Compliance Program

Two tracks

BRSG operates two types of work with distinct compliance profiles. Content sites carry FTC affiliate and AI disclosure obligations. Client consulting work carries engagement, confidentiality, and professional-conduct obligations.

Track 1 · Owned Content

Content Sites

Affiliate disclosure, AI content transparency, privacy/CCPA, and lead-gen consent for BRSG-owned properties. Primary risk: FTC 16 CFR 255 affiliate disclosure and FTC AI guidance.

7owned sites

0P0 open

4standards live

Applies uniformly to every BRSG-owned content property. The current roster lives in the owned-properties reference and the periodic property audit — not enumerated here, so the standard never churns as the roster changes.

Track 2 · Client Consulting

Client Engagements

SOW standards, confidentiality obligations, deliverable ownership, conflict of interest, and professional liability awareness for active consulting clients.

5+active clients

1standard live

Applies to every active consulting engagement. Specific clients are tracked in the engagement register, not listed here.

Standards library

Operational standards that govern how BRSG publishes content and manages client relationships. Each standard is a deployable document — read it, apply it, reference it by URL in vendor agreements or counsel memos.

Affiliate & Sponsorship Disclosure Standard Live FTC 16 CFR 255 · all content hubs · v1.0 · 2026-06-25
Authorized Security Testing & Scanning Standard Live CFAA authorization boundary · BRSG-owned assets only · v1.0 · 2026-06-25
Privacy Policy & CCPA/CPRA Standard Live CCPA/CPRA baseline · notice-at-collection · all data-collecting sites · v1.0 · 2026-06-25
AI Content Disclosure Protocol Live FTC AI guidance · CA SB 942 · accuracy gate · v1.0 · 2026-06-25
Client Engagement Standard Live SOW · confidentiality · IP ownership · conflicts · Track 2 · v1.0 · 2026-06-25
TCPA/Lead Consent Standard Queued Required if any lead form adds a phone field (none collect phone today)

Audits

Point-in-time reviews of the owned-property fleet against the standards. Findings feed the open-action register below.

Owned-Property Compliance Audit — Affiliate & Privacy 2026-06-25 8 properties · affiliate disclosure (A1) + privacy/CCPA (A3) · headline: privacy is the systemic gap
Verify your site → Self-audit Conformance checklist · run any site against the standards · affiliate · privacy · AI · security

Open actions

Post-audit remediation register (2026-06-25). All audit remediations are complete and live-verified across the fleet — no open items.

✓ Privacy (A3) — all live. Privacy policies published on all 6 live sites per the standard (A3-1), incl. proinvestorhub Do-Not-Sell/Share for lender routing (A3-3), verifiedvector lead-form notice-at-collection (A3-4), cryptolendinghub CCPA upgrade (A3-5), agedleadsales CPRA cross-context-sharing polish (A3-6). Complete 2026-06-25
✓ Affiliate (A1) — all live. howtoworkleads AgedLeadStore material-connection disclosure — dedicated page + footer + proximate CTA (A1-1); proinvestorhub disclosure page + footer + honest per-lender badge mechanism (A1-2); crypto + self-employed proximate affiliate banners on the comparison/lender pages (A1-3). Plus howtoworkleads Terms-of-Service dead-link fix. Complete 2026-06-25
✓ Foundations. Audits A1 + A3 complete; all Phase-1 standards written and live. Remaining non-remediation follow-ups (demoleadgen build, billricestrategy Vercel auto-deploy reconnect, privacy mailbox aliases) tracked in site backlogs. Complete 2026-06-25

About this portal

Source markdown lives in ~/Documents/brsg/_internal/compliance/ — never committed to git. This portal is the rendered surface. To rebuild after source changes:

cd ~/Code/apps/brsg/compliance-portal/compliance/_build
npm install   # first time
node build.mjs && node render-pdfs.mjs   # HTML + true PDFs

Commit the HTML output + push to main. Vercel auto-deploys to standards.billricestrategy.com.