Everything the evidence file contains.

A headless browser renders every page on every domain and subdomain you’ve verified, runs 90+ automated WCAG 2.1 AA checks against the live DOM, and files the findings — on a monthly, weekly or daily schedule, or triggered by your deploys on the top tier.

Findings are deduplicated to template-level root causes: sixty-one contrast failures across a shop are usually one broken template, so your developers get one fix, not sixty-one tickets. Subdomains are discovered automatically from certificate-transparency logs, so the staging site nobody mentioned still gets scanned.

Scanning infrastructure is EU-located. The crawler covers the machine-checkable share of WCAG — roughly a third to half of the criteria — and the matrix says exactly which.

Some criteria no machine can judge: whether keyboard focus is ever trapped, whether the focus order makes sense, whether a screen reader announces something a person can actually act on. For each of these, the platform provides a structured checklist — what to test, how, and what pass looks like — so a competent person can verify it without being a WCAG scholar.

Each completed check is signed off by name into the ledger: who verified it, when, against which checklist version. That named entry is what turns “we looked at it” into evidence.

Nothing enters monitoring unverified. Every root domain is verified by DNS TXT record (meta-tag and file-upload fallbacks) at the moment it is added, covering all its subdomains, and re-checked periodically — because a verification gap would taint the evidence chain.

If the TXT record vanishes — a DNS migration, an overzealous cleanup — monitoring doesn’t silently break. A 72-hour grace period starts: the ledger logs a warning, you’re notified by email and dashboard banner, and scanning continues for three days. Only then does it hard-pause. Every step is logged, never hidden — the ledger tells the honest, dated story, which is exactly what keeps it defensible.

Every scan, recorded journey, human sign-off and verification event lands in a timestamped, append-only ledger — including the awkward entries. A record that only tells the good story wouldn’t be evidence.

From the ledger, three exports: the conformance report (EN 301 549, continuously maintained), the accessibility statement generator (the statement the law requires you to publish, kept consistent with your actual evidence), and the regulator response pack — a dated PDF dossier assembled for the day a demand letter or information request arrives.