Case study · Bespoke AI application
Verify: a free way to check a link, QR code or phone number before you trust it
Scams now arrive as a text, a parking-meter sticker or a QR code on a table. Verify gives anyone a plain red, amber or green answer in seconds — and shows businesses how to prove their domains are genuine. Built by Eazi IT, running on our infrastructure.
The brief
Make the safe choice the easy one
Nobody stops to research a QR code on a parking meter. If checking takes more than a few seconds, people simply do not check. So the brief was a single screen: point the camera or paste the thing you were sent, and get an answer a non-technical person can act on.
It also had to be honest about what it does not know. A tool that says “safe” when it has merely failed to find a problem is worse than no tool.
What we built
How it works
Scan, paste or search
Scan a QR code with the phone camera, paste a link, or check a phone number. The result is a 0–100 score with a red, amber or green verdict and the reasons behind it.
Follows short links
Shortened links are expanded silently on the server, with protection against being tricked into visiting internal addresses, and the real destination is what gets rated.
Says what the page is
A short AI-written description at the top — for example “an IT services contact page” — so a mismatch with what you expected is obvious.
Safe Browsing and reputation
Addresses are checked against Google Safe Browsing, and a known-brand allowlist stops genuine sites such as PayPal being treated as suspicious.
Registered, verified domains
Businesses register a domain and prove they own it with a DNS record. Verify re-checks it automatically: pass and it is approved, fail and it is withdrawn. A page on a verified domain is reported as such, and www is treated the same as the bare domain.
Community votes
Visitors can vote on what they have seen. Votes are stored against a one-way hash, never an identity.
The AI decision
AI describes and explains. It does not decide.
This is the part we would point any client to. The verdict comes from ordinary, testable rules: reputation lists, redirects, domain ownership, payment-page checks. AI is used for one narrow job — writing a one-line description of the page — and only on public text.
Treated as untrusted
Page text is handed to the model as data to describe, never as instructions, so a hostile page cannot talk the tool into calling it safe.
Cheap and bounded
Rate-limited, cached for 24 hours and run on a small, fast model, so a busy day cannot become an expensive one.
Switchable
If the AI service is unavailable the app falls back to a keyword-based description and carries on.
The honest bit
Three things the real world taught us
Any agency can show you a case study where everything worked first time. Here is what actually happened.
A site that refused to be looked at
One short-link service blocked our server outright. We could not see where it led, and we chose to cap it at amber with a clear warning rather than guess either way.
A famous brand, a generic page
PayPal sends automated visitors a generic wallet page, so the description of a personal payment link describes PayPal, not the person. Correct behaviour, but we now say so rather than let it surprise anyone.
A blank admin page
The first DNS check page came up blank because the host restricts a PHP DNS function. We moved to a standards-based DNS-over-HTTPS lookup with a fallback, and added a visible message for the next failure.
Each was fixed and covered by an automated test. The suite currently runs 31 checks without needing a database or a network connection.
Built in properly, not bolted on
Private by design
Camera images stay on the device. Checked links are not tied to a person. A short privacy notice is built into the app and referenced from ours.
Plain, maintainable stack
PHP and MariaDB behind a small JSON API, with no framework to go out of date. Hosted in the UK/EU on our own infrastructure.
Backed up and monitored
The database is dumped and backed up nightly with the rest of our estate, and the site is monitored like every other site we run.
What this project says about how we work
We decide where AI belongs before we build. Here that is one job, not ten. Everything else is rules you can read and test.
We say what we do not know. An honest amber beats a confident green.
We build the thing we sell. Verify is our own product, in the same AI-powered, UK-hosted way we would build yours.