope hygiene

A written scope protects both sides. These terms are our method (hypothesis, AG-11), with the access points grounded in Google's help pages:

• Deliverables, not effort. List the outputs: a baseline report, a prioritized findings list with affected URLs and acceptance checks, a measurement specification, named pages. "Ongoing optimization" is not a deliverable.
• Success measures agreed up front. Define the qualified lead or activation event, the baseline and the control set before work starts. Say how early movement will be reported, with its limitations.
• You own the accounts. Your company should be the verified owner of the Search Console property, analytics and tag manager. Give the agency a user role. Search Console's restricted users can view most data; full users can take more actions; only owners manage users (official guidance, Search Console permissions, AG-06). Start with read access during an audit (AG-01).
• Offboarding written in. When the engagement ends, remove users. If the agency verified ownership, also delete its verification token, or it can re-verify (official guidance, AG-06).
• A change log. Every change to the site, links built or placed, and content published, with dates and URLs.
• A link and review clause. No paid links that pass ranking credit, no link exchanges, no private networks, no fake or incentivized reviews, no undisclosed paid mentions. Ask the agency to confirm this in writing (AG-03, AG-07, AG-08).
• You own the work. Content, code, data and reports belong to you. No hidden links back to the agency.
• A short first term. A fixed audit or sprint before any retainer, so you can judge the method before committing.
• Exit terms. Notice period, handover of every deliverable, and no penalty for ending a retainer that hasn't met its agreed measures.

RankPropel works this way: a written scope and success measures agreed before an invoice. The delivery plan and scope and prices are public. You can hold any provider, including us, to the checklist below.

Checklist

Before the first call:

• You know your own baseline: Search Console clicks and impressions, key events, qualified leads.
• You've read Google's "Do you need an SEO?" page.

In the conversation:

• They asked about your buyers, sales cycle and competitors.
• They separate Google's documented guidance from their own opinion.
• They describe exactly how links are earned, and none are paid, exchanged or from their own network.
• They showed a dated, redacted past report with a baseline and a comparison.
• For AI search: named engines, a fixed prompt set, a run count and dates.

Red flags (any one is a reason to stop):

• Guaranteed rankings, guaranteed AI citations, or claimed Google approval.
• Secret methods or a network you can't inspect.
• Reviews, testimonials or mentions for sale.
• llms.txt, schema or chunking sold as an AI requirement.
• A score only they can measure.

In the contract:

• Deliverables and success measures in writing.
• You own every account; they get user access, starting at read-only.
• Change log, link and review clause, ownership of work.
• Short first term, clear exit, offboarding steps including verification tokens.

Sources

Google Search Central: Do you need an SEO? (page dated 2026-06-05), third-party SEO tools and advice (page dated 2026-06-05), spam policies (page dated 2026-08-28), optimizing for generative AI search (page dated 2026-07-10), AI features, page experience (page dated 2026-09-22). Search Console Help: Performance report, users and permissions. Google Maps: user-contributed content policy. US FTC: Consumer Reviews and Testimonials rule Q&A, Endorsement Guides FAQ, policy statement on advertising substantiation. SparkToro and Gumshoe.ai, AI brand-recommendation consistency study (2026-01-28). Chen, Wang, Chen and Koudas, arXiv:2509.08919 (2025). All retrieved 2026-10-06.