Our Compliance Standard

We don't bolt compliance on after the fact. We build it into the foundation. Here is exactly what every Forged Site includes, and how Vigil checks accessibility with a nightly scan and a monthly staff review.

Accessibility Checks Accessibility Privacy Security Consent Verification

Accessibility practice

How Vigil Checks Accessibility

Vigil's scope is accessibility. A nightly scan runs at about 01:15 ET on every live Forged Site. It uses axe-core rules for WCAG 2.2 Level A and Level AA, on desktop and mobile. About 8 pages are included (home, contact, the shallowest pages, and the newest post). Assets served from other domains are not scanned.

What that means:

Before launch: a staging check targets zero failed Lighthouse accessibility audits and zero axe WCAG 2.2 A/AA violations, plus a human review of what scanners cannot judge.
Before our changes publish: we review them for accessibility. DraftDash posts get a remediation pass for alt text, heading order, link text, inline contrast, and table headers.
After launch: the nightly scans continue, and staff review accessibility at least monthly. The scan is nightly. The commitment is the monthly review.
Fixes and exceptions: failures in our own work are fixed free. A client design choice that conflicts with WCAG is recorded as an exception and is never called conforming.
What a clear scan is: results go to IDFS AI staff. Automated rules on the tested pages are not a compliance certificate, because manual criteria can remain unassessed.

Vigil does not check privacy-law compliance, cookie consent, or security headers. Those site practices are described below on their own. A clear automated scan is not legal conformance.

Accessibility (WCAG 2.2 AA)

Every person can use every page.

We build toward the Web Content Accessibility Guidelines (WCAG) 2.2 at Level A and Level AA, the standard referenced by the Americans with Disabilities Act (ADA), Section 508, and the European Accessibility Act. This is not an overlay. The actual HTML, CSS, and ARIA markup is written to be accessible from the source.

What This Means in Practice:

✓ Color contrast of at least 4.5:1 on all text, on the pages the nightly scan covers. Coverage is partial.
✓ Keyboard navigation works on every interactive element — skip-navigation links, visible focus rings, no keyboard traps
✓ Screen reader compatibility — semantic HTML, ARIA landmarks, meaningful alt text on every image, proper heading hierarchy
✓ Touch targets meet the WCAG 2.2 minimum of 24×24px on desktop and 44×44px on mobile
✓ Reduced motion support — animations respect the user's system preferences
✓ Focus not obscured — sticky headers and cookie banners never hide the focused element

Privacy (State-Specific)

Your privacy policy references your state's actual law.

Every Forged Site includes a privacy policy, terms of service, and cookie policy that are specific to the jurisdiction where the business operates. Not a generic template — actual references to the laws that apply to you.

State Privacy Laws We Cover:

California Active

CCPA / CPRA — "Do Not Sell or Share" footer link, GPC signal honored, specific consumer rights disclosures

New Jersey Active

NJDPA — Explicit consent for sensitive data, right to limit use, financial data protections

Virginia Active

VCDPA — Right to opt out of targeted advertising, profiling, and data sale

Colorado Active

CPA — Universal opt-out mechanism required, GPC signal honored

Connecticut Active

CTDPA — Data sale and targeted advertising disclosure requirements

Texas Active

TDPSA — Data processing agreement terms, specific category disclosures

Oregon Active

OCPA — Opt-out signal recognition, children's data protections

Montana Active

MCDPA — Standard consumer rights framework for data privacy

Security (Headers & Hardening)

Six headers that most agencies don't know exist.

Every Forged Site ships with enterprise-grade HTTP security headers. These prevent clickjacking, script injection, MIME-type attacks, and information leakage. Most small business websites have zero security headers. Ours have six, configured strictly.

Strict-Transport-Security

Forces HTTPS with preload — prevents downgrade attacks and man-in-the-middle interception

Content-Security-Policy

Explicitly whitelists which scripts, styles, and resources can load — blocks cross-site scripting (XSS)

X-Frame-Options

Prevents your site from being embedded in a malicious iframe — blocks clickjacking attacks

X-Content-Type-Options

Stops browsers from guessing file types — prevents MIME-type confusion attacks

Referrer-Policy

Controls what information is sent when users navigate away — prevents data leakage to third parties

Permissions-Policy

Disables camera, microphone, geolocation, and tracking APIs that your site doesn't need

Scheduled Accessibility Checks

A nightly scan, a monthly staff review, and a human look before our own changes publish.

Vigil is not a publish gate. Accessibility is checked on the schedule below. A passing automated scan covers the pages and rules that ran. It does not, by itself, mean the site conforms.

The Verification Cycle:

Before Launch

A staging check targets zero failed Lighthouse accessibility audits and zero axe WCAG 2.2 A/AA violations. A person reviews what the scanners cannot judge.

Before Our Changes Publish

Changes we make are reviewed for accessibility before they publish. DraftDash posts get a remediation pass for alt text, heading order, link text, inline contrast, and table headers.

Nightly Scan

Around 01:15 ET, axe-core runs WCAG 2.2 Level A and AA rules on about 8 pages of each live Forged Site, on desktop and mobile. Home, contact, the shallowest pages, and the newest post are the usual set. Assets served from other domains are not scanned.

At Least Monthly

Staff review accessibility at least monthly. Failures in our own work are fixed free. A client design choice that conflicts with WCAG is recorded as an exception and is never called conforming.

Want Accessibility Checked on a Schedule?

Vigil checks accessibility on live Forged Sites with a nightly WCAG 2.2 A and AA scan, partial page coverage, and a staff review at least monthly. Our own changes are reviewed before they publish.