How BeaverCheck Calculates Business Impact

BeaverCheck turns technical audit findings into financial estimates so you can prioritize fixes by revenue impact, not just severity level. This page documents every model, source, and assumption behind those numbers.

All figures are estimates. They are intended to help you rank which findings are worth your attention — not to serve as legal, financial, or actuarial advice. Actual impact depends on your site, your audience, your vertical, and the enforcement priorities of the regulators your site falls under.

If you spot an error in our data or methodology, let us know via the feedback widget on any result page.

Performance → Conversion Model

Used in the Revenue Calculator (Prompt 9), Cost-of-Inaction (Prompt 13), ROI dashboard (Prompt 14), and Third-Party Script Cost calculator (Prompt 17).

The model:

• Baseline bounce rate: 25% for sites with Largest Contentful Paint (LCP) under 2.5 seconds
• Each additional second above 2.5s adds +7 percentage points of bounce
• Capped at 70% maximum bounce rate (beyond that, you're not measuring performance — you're measuring site abandonment)

From bounce rate to dollars:

lostVisitors     = monthlyViews × additionalBounceRate
lostConversions  = lostVisitors × 0.0235   (baseline conversion rate)
monthlyCostUSD   = lostConversions × localCPC  (CPC as conversion-value proxy)

We use cost-per-click as a conversion-value proxy because it's the only traffic-value signal we can localize reliably without the operator's analytics.

Sources:

• Google / Deloitte, Milliseconds Make Millions (2020) — found that sites loading in 5s vs 19s see 70% longer sessions and 35% lower bounce rates
• Google Web Vitals documentation — the 2.5s LCP threshold for "Good"
• Akamai, State of Online Retail Performance (2017) — every 100ms of latency costs ~7% in conversion
• Portent, How Page Speed Impacts Conversion (2022) — highest ecommerce conversion rates at 0–2s load times

Limitations:

• The linear bounce-rate-per-second relationship is a simplification. Real behavior is non-linear near the thresholds, and depends on content quality, user intent, device, and network.
• The 2.35% baseline conversion rate is an industry average; vertical-specific rates range from under 1% (B2B SaaS) to over 5% (financial services lead-gen).
• CPC varies dramatically by vertical — legal and insurance CPCs can exceed $50; retail averages $1–$2.

Developer Rate Defaults

Used in Cost-to-Fix (Prompt 12), ROI (Prompt 14), Sprint Plan (Prompt 15), and Stakeholder Summaries (Prompt 16).

Rates are fully loaded — base salary plus benefits, employer taxes, office and tooling overhead. Fully-loaded cost is typically 1.5–2.5x base salary depending on jurisdiction.

Representative rates (mid-level default; the UI lets operators override):

BeaverCheck's jurisdiction database (internal/jurisdiction/countries.go) covers 130+ countries with localized rates and preset labels. Countries not shown above use locally-sourced medians following the same fully-loaded methodology.

Sources: Glassdoor, StepStone, Talent.com, Stack Overflow Developer Survey, and regional salary databases. Each country entry in the database cites its primary source.

Limitations:

• Rates reflect 2024 medians; expect 5–10% annual drift.
• "Mid-level" is an average across 3–7 years of experience — your team's actual loaded cost may be higher or lower.
• Rates don't account for specialization premiums (security, ML, cloud architecture can command 1.5–2x the base median).

Compliance Risk Calculations

Used in Cost-of-Inaction (Prompt 13).

Fine ranges come from each regulation's published enforcement schedule. They reflect the maximum statutory exposure for a violation — not a prediction of what you'd actually be fined. Real enforcement is shaped by violation severity, company size, cooperation with authorities, and the regulator's priorities that year.

The full regulation catalog in internal/jurisdiction/regulations.go covers 30+ regulations across every region in the country database.

Disclaimer. These are published regulatory ranges, not legal assessments. Actual fines depend on violation severity, company size, mitigation steps taken, cooperation with authorities, and the regulator's priorities. Consult qualified legal counsel before making compliance decisions based on these figures.

SEO Traffic Value Model

Used in Cost-of-Inaction (Prompt 13).

Each SEO finding has an estimated click-through-rate (CTR) loss. Lost monthly value is:

monthlyLostValue = monthlyViews × ctrLossFraction × localCPC

CTR impact by finding type:

CPC by country (2024 regional averages for Google Search Ads):

Currencies without an explicit entry fall back to converting $2.69 USD through the local exchange rate.

Limitations:

• CPC varies dramatically by vertical — legal ($50+), insurance ($30+), retail ($1–2). The regional defaults are cross-vertical averages.
• CTR-loss estimates are published research averages; actual impact depends on how your competitors are optimized.
• Monthly views defaults to 10,000 when the operator doesn't supply a real number.

Bandwidth Cost Model

Used in Cost-of-Inaction (Prompt 13).

wastedBytes   = totalTransfer - efficientTransfer
wastedMonthly = wastedBytes × monthlyViews
monthlyCost   = (wastedMonthly / 1e9 GB) × cdnRatePerGB

CDN rate: $0.08/GB, blended across Cloudflare, AWS CloudFront, and Fastly public pricing tiers (2024). Converted to local currency via exchange rate.

Sources: Published pricing pages for Cloudflare, AWS CloudFront, Fastly, Google Cloud CDN, Azure CDN, Bunny.net. The blended rate sits in the middle of the per-GB pricing tier most common-weight operators land in.

Limitations:

• Enterprise pricing at high volume can be 50–90% lower than the public-rate blend.
• Free CDN tiers (Cloudflare Free, Netlify, Vercel) don't fit this model — but the waste is still real from the end user's perspective (loading 500KB you didn't need is 500KB of battery, data plan, and time).

Third-Party Script Impact Model

Used in the Third-Party Script Cost calculator (Prompt 17).

Each third-party script's cost is derived from its contribution to page slowness:

LCPImpactMs = isRenderBlocking
                ? executionMs               (full blocking contribution)
                : executionMs × 0.30        (main-thread contention heuristic)

then the bounce-rate model from Section 2.

The 30% contention factor is a heuristic — async scripts still compete for main-thread time during parse/compile, we just can't precisely measure that from lab data. Published research on async-script LCP impact doesn't give a single canonical number; 30% sits in the middle of the observed range.

Verdicts:

• Essential — consent banners, payment processors. Must keep regardless of cost.
• Efficient — under 50ms execution AND under the low-cost threshold. Fine to keep.
• Optional — 50–200ms non-essential scripts. Evaluate alternatives (Plausible vs GA4, LiveChat vs Intercom, etc.).
• Costly — over 200ms execution OR over the high-cost threshold. Evaluate whether the script justifies its cost.

Limitations:

• Script execution time is measured by Lighthouse in a lab environment. Real-world impact depends on user device, network, and concurrent scripts.
• The 30% contention factor is a heuristic, not a measured value.
• Render-blocking detection is conservative — we mark async scripts as non-blocking even when they're loaded early in <head>.

Effort Estimates

Used in the Priority Matrix (Prompt 5), Cost-to-Fix (Prompt 12), Sprint Plan (Prompt 15).

Every finding in the internal/impact registry is tagged with one of three effort tiers:

Limitations:

• Estimates assume a developer familiar with the technology stack.
• Actual time depends on codebase complexity, test coverage, deployment process, and team conventions.
• "Quick Win" and "Significant" are the confident ends — most findings land in "Moderate," which has a wide range.

Jurisdiction Detection

Used everywhere that produces localized currency, rates, or regulatory context (Prompts 11–17).

Seven signals, weighted toward stronger indicators:

Combined confidence below 0.3 falls back to US/USD defaults rather than displaying a low-confidence guess.

Limitations:

• CDN edge nodes may resolve to a different country than the origin server — the ASN signal can be misleading for CDN-fronted sites (we weight it low for this reason).
• Privacy-shielded WHOIS provides no registrant country.
• Generic TLDs (.com, .io, .app) give no country signal.
• A US company serving German customers legitimately triggers both GDPR and US regulations — the badge shows the primary jurisdiction but our compliance risk sums across all triggered regulations.

Composite Score Methodology

The overall score shown at the top of every result page is a weighted combination of category scores:

Weights are renormalized when a category has no available data (e.g. a site without a Lighthouse report skips Performance and the remaining weights sum to 1.0).

Why these weights? See docs/DECISIONS.md in the source tree — the weights reflect both user-facing impact (performance, SEO) and legal/financial risk (security, compliance, accessibility).

Data Freshness

• Exchange rates are approximate and updated periodically. They're not live — a 3% drift is typical between updates.
• Developer rates are based on annual salary surveys. Updated yearly.
• CPC values are based on WordStream and SEMrush public reports, updated semi-annually.
• Fine ranges reflect the statutory maximum as of the last regulation catalog update. Enforcement-patterns data updates when DPAs publish new decision summaries.

All estimates should be treated as order-of-magnitude guidance, not precise forecasts. BeaverCheck's purpose is to help you decide which findings deserve attention first — not to produce a number you'd put in a budget.

Feedback

If you believe any of our data or methodology is incorrect, please let us know via the feedback form on any result page, or open an issue at the project's GitHub repository. We take accuracy seriously — specific citations beat general complaints.