Compliance was the part nobody owned.

This was built after years of running business websites on managed WordPress, where the same pattern appeared on every account.

Hosting was somebody’s job. Updates were somebody’s job. Design was somebody’s job. Accessibility, privacy disclosure, consent behavior and data requests belonged to whoever noticed last, which usually meant nobody until a letter arrived. Clients assumed it was covered because they were paying somebody every month, and the plan they were paying for said nothing about it.

The second pattern was evidence. When a customer sent a security questionnaire, or a funder asked about accessibility during diligence, there was nothing to send. The work had often been done, and there was no record that it had.

So the product is the operational layer as a system rather than a retainer: checks that run on every change instead of when somebody remembers, and a dated record produced by the checks themselves. A site with no admin panel and no plugins is a smaller thing to defend, which is what makes running it this way affordable.

What we will not do

We will not tell you a website is lawsuit-proof, because nobody can make that true. We reduce exposure and we evidence it. We do not give legal advice, and we say so on every page where somebody might mistake description for counsel. And we do not install accessibility overlays, which is the shortcut this industry currently sells hardest.