The words vendors use, and what each one means.
Google's measure of whether your ad can show at all and, if it can, where on the page. Google names six inputs: your bid, the quality of your ads and landing page, the Ad Rank thresholds, how competitive the auction is, the context of the search, and the expected impact of your assets.
Auto-applied recommendations let a platform change your ad account on a schedule once you turn the setting on. Google says the recommendations available are subject to change over time, so you are consenting to a category rather than a fixed list. Both platforms keep a history of what was applied.
Read the full entryBroad match is the widest keyword setting, and Google's default. Google says ads may show on searches related to your keyword, including ones that do not contain its direct meaning. Both platforms say it should be paired with automated bidding, because every query it matches is different.
Read the full entryClick-through rate is the share of people who saw your ad and clicked it, worked out as clicks divided by impressions. Google gives the example of 5 clicks from 100 impressions being a 5 percent rate. It measures interest in the ad, not whether the click was worth anything.
Read the full entryConversion rate is the share of ad clicks that turned into something you count as a result, like a phone call or a filled in form. Google works it out as conversions divided by ad interactions. Microsoft divides by clicks. The two are not the same number, so compare platforms carefully.
Read the full entryCost per click is what you pay each time someone clicks your ad. You set a maximum you are willing to pay, and the auction usually charges less: Google says advertisers are often charged less, sometimes much less, than that maximum. It is the unit your ad invoice is built from.
Read the full entryWhat you paid to get one person to actually get in touch, worked out as spend divided by inquiries. Cost per click counts everybody who clicked. Cost per lead counts only the ones who called, filled in a form or booked. The gap between the two is where the money leaks.
A daily budget is an average, not a cap. Google says your daily spending limit is two times your average daily budget on any given day, and your monthly limit is 30.4 times it. So 10 dollars a day is about 304 a month, and a single day could reach 20.
Read the full entryImpression share is how often your ads appeared as a share of the times Google estimates they could have. The denominator is an estimate, not the whole market: Google excludes auctions where you would need a huge bid increase to appear. Microsoft measures against the market it targeted, so the two are not comparable.
Read the full entryThe learning phase is the stretch after a change when an ad platform is still working out who to show your ads to, so results swing around. Meta reports it as learning, success or fail. Meta publishes no number of conversions needed to leave it. Google does state a figure for its own bid strategies.
Read the full entryThe most you are willing to pay for one click, set by you on a keyword, an ad group or a campaign. It is a ceiling, not a price. What the auction actually charges is usually lower, though Enhanced CPC and bid adjustments can push a single click above it.
A negative keyword stops your ad from showing on searches that contain it. It is the main tool for cutting wasted spend. The catch is that negatives do not expand the way normal keywords do: Google says they will not match close variants, so plurals and misspellings need adding by hand.
Read the full entryOptimization score is a platform's estimate of how fully your account is set up, shown as 0 to 100 percent. Both Google and Microsoft say it rises when you apply a recommendation or dismiss one. So it measures how few recommendations are outstanding, not how the account performs.
Read the full entryPerformance Max is a single campaign that buys across all of a platform's inventory. Google lists YouTube, Display, Search, Discover, Gmail and Maps from one campaign. Microsoft advises giving it two to three times the budget of a standalone campaign, because it serves across multiple formats and inventory.
Read the full entryPlacement means where your ad appears, but the two big platforms mean different things by it. On Google a placement is somebody else's website, app or video. On Meta it is a surface inside Meta, like the Facebook feed or an Instagram story, plus its Audience Network of third party apps.
Read the full entryQuality Score is a 1 to 10 diagnostic number reported against each keyword, estimating how relevant your ad, keyword and landing page are. Both Google and Microsoft state plainly that the score itself is not used in the auction. Ad quality does affect what you pay. The number in your account does not.
Read the full entryThe search terms report lists the actual things people typed before your ad appeared, next to what each one cost. It is where you find out whether you are paying for searches you would never want. Google omits low volume terms from it for privacy, so it is not a complete list.
Read the full entrySmart Bidding sets a bid for every individual auction rather than per keyword. Google calls this auction-time bidding and says some of its signals are exclusive to it. Microsoft is blunt about the trade: with auto-bidding you can only set a bid at campaign level, and the model computes the rest.
Read the full entryA special ad category is a label Meta makes you declare when your ad is about housing, employment, credit or politics. Declaring it removes most targeting: no lookalike audiences, a fixed 18 to 65 plus age range, no gender choice, and a radius of at least 15 miles. Google restricts the same areas by different rules.
Read the full entryThe AI Assistant channel is a Google Analytics 4 traffic channel for visitors who arrive from AI tools such as ChatGPT, Gemini, Deepseek, Copilot or Grok. It excludes Google's own AI Overviews and AI Mode, which GA4 counts as Organic Search, so AI traffic is split across two channels.
Read the full entryAn attribution model is the rule or algorithm that decides which clicks and visits get credit for a sale or lead. Google Ads defaults most conversions to data-driven attribution, and GA4 offers three models, so the same lead can be credited differently depending on the report.
Read the full entryA conversion is an action you told the ad platform to count as a result, like a form or a call. The number is not a headcount. Google's One conversion setting counts one per ad click, not per person, and Microsoft calls the same two settings All and Unique.
Read the full entryConversion delay is the gap between the click and the sale. Microsoft states conversions are reported on the click date rather than the conversion date, so recent days are always incomplete, which temporarily inflates cost per acquisition and deflates return on ad spend.
Read the full entryA conversion window is how long after somebody clicks your ad a resulting action still gets counted. Google's default for click-through conversions is 30 days. Changing the window is not retroactive, so an action that fell outside the old window does not get counted later.
Data thresholds are rules Google Analytics 4 applies to withhold rows or numbers from a report when showing them could reveal something about individual visitors. A thresholded report shows less than the property collected, so it is easy to mistake for broken tracking or a slow week.
Read the full entryEngagement rate is the share of visits to your website that Google Analytics 4 counts as engaged. A visit qualifies when it passes a timer that starts at 10 seconds, reaches two page views, or records a key event. Bounce rate is everything else, so the two add up to 100%.
Read the full entryEnhanced conversions send a hashed version of your customer's email address or phone number to the ad platform, which matches it against its own signed-in account holders. Both platforms describe it as a replacement for third-party cookies, and both match against their own user base.
Read the full entryGoogle signals is a Google Analytics 4 setting that enriches reporting with data from visitors signed in to a Google account who have turned on Ads Personalization. Since June 15, 2026, Google says the setting controls only the association of Analytics data with signed-in user information for behavioral reporting.
Read the full entryIncrementality testing is a controlled experiment that splits an audience into a group that can see the ads and a group held back from them, then compares their conversions. The difference estimates the sales or leads the ads caused, apart from the attribution rules behind the conversions an ad account reports.
Read the full entryKey event is the word Google Analytics uses for an action worth counting. Google calls it the umbrella term, and says conversions are specific to the context of ads and, unlike key events, are eligible for bidding and reporting in Google Ads. The two columns are not the same measurement.
Modeled conversions are Google's estimate of conversions it is unable to observe directly. Google says they can take up to 5 days to fully process and stabilize, and that conversion values are subject to retroactive increases for a period of several days while modeling finalizes. So a number can legitimately rise after you read it.
An offline conversion import tells the ad platform that a click became a sale somewhere it could not see. You store the click ID with the lead and hand it back when the deal closes. Microsoft states that anything uploaded more than 90 days after the click is not imported.
Read the full entryA phone call conversion is a call that Google Ads counts as a conversion, usually one that lasts at least a minimum length the advertiser sets. Two of Google's five tracking methods count taps or estimates instead of calls, so a report can show call conversions for calls that never happened.
Read the full entryPrimary and secondary conversion actions decide which conversions count where. Google reports primary actions in the Conversions column and uses them for bidding, while secondary actions are observation only and appear in All conversions. Microsoft draws the same line with a property called ExcludeFromBidding.
Read the full entryUTM parameters are tags added to the end of a link so analytics can record where a visit came from. Google says to always use utm_source, utm_medium and utm_campaign. Values are case sensitive, so utm_source=Google and utm_source=google are counted as two different sources.
Read the full entryA view-through conversion credits an ad that was seen but never clicked. Google counts an impression as viewable when at least 50% of the ad is onscreen for at least 1 second, so the standard being met is lower than most people picture when they hear that someone saw the ad.
Read the full entryAverage position is the topmost position your page reached, averaged only across searches where it appeared at all. Google counts result blocks rather than places on the screen, and says ads occupy none of them. In advertising the metric is gone: Microsoft deprecated it in 2021 and now reports zero.
Read the full entryA canonical URL is the version of a page you want treated as the real one when several URLs show the same content. The standard calls it the author's preferred version. Google ranks it a strong signal, not an instruction, and says none of these methods are required because it will pick a version anyway.
Read the full entryCrawled, currently not indexed is a Search Console status meaning Google fetched a page and chose not to index it. Google says it may or may not be indexed later and that there is no need to resubmit the URL. Discovered, currently not indexed is different: Google has not fetched it yet.
Read the full entryCrawling is a search engine fetching your pages to see what is on them. MDN describes a crawler as a program that systematically browses the web to collect data. Google is blunt about the limit: it does not guarantee that it will crawl, index, or serve your page, even when everything is done correctly.
Read the full entryA Google Business Profile is the free listing that puts your business in Google Maps and in the local results beside search. Google's rule for qualifying is narrower than most people expect: the business must make in-person contact with customers during its stated hours, so online only businesses do not qualify.
Read the full entryAn incentivized review is one a customer wrote after being offered something for it. The FTC rule does not ban that. It bans conditioning the incentive, expressly or by implication, on the review expressing a particular sentiment. Adding a disclosure does not fix a five-star requirement.
Read the full entryIndexing is a search engine storing information about your page in its database so the page can be found later. Cloudflare compares it to a library card catalog. Google is direct about the limit: indexing is not guaranteed, and a page can be indexed and still never appear.
Read the full entryA knowledge panel is the box of facts Google shows beside search results about a person, organization or thing. Google builds it automatically when enough information exists on the open web, so nobody can buy or request one, and businesses get a separate Business Profile panel instead.
Read the full entryLocal SEO is the work of showing up when somebody nearby searches for what you sell. Google names three factors: relevance, distance and prominence. Distance is the one you cannot change, and Google states plainly that there is no way to request or pay for a better local ranking.
Read the full entryA review snippet is the star rating Google can show beside a search result, drawn from structured data on the page. Local businesses cannot get one from reviews about themselves. Google says pages where the reviewed entity controls the reviews, including embedded review widgets, are ineligible.
Read the full entryReview suppression is hiding or removing customer reviews based on how negative they are. The FTC rule allows moderation as long as the criteria are applied equally regardless of sentiment. What it prohibits is implying the reviews you display represent all of them, and using false accusations or threats to get one taken down.
Read the full entryA robots.txt file tells crawlers which URLs they may fetch on your site. Google is explicit that it is not a way to keep a page out of search: a disallowed URL can still be indexed if other sites link to it. The convention dates to 1994 and became RFC 9309 in 2022.
Read the full entryScaled content abuse is Google's name for generating many pages mainly to manipulate rankings rather than help people. Its definition says this applies no matter how the content is created, so using AI is not itself the violation. Google states it focuses on the quality of content rather than how it was produced.
Read the full entryA sitemap is a file listing the URLs on your site so search engines can find them. Google says it ignores the priority and changefreq tags and uses lastmod only when the date is verifiably accurate. Bing calls lastmod a key freshness signal. A sitemap aids discovery and guarantees nothing.
Read the full entryStructured data is markup that describes your page in a shared vocabulary, founded by Google, Microsoft, Yahoo and Yandex. Google is explicit about the limit: using it enables a feature to be present and does not guarantee that it will be present, even when the markup is correct.
Read the full entryAI content disclosure is labeling material as machine-made where a platform requires it. Google's product listings require AI-generated images to carry a specific IPTC metadata code, and IPTC defines three different codes: created with generative AI, edited with it, and edited by a person.
Read the full entryAn AI Overview is the summary Google sometimes places above the results, with links to sources. Google says they are only shown when its systems judge them additive to classic Search, so they often do not trigger. There is no special file or markup that gets you into them.
Read the full entryAn AI performance report shows how often AI search features show or cite your site. Google's version counts impressions in AI Overviews and AI Mode. Bing's counts citations and states its numbers do not indicate ranking, authority or placement. Neither publishes a position inside an AI answer.
Read the full entryGoogle-Extended is a robots.txt token that controls whether content Google crawls from your site may be used to train Gemini models and ground Gemini apps. Google states it does not affect your inclusion in Search or your ranking. It is a training control, not a way to stay out of search results.
Read the full entryGPTBot is the web crawler OpenAI uses to collect pages that may be used to train its AI models. You allow or block it with a line in your robots.txt file. Blocking it is a separate decision from appearing in ChatGPT search, which a different crawler handles.
Read the full entryGrounding is tying an AI answer to retrieved sources rather than letting the model answer from memory. Google uses the word as a synonym for retrieval augmented generation. Microsoft treats groundedness as something you measure on a scale, which is the more useful way to think about it.
Read the full entryllms.txt is a proposed Markdown file, placed on a website, that gives AI agents a short summary of the site and links to its most useful pages. Google says Google Search ignores these files, so adding one neither helps nor harms how a site appears in Google, AI Overviews included.
Read the full entryNon-commodity content is Google's term for a page carrying something only you could write. Its test is a contrast: commodity content is common knowledge that could originate from anyone, while non-commodity content gives an expert or experienced take that goes beyond the ordinary. First-hand beats summarized.
Read the full entryQuery fan-out is the model turning one question into several searches at once. Google describes it as a set of concurrent, related queries generated by the model to fetch additional relevant search results. The trap is the obvious response: Google names a page per fan-out query as scaled content abuse.
Read the full entryYouTube AI disclosure is the AI use setting a creator must turn on when a video contains realistic content made or meaningfully altered with AI. YouTube then labels the video, and says disclosure does not limit a video's audience or its eligibility to earn money.
Read the full entryA 301 redirect is a server instruction saying a page has permanently moved to a new address. Google treats it as a signal that the new address is the real one and should be the version shown in search results. A 302 says the move is temporary, so Google keeps showing the old address instead.
Read the full entryA 302 tells browsers and search engines that a page has moved for now, but the old address is coming back. Google follows it without treating the new address as the one to show in results. Using it for a permanent move is a common and quiet mistake.
A 404 means the server could not find the page. The standard adds a second meaning most people miss: it can also mean the server will not say whether the page exists. A soft 404 is worse, a page that tells visitors it is missing while still reporting success.
Read the full entryCore Web Vitals are three measurements Google uses for page experience: loading, responsiveness and visual stability. The current set is LCP under 2.5 seconds, INP under 200 milliseconds and CLS under 0.1. A page passes only if it hits all three at the 75th percentile of real visits.
Read the full entryCumulative Layout Shift measures how much a page's visible content moves unexpectedly. Despite the name it is not a total: web.dev defines it as the largest burst of shifts within a five second window. Movement you caused, like clicking a button, does not count.
Read the full entryThe Deceptive site ahead warning is a red alert Chrome can show when Google Safe Browsing detects social engineering content on a site, meaning content that tricks people into doing something dangerous. Chrome advises visitors against continuing, so traffic from Chrome can stop until the content is removed and a review is approved.
Read the full entryDNS is the system that turns a domain name into the address of the machine that answers for it. Your records live on an authoritative server named in the domain's NS record. Changes are not broadcast; old answers simply sit in caches until the TTL you set expires.
Read the full entryInteraction to Next Paint measures how long a page takes to respond visibly to a click, tap or key press. It reports the worst interaction of the visit rather than the average, ignoring outliers, and it breaks into three parts: input delay, processing duration and presentation delay.
Read the full entryLargest Contentful Paint is the render time of the largest image or block of text visible without scrolling, measured from when the page starts loading. web.dev breaks it into four parts that add up with no gaps, and says time to first byte and resource load duration are usually about 40 percent each.
Read the full entryThe redemption grace period is the 30 days after an expired domain name is deleted during which it can still be restored for the registrant who held it, usually for a restore fee. The registry switches off the domain's DNS during those days, so the website and email tied to it stop working.
Read the full entryA redirect chain is one address sending you to a second, which sends you to a third. Google says its crawler follows up to ten hops but advises going straight to the final destination, keeping any chain to fewer than five. Every extra hop is another request the visitor waits for.
An SSL or TLS certificate is the file that lets a browser confirm it is really connected to your domain, and it turns on encryption for the connection. It binds your keys to your domain name. It says nothing about whether the business behind the domain is trustworthy, and it is usually free.
Read the full entryA VPAT, or Voluntary Product Accessibility Template, is a free form from the Information Technology Industry Council for reporting how a product meets accessibility standards. Completed for one product, it becomes an Accessibility Conformance Report, or ACR. A federal agency may not buy without an ACR unless the agency claims a special use case exception.
Read the full entryWeb accessibility means people with disabilities can use your site. The Department of Justice says the ADA's requirements apply to what a business offers online, while stating it has no regulation setting out detailed standards for how. A separate rule does set one, WCAG 2.1 Level AA, but it binds state and local government.
Read the full entryA web application firewall (WAF) is a filter that sits in front of or inside a website's server and applies rules to incoming HTTP requests, blocking those matching common attacks such as SQL injection. It can shield a known flaw quickly while a fix is written, but OWASP notes that the source code is left unchanged.
Read the full entry10DLC registration is the verification US carriers require before a business sends text messages through software from an ordinary 10-digit local number. The business is registered as a brand, and its messaging as a campaign, through its texting provider. Unregistered traffic faces more filtering and extra carrier fees.
Read the full entryAn AI voice call uses a synthesized or cloned voice to speak to the person who answers. In February 2024 the FCC confirmed those voices fall under the existing rules on artificial or prerecorded voice, so the same consent requirements apply. The message must also identify your business and offer an automated way to opt out.
Read the full entryCall tracking replaces the phone number shown to a visitor with a substitute number that routes to your real one. Only calls dialed through that substitute are measured. Google assigns a forwarding number when call reporting is on, and Microsoft requires an ad group to have reached 10 clicks and 10 dollars of spend in 30 days.
Read the full entryCaller ID spoofing is sending a number other than the line you are calling from. The federal prohibition is not about the technique. It applies to transmitting misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value.
Read the full entryAn entity-specific Do Not Call list is a business's own record of people who asked it to stop calling them. The Telemarketing Sales Rule forbids calling those people, separately from the National Do Not Call Registry, and each violation can bring a civil penalty of $53,088.
Read the full entryKari's Law is the federal rule that lets anyone dial 911 from an office phone without pressing 9 or any other code first. It applies to phone systems installed or first sold after February 16, 2020. When a system breaks the rule, the business managing it is presumed responsible.
Read the full entryA letter of authorization is the signed form that lets a new phone provider request a business's existing numbers from the current provider, a move called porting. If its details do not match the old carrier's records, the port is usually rejected and the move is delayed.
Read the full entryThe National Do Not Call Registry is the federal list of numbers telemarketers may not call. Sellers subscribe by area code, and FTC guidance says call lists must be scrubbed against it at least every 31 days. Business to business calls are largely outside the rule, with narrow exceptions.
Read the full entryThe Reassigned Numbers Database is an FCC database that tells a caller whether a phone number has been permanently disconnected since a given date, which means it may now belong to someone else. Querying it before calling on old consent is how a caller qualifies for the FCC's safe harbor for reaching a reassigned number.
Read the full entryA robocall is an outbound call that plays a recorded message. The Telemarketing Sales Rule prohibits placing one to sell something unless the person gave express agreement in writing beforehand. The rule covers calls you place. A system that answers calls coming in to you is a different thing.
Read the full entrySTIR/SHAKEN is how phone carriers sign outbound calls so the receiving network can tell the caller ID was not faked. The signature is your provider attesting to the accuracy of the number it is sending. Congress required it on internet protocol networks and asked only for reasonable measures elsewhere.
Read the full entryThe Telemarketing Sales Rule is the FTC rule governing sales calls. Beyond the do not call list, it sets what a caller must say and when they may call: residential calls only between 8am and 9pm local time, and a prompt disclosure that the purpose of the call is to sell something.
Read the full entryThe CCPA business thresholds are the three tests that decide whether California's privacy law covers a for-profit company doing business in the state. Meeting any one is enough: revenue above $26,625,000 a year, buying, selling or sharing personal information of 100,000 or more consumers or households, or earning half its revenue from selling or sharing it.
Read the full entryConsent mode is how an advertising tag is told whether a visitor agreed to be tracked. Both major platforms now require a consent signal, and the penalties differ in kind: Google's policy allows it to suspend or terminate your account, while Microsoft simply stops recording your conversions.
Read the full entryDKIM attaches a cryptographic signature to a message so a receiver can confirm the signed parts were not altered. The standard describes it as a domain claiming some responsibility for the message, and it separates the signer from the purported author. Modifying a message in transit breaks the signature.
Read the full entryDMARC is a DNS record that tells receiving mail systems what you think about messages using your domain that fail authentication. The current standard, RFC 9989, is explicit that receivers can honor your request but are not required to. It was revised in 2026, and the percentage rollout tag was removed.
Read the full entryGlobal Privacy Control is a signal a web browser sends to every site a person visits, saying they do not want their personal information sold or shared. California's CCPA counts it as a valid opt-out request, and Colorado recognizes it as a universal opt-out, so covered businesses must honor it automatically.
Read the full entryAn MX record is the DNS record that names the mail servers accepting email for a domain, and senders try the lowest priority number first. If a DNS move drops it, senders try the domain's own A or AAAA address, often the website's server, and if nothing there accepts mail, may keep retrying for about a week.
Read the full entryA notice at collection is the disclosure California's privacy law requires before or as a covered business collects personal information. It says what is collected and why, whether it is sold or shared, and how long it is kept. So it belongs wherever the information is gathered, such as a website form.
Read the full entryPrior express written consent is the standard the FCC's rules require before a business sends marketing calls or texts using an autodialer or an artificial voice. It has to be a signed agreement naming the phone number, and the rule says a person cannot be required to sign it as a condition of buying anything.
Read the full entryThe CCPA right to delete lets a California consumer ask a covered business to erase personal information collected from them. Unless an exception applies, the business deletes it within 45 days, extendable once by 45 when reasonably necessary with notice. It also notifies service providers, contractors and, unless impossible or disproportionate, third parties it sold or shared data with.
Read the full entryYour spam complaint rate is how often recipients mark your mail as spam. Google publishes a target and a ceiling: keep it below 0.10% and avoid ever reaching 0.30%. Yahoo asks for below 0.3% and adds the detail that changes the arithmetic: it counts mail delivered to the inbox.
Read the full entryA spam trap is an email address kept to catch senders who mail people without permission. Nobody ever signed up with it, or its owner abandoned it long ago, so mail arriving there points to a problem with how a list was built. Hitting traps can get your email blocked.
Read the full entrySPF is a DNS record listing which servers may send mail using your domain in the envelope sender. The specification caps it at ten DNS-querying terms, and receivers must return permerror if that is exceeded, which means the check fails. It does not check the From address a recipient sees.
Read the full entryUnsubscribing has a legal shape and a technical one. The law allows a reply or a single web page, with no fee and no information beyond the address, honored within 10 business days. The one-click standard exists because automated scanners were unsubscribing people by accident.
Read the full entryAn API is the way one piece of software talks to another without a person in the middle. MDN describes it as a contract between the application offering it and whatever uses it. The part that matters commercially is that the contract belongs to whoever publishes it, and it changes.
Read the full entryBroken access control is an application letting someone see or do something their account should not. OWASP ranks it first in its 2025 Top 10 and reports that 100 percent of applications tested had some form of it. The rule that matters: a check enforced only in the browser is not a check.
Read the full entryA definition of done is the written list of conditions every piece of work must meet before anyone calls it finished. The Scrum Guide treats it as a gate: work that misses it cannot be released or even shown at the review. Agile Alliance warns that an unwritten one loses most of its value.
Read the full entryMulti-factor authentication means proving who you are with two different kinds of evidence. NIST treats it as a level rather than a switch: at AAL2 two distinct factors are required and the application must offer a phishing-resistant option. Vendor lists run from text messages to passkeys, all labeled MFA.
Read the full entryThe OWASP Top 10 is a standard awareness document naming the most common security risks in web applications. It is not a certification and not a checklist a supplier can pass. NIST built its own development framework partly on it, which is why it works better as a question than as a requirement.
Read the full entryA product backlog is the ordered list of everything a team might build next. The Scrum Guide calls it the single source of work for the team. Agile Alliance is explicit that including an item does not guarantee it will be delivered, so being in the backlog is not a commitment.
Read the full entrySecurity misconfiguration is software set up incorrectly rather than written incorrectly. OWASP ranks it second in its 2025 Top 10 and lists the usual causes: unnecessary features enabled, default accounts unchanged, and errors that show users a stack trace. The fix is a baseline somebody owns.
Read the full entryA sprint is a fixed length block of development work, one month or less in the Scrum Guide and usually one to four weeks in practice. The fixed length is the point: it is what makes a completion estimate possible, and it decides what can be changed once the block has started.
Read the full entryA user story is a small slice of work written from the user's point of view, usually to a role, feature, reason template. The Agile Alliance defines it and offers INVEST as the quality test. The Scrum Guide, the framework most teams name, does not use the phrase at all.
Read the full entryVelocity is the total of the estimates a team finished in one iteration. Agile Alliance is blunt about what it is not: a measurement made after the fact, not a budget or a forecast, with no meaningful comparison between teams and no such thing as an individual velocity.
Read the full entryVersion control is the permanent record of software as it changes. Microsoft describes it as taking a snapshot of the files and saving it so it can be recalled later. For a business paying for the work, it is where the asset lives, and access to it is a separate question from owning it.
Read the full entryWork made for hire is the legal category that decides who owns something you paid to have made. Copyright starts with whoever created the work. For commissioned work it only becomes yours through one of two narrow routes in the statute, and software fits neither by default.
Read the full entryAn AI agent is a model that has been granted the ability to take actions, not just produce text. OWASP says the damage one can do comes from three grants: excessive functionality, excessive permissions and excessive autonomy. What it is allowed to do matters more than how good it is.
Read the full entryAn automated employment decision tool is software that helps decide who gets hired or promoted, such as a system that scans resumes for key words. New York City's Local Law 144 bars employers from using one unless it had a bias audit within a year, the results are public, and candidates were notified.
Read the full entryA batch API lets software send a large group of AI model requests to be processed together within a set window, instead of waiting for each answer. OpenAI and Anthropic both charge half the normal price for batched requests, in exchange for results that can take up to 24 hours.
Read the full entryA context window is the maximum amount of text, counted in tokens, that an AI model can work with in one request, including its own reply. Everything counts toward it, from instructions to the conversation so far, and Anthropic notes that accuracy and recall degrade as it fills.
Read the full entryExplainability is being able to say how an AI system reached a decision. NIST separates three questions: transparency answers what happened, explainability answers how, and interpretability answers why it meant what it did. A global explanation describes the model. Only a local one answers a customer.
Read the full entryA hallucination is AI output that sounds right and is not. OWASP describes the model filling gaps in its training data using statistical patterns, without understanding the content, so the answer can be fluent and unfounded at once. Its own first example is an airline that was successfully sued over its chatbot.
Read the full entryThe Model Context Protocol, or MCP, is an open-source standard for connecting AI applications such as Claude or ChatGPT to outside tools and data. Each connection can let an AI tool read data or act in another system. Its specification says MCP cannot enforce its security principles at the protocol level, leaving that to the applications built on it.
Read the full entryModel drift is an AI system getting worse without anyone changing it. Microsoft names the causes plainly: data distribution changes, training-serving skew, data quality problems, shifts in environments and consumer behavior changes can all make a model stale. NIST sets the bar over the entire lifetime of the system, not at launch.
Read the full entryPrivacy-enhanced AI means an AI system built so your data is not exposed or quietly reused. NIST lists it as one of seven characteristics of trustworthy AI, and states the honest catch: privacy techniques can cost accuracy. The FTC has required firms to delete models built on unlawfully obtained data.
Read the full entryPrompt caching lets an AI provider reuse its work on the opening part of a prompt when the next request starts the same way. It lowers cost and speeds up replies. OpenAI applies it by default, while Anthropic charges extra to write a cache and a tenth of the normal price to read one.
Read the full entryPrompt injection is when text an AI system reads becomes an instruction it follows. OWASP notes the text does not have to be visible to a person, only parsed by the model, and that no fool-proof prevention is known. The UK's national cyber security body says the same.
Read the full entryRetrieval augmented generation is how an AI answers from your documents without being trained on them. OWASP describes it as combining a pre-trained model with external knowledge sources at answer time. So the documents sit in a store the system reads from, and who can read that store is the question.
Read the full entryTraining data is what a model learned from. The question owners ask is whether their own data joins it, and there is no single answer: OWASP names three separate stages, pre-training, fine-tuning and embedding. A commitment worth having names the stage and comes in writing.
Read the full entryAccess levels decide what somebody can do inside your advertising account. Google Ads has five: Email-only, Billing, Read-only, Standard and Admin. Only Admin can give account access, change access levels and cancel invitations. Microsoft uses different names for a similar ladder, topped by Super Admin.
Read the full entryAccount ownership decides who keeps the advertising account and its history when an agency relationship ends. Google lets anyone with administrative access unlink from a manager account at any time. Microsoft names the fix when the account was created in the wrong place, and lists what cannot be moved.
Read the full entryThe Consumer Review Fairness Act voids contract terms that stop customers reviewing you. A provision of a standard-form contract is void from the start if it bars a review, penalizes one, or takes the reviewer's intellectual property. Removing abusive or irrelevant content is still allowed.
Read the full entryA DMCA designated agent is the contact a website or online service registers with the US Copyright Office to receive copyright takedown notices. Sites that let users post material need one to qualify for the safe harbor from infringement liability. The registration expires after three years unless it is renewed.
Read the full entryGoogle publishes its own advice on hiring an SEO, and it is blunter than most agency marketing. No one can guarantee a number one ranking, a claimed special relationship with Google is a warning sign, and you remain responsible for what anyone you hire does to your site.
Read the full entryA liquidated damages clause sets, in advance, the amount or formula one party owes the other if it breaks the contract. Courts generally enforce one only when the figure is a reasonable estimate of harm that is hard to prove, and refuse one that works as a penalty.
Read the full entryA manager account is the umbrella account an agency uses to run several advertising accounts from one login. Linking one to your account is normal. Giving it ownership is not the same thing: Google says a manager account can be given ownership of a client account, which lets it manage who has access.
Read the full entryStatutory damages are a copyright award a court sets within ranges fixed by law, without the owner proving any loss: $750 to $30,000 per work, and up to $150,000 if the infringement was willful. In federal court they generally apply only to works registered in time, so registration dates shape what one unlicensed website photo can cost.
Read the full entryA time and materials contract pays a supplier fixed hourly rates for the hours actually worked, plus the actual cost of materials. The buyer carries the risk of the work running long, so the total is open ended unless the contract sets a ceiling price that the supplier exceeds at its own risk.
Read the full entryA trademark is a word, phrase, symbol or design that identifies your goods or services and indicates where they come from. It is not ownership of the word itself. The USPTO is blunt about that: rights attach to how the word is used with your specific goods or services, not to the word in general.
Read the full entryTypical results is the standard a testimonial has to meet before it can be advertised. The FTC Endorsement Guides treat a specific result as a claim about what customers will generally achieve, and the Commission tested the usual disclaimers. Neither one reduced that impression, so a caveat does not fix an unrepresentative case study.
Read the full entryAn uptime guarantee is a provider's promise that a service will be available for a stated share of each month, such as 99.9%. In the published terms of large cloud providers, the remedy for a miss is a credit on future bills that the customer has to claim, and that credit is the only remedy.
Read the full entryAn accountable plan is an employer's arrangement for reimbursing employees' business expenses that meets three IRS rules. Payments under it are not wages, so no income, Social Security, Medicare or FUTA tax applies. Payments under a plan that misses the rules are taxed as wages.
Read the full entryBonus depreciation, which the IRS calls the special depreciation allowance, lets a business deduct a large share of qualifying property's cost in its first year. Law passed in 2025 reinstated 100% for qualifying property acquired and placed in service after January 19, 2025, and it applies unless the business elects out.
Read the full entryThe break-even point is where total cost and total revenue are equal, so there is no loss or gain. The SBA states it plainly and then states the limit plainly too: it is an estimate for lender viability and a business plan, not an accounting result, and the formula assumes a single product or service.
Read the full entryCost per acquisition is what you paid for each counted conversion, spend divided by conversions. Google expands the abbreviation as cost per action, not acquisition. It inherits whatever your conversion column counts, so two businesses can report the same figure and mean entirely different things.
Read the full entryCustomer lifetime value is the dollar value of a customer relationship, based on the present value of projected future cash flows. The LTV column in your analytics is a different quantity: measured revenue from users the tool could identify, sampled above a limit, and often zero even at the 90th percentile.
Read the full entryThe de minimis safe harbor election is an IRS rule for deducting small equipment purchases in the year they are paid for. It covers up to $2,500 per invoice or item, or $5,000 for a business with an applicable financial statement. The election is made on each year's return.
Read the full entryDepreciation recapture is the tax rule that treats gain on selling depreciated business equipment and other section 1245 property as ordinary income, up to the depreciation allowed or allowable. It decides how much of the money from selling equipment written off with Section 179 or bonus depreciation is taxed as ordinary income.
Read the full entryThe estimated tax safe harbor is the IRS rule that protects a taxpayer from the underpayment penalty. Paying at least 90% of this year's tax or 100% of last year's, whichever is smaller, generally avoids it, with 110% of last year's tax once adjusted gross income passed $150,000.
Read the full entryA factor rate is the multiplier some business funders use to price an advance: take $40,000 at 1.35 and you repay $54,000. It reads like a 35% cost, yet it ignores time. Repaid over six months of daily debits, that example works out to an annual percentage rate near 126%.
Read the full entryMargin is the difference between selling price and cost, stated either as a percentage of the selling price or per unit. The standards board that defines it also records that managers differ widely in the assumptions they use. So the number only means something once you know which costs are inside it.
Read the full entryReturn on ad spend compares what the advertising produced against what it cost. Google reports it as conversion value divided by cost and shows a percentage. Microsoft divides revenue by spend and shows a ratio. Neither is net of your own costs, so it is not profit.
Read the full entryReturn on investment is profit measured against capital invested. The standards board that defines it says related measures differ mainly in how investment is defined, which is where most disagreements live. The tax code draws the sharper line: money you deduct this year is spent, money you capitalize is invested.
Read the full entryThe Section 179 deduction lets a business deduct the cost of qualifying equipment and off-the-shelf software in the year it is placed in service, instead of depreciating it over several years. For tax years beginning in 2025, the limit is $2,500,000, reduced once qualifying purchases pass $4,000,000.
Read the full entrySend it over and we will tell you what it actually says. Twenty minutes, no follow-up sequence.
