AI visibility for US SaaS: the procurement facts are the filter, and most of them sit behind a form

A US software company gets named by ChatGPT or Gemini when the procurement facts an American buying question carries are sitting in plain text on a page an engine can fetch. In this market the question almost never arrives on its own. It arrives with a clause attached: a security report, a signed agreement for regulated data, a seat count, a tax position, a vendor form. Those facts exist at every serious SaaS company and they usually live in a PDF behind a request form, which means they are not in the text an answer gets assembled from. In our benchmark run on 15 October 2026, ChatGPT and Gemini each answered 102 buying questions in the United States, which is 204 US readings, and cited our own domain zero times on either engine. Across the full run of 597 readings, 85.6 per cent of 10,652 citations went to somebody's own website.

The scope of that measurement

Two engines, read once, on a stated date: ChatGPT and Gemini on 15 October 2026, across the United States, the United Kingdom and India, 597 usable readings of 612 attempted. Every question in it was a general buying question asked market by market. No industry was measured on its own, so the run contains no software category rate, and the part that transfers is the source mix an American answer is built from. Method and the full table are in what AI assistants actually cite across 597 readings of ChatGPT and Gemini in three markets, and the American slice in the US cut of those 204 readings. The product we sell reads five surfaces: ChatGPT, Gemini, Perplexity, Claude and Google AI Overviews. The figures here come from two, so nothing on this page speaks for Perplexity, Claude or AI Overviews.

What an American software question has attached to it

The clause in the question	What the engine needs to find in text
Needs SOC 2	Report type, the CPA firm that issued it, the period it covers, the trust criteria in scope
Handles patient data	Whether you sign a business associate agreement, and which parts of the product it covers
Sells to a federal or state agency	FedRAMP or StateRAMP status in words, the authorizing body, the marketplace listing
Has a California privacy requirement	Your position under the state privacy law, named, with the request process
Fifty seats and a budget	A dollar figure, the billing unit, and what sales tax does to it

Each row is a filter a shortlist runs on. The pattern is consistent: the facts are not secret, they are just not published as sentences. A security questionnaire answers all of this for one prospect at a time, privately, which is the opposite of being quotable.

The trust page, written as text rather than offered as a download

Publish a page that answers the compliance clause without a form in front of it. Name the report you hold and its type, the CPA firm that performed the examination, the period the report covers, and which trust services criteria were in scope. Say plainly whether the full report needs an agreement, because a reader who knows that will ask rather than leave. Then add the subprocessor list, where customer data is stored, the regulated data agreements you will sign, and the date you last reviewed the page.

Write it as prose and a table, not as a wall of logos. A badge image says nothing to a fetcher and almost nothing to a buyer, while one sentence naming the auditor and the period is checkable, which is the quality the engines rewarded across the run. For the rest of the SaaS question set, from the comparison page to the docs, the market neutral version of this work is in AI visibility for SaaS, and this page is the American layer on top of it.

Dollars, seats and the sales tax sentence

Every one of the 102 build spec conversations in our run asked for pricing in the reader's own currency. For a US buyer that means a dollar figure, the unit it is charged per, the annual and monthly difference, and one sentence on tax, because an American list price is quoted before sales tax and the buyer knows the total will differ. Say which states you collect in, or say that tax is added at checkout based on the billing address. That single sentence turns a price into a total somebody can budget against.

If a plan is genuinely quoted, publish the structure: the unit, the band, the things that move the number, the contract length, and the review date. 101 of 102 specs also asked for a before and after with the window stated, so dating the page is not optional decoration. It is the thing that makes the number usable next quarter.

Badges, awards and testimonials under US advertising rules

American software marketing leans on quadrants, grids and category badges. Two things are worth knowing. The Federal Trade Commission's endorsement rules require a material connection between you and anybody endorsing you to be disclosed, and expect a testimonial to represent a typical experience or to say what the typical experience is. And the measured value of the directories those badges come from is smaller than the industry assumes: review directories took 0.8 per cent of the 10,652 citations in the run, counted one at a time in our count of every directory citation. Keep the profiles accurate because buyers look at them, and write the dated customer result in text on your own site, where the citation data says the answer is actually coming from.

The two engines are not one audience

Test both, because they behave differently. ChatGPT's most cited domain appeared in 176 of its 306 readings, while Gemini's most cited domain appeared in 19 of its 291. One engine leans on a short, entrenched list of sources; the other spreads across many small sites. A software company with a thin link profile and a good trust page has the better opening on the second while it works on the first.

Reading your own position this week

1. Write six buying questions with the clause in them, in a buyer's words, naming your product in none: team size, the security report, the regulated data, the state, the seat count.
2. Ask each one twice in ChatGPT and twice in Gemini, from a fresh chat with history turned off.
3. Record who was named, and save every source shown.
4. Publish the two facts the engines went looking for and could not find on your domain, with a date on each.

An enquiry that arrives after an assistant named you tends to land further down the process than a form fill, which is worth weighing against what b2b lead generation services actually buy. A plain statement of interest: the fix is the thing we sell. AI Knows Us publishes the trust, pricing and comparison pages an American buying clause asks for, then keeps score afterwards. 64 of the 102 build specs asked for that to be on the page, and the benchmark here carries our own figure of 3 citations in 597 readings, zero of them in the United States.

Questions about AI visibility for a US software company

Does publishing SOC 2 detail create a security risk?

The detail that belongs on a public page is the fact of the report, its type, the auditor, the period and the scope. The report itself stays under agreement. Naming the auditor and the period is what a buyer needs to believe the claim, and it is already on the certificate.

We are pre certification. What do we publish instead?

The current position with a date: the controls in place, the framework you are working to, the stage you are at, and when you expect the examination. A dated, specific statement is quotable, and it gets you into answers that a silent page does not.

Should the trust page sit on the main domain or a subdomain?

Either works, as long as that host has its own robots.txt permitting the AI fetchers and the content renders server side. A trust page on a blocked subdomain is a page the engines never read.

Will an assistant quote a price we change every quarter?

It quotes the page it can read, so the fix is to keep the page current and dated rather than to remove the number. A quarterly review line on the pricing page tells a reader and a model how fresh the figure is.

The questionnaire you already answer, one prospect at a time

Most American software companies answer the same security and procurement questionnaire several times a quarter, in private, for one buyer at a time, and then file it. Half of what goes into those replies is not confidential at all: the report and its auditor, the data you will sign for, the storage location, the price for a seat count, the tax treatment. Published once, in text, with a review date, that half stops being a private email and becomes the passage an assistant can quote when somebody asks the same question without ever reaching your sales team. The private version serves one buyer. The published version serves the question itself.