Everything we get asked, in plain English.

Yes. Verify your domain (one DNS TXT record or HTML meta tag), get one full WCAG 2.1 AA scan free, no credit card required. Continuous monitoring is $49+/month if you keep it.

Verification takes a few minutes once the DNS or meta tag is in place. The first scan typically completes in 1 to 4 minutes for sites under 50 pages, and the dated report is available in your dashboard immediately.

That is why we exist. We re-scan weekly or monthly, diff against the previous run, and email you when new violations appear. Full history exports as one dated audit-trail PDF.

Yes. Every scan is timestamped and stored. The dashboard exports an audit-trail PDF spanning your full history, formatted as good-faith effort documentation that US courts have considered as evidence of active remediation.

No, and no other vendor in the US can either. There is no official ADA certification program issued by any government body or third party. What we do produce is dated technical evidence of ongoing testing and remediation, which is the documentation US courts have historically considered as good-faith effort.

It documents that you actively test and remediate, which is the strongest documented defense available short of a full manual audit. Courts have considered ongoing programs as good-faith effort. We make no outcome guarantees, and we recommend pairing continuous scanning with periodic manual audits performed by an accessibility professional.

Because no tool can. The accessibility overlay vendors that did make such guarantees were publicly opposed by the National Federation of the Blind and have been treated skeptically in court filings. Our position is documentation and continuous improvement, not a compliance badge that does not hold up under scrutiny.

Public pages discovered from your sitemap.xml, capped by plan tier (Starter 10 pages, Pro 50, Business 200). If your sitemap is missing, we discover pages from your homepage links. You can also pin specific URLs for every scan.

We scan public pages from your sitemap today. Authenticated crawl is on the roadmap for Pro and Business plans. If logged-in coverage is a hard requirement for procurement, contact us before subscribing so we can give you a realistic timeline.

Yes, the basic structural checks run today: tagged structure, document title, language, and figure alternative text. Full PDF/UA-1 conformance is on the roadmap; for procurement-grade PDF conformance pair our checks with a manual review.

No, not in the current product. Invoset focuses on web (HTML, CSS, JavaScript) and basic PDF accessibility. Native iOS and Android accessibility requires separate testing tools and manual review against WCAG 2.1 and platform-specific guidelines.

WCAG 2.1 Level A and Level AA, the technical standard referenced by the US Americans with Disabilities Act, Section 508, the EU European Accessibility Act, the UK Equality Act, and most state-level civil rights statutes. We do not test against WCAG 2.1 Level AAA as it is not the legal threshold in any major jurisdiction.

We test the technical standard both laws reference (WCAG 2.1 Level A and AA). Reports document conformance findings but are not a formal conformance statement under either law. For procurement-grade conformance under the European Accessibility Act or a UK Equality Act audit, pair our reports with a manual review by a credentialed accessibility professional.

Section 508 references WCAG 2.0 Level AA. We test WCAG 2.1 Level A and AA, which is a superset. Reports flag the same technical findings that a Section 508 conformance review would catch. Federal procurement still typically requires a VPAT (Voluntary Product Accessibility Template), which we publish for our own product at invoset.com/legal/vpat.

HHS Section 1557 received a final rule in May 2024 that explicitly extends to web content for any provider receiving federal financial assistance (most do, through Medicare or Medicaid). The rule references WCAG 2.1 Level AA as the conformance threshold, which is what we test against. We do not provide HHS-specific legal advice.

A chronological log of every scan ever run on your site, with timestamps in UTC, plan tier at the time of each scan, baseline marker, new violations, resolved violations, and WCAG score. Plus a methodology section, a good-faith-effort attestation statement, and a verifiable report identifier that ties back to your dashboard.

Seven years on Supabase Storage cold tier, for all customers regardless of plan tier. Long enough to cover any reasonably contemporaneous demand letter or settlement discussion timeframe.

Yes. Each scan exports as a developer-formatted PDF report grouped by impact severity, with rule IDs, WCAG criterion references, page URLs, suggested fixes, and DOM selectors for each finding. Designed to be handed to a developer or agency without translation.

White-label PDF reports are available as part of the agency partner program. Standard customer reports carry Invoset branding by default. See invoset.com/partners/agencies for partner details.

Yes, all plans are monthly billing. No annual contract, no hidden upgrade trigger, no auto-tier-jumping when you add a domain. Cancel from the dashboard any time and your remaining month stays active until the period ends.

The scan still runs but stops at the plan cap (Starter 10 pages, Pro 50, Business 200). The dashboard surfaces what got skipped so you can prioritize a manual rescan or upgrade. We never charge per-page overage; the cap is just a cap.

Full refund within 30 days of first payment for any reason. After 30 days, monthly billing means you can cancel at any time and you simply will not be charged the next month. See invoset.com/refund for the full policy.

Annual billing with a 15% discount is available for Pro and Business plans on request. We do not advertise it publicly because monthly cancel-anytime is the default. Volume discounts apply for 5+ domains on the same account.

Supabase US-East (Virginia). Customer data, scan results, and audit-trail PDFs never leave the US data plane. Background workers run in Render US-East (Ohio). See invoset.com/legal/subprocessors for the full processor list.

Our sub-processors (Supabase, Render, Vercel, Brevo) are SOC 2 Type 2 certified. Invoset itself is not yet SOC 2 certified; we will be pursuing it once procurement-tier customers ask for it directly. For most SMB customers SOC 2 is not a procurement requirement.

We are a CCPA Service Provider and a GDPR Article 28 Processor. A standard Data Processing Addendum is published at invoset.com/legal/dpa and is incorporated by reference into our Terms of Service. EU customers can request a counter-signed DPA at no charge.

Email legal@invoset.com with details. We respond within 72 hours and never threaten researchers acting in good faith. A formal Vulnerability Disclosure Policy page is on the legal roadmap.