No account, no card. The same scan the paid product runs on a whole list, on one site you choose.
Takes about ten seconds. We read the public pages and the public tag container, nothing else, and we never touch an account.
Tags still running for products Google switched off years ago. A conversion pixel installed twice, so every sale is counted twice. A certificate that fails. A consent banner with no Consent Mode behind it. A tag on the home page that is missing from the product pages. A robots.txt that blocks the crawler Google Ads uses to read the landing page.
Every finding carries the evidence it was drawn from and how sure we are of it. Here is the one-page report an agency sends a prospect, with their branding on it rather than ours.