Powered by OptioAttest · Optio Labs
SmartQCompliance
Compliance, Quantified.
Daily automated scans
AI-generated fix code
Cryptographic proof

Understanding Compliance the SmartQ Way

Certifications, standards, and how we help you achieve and prove compliance — with court-ready evidence.

Certification Framework

The Real Value Matrix

Each certification serves a different stakeholder. Understanding who benefits helps you prioritize your compliance roadmap.

Certification Full Name Primary Value Who Benefits
ARA Accessibility Ready Attestation Lawsuit deterrent + procurement qualification Legal, Sales, Procurement
PRA Privacy Ready Attestation GDPR/CCPA trust signal EU Customers, Legal, DPO
SRA Security Ready Attestation Vendor qualification Enterprise Procurement, CISO
XRA-HIPAA HIPAA Ready Attestation BAA qualification Healthcare, Covered Entities
XRA-PCI PCI Ready Attestation Cardholder trust E-commerce, Payment Processors
XRA-CMMC CMMC Ready Attestation DoD contract eligibility Defense Contractors
XRA-SOC2 SOC 2 Ready Attestation Enterprise sales qualification B2B SaaS, Enterprise Sales
Why "Ready Attestation"?
We don't replace auditors — we prepare you for them. Our attestations prove continuous monitoring and evidence collection, making your formal audits faster and cheaper. When the auditor arrives, your evidence is already organized, signed, and timestamped.
Understanding VPAT & ACR

Voluntary Product Accessibility Template

The VPAT was developed by the Information Technology Industry Council (ITI) and the Government Services Administration (GSA) to help Federal contracting officials assess the accessibility of commercial ICT products and services.

📋
What is a VPAT?
A standardized template documenting how a product conforms to accessibility standards including Section 508, WCAG 2.0, 2.1, and 2.2. It's a self-disclosure document created by the vendor.
✅
What is an ACR?
An Accessibility Conformance Report is the completed VPAT — the actual assessment showing the degree of conformance to accessibility standards. This is what procurement officers review.
🎯
Why It Matters
Federal agencies require VPATs/ACRs for procurement. State and local governments increasingly follow suit. Without one, you're disqualified from government contracts.

Conformance Levels

Level Meaning Implication
Supports The functionality of the product has at least one method that meets the criterion without known defects. Full compliance for this criterion.
Partially Supports Some functionality meets the criterion, but some does not. May require workarounds or additional evaluation.
Does Not Support Most functionality does not meet the criterion. Remediation required for compliance.
Not Applicable The criterion is not relevant to the product. No action needed.
Not Evaluated The product has not been evaluated against this criterion. Evaluation recommended before procurement.
SmartQCompliance VPAT/ACR
We automatically generate and maintain your ACR based on continuous scanning. When a new WCAG success criterion passes or fails, your ACR updates. No manual documentation — always current, always accurate.
W3C ARIA Authoring Practices Guide

We Don't Just Find Violations — We Validate Widget Patterns

Every accessibility scanner can tell you "this button lacks an accessible name." None of them can tell you "this is supposed to be a menu button, and it's missing aria-haspopup, aria-expanded, and the keyboard pattern that opens the menu on Enter — here's the W3C reference implementation showing exactly how to fix it."

The Difference
Static scanners read the DOM once and check for missing attributes.
DeepScan interacts with your widgets, captures the Accessibility Tree before and after, and verifies that ARIA states change correctly during use.

What Others Find vs. What We Find

Widget What Others Report What DeepScan Reports + Fixes
Search Combobox "Input missing role attribute" Full combobox with aria-expanded, aria-controls, aria-activedescendant + Arrow/Escape keyboard handling — from W3C reference
Navigation Menu "Button missing accessible name" Complete menu button with aria-haspopup, aria-expanded, menu/menuitem roles + full keyboard navigation
Checkout Modal "Dialog missing aria-labelledby" Modal with aria-modal, focus trap, Escape closes, focus returns to trigger — verified via interaction
Product Tabs "Missing tabpanel role" Full tab interface with aria-selected, aria-controls/aria-labelledby linking, Arrow key navigation
Cookie Consent Toggle "Element has no role" Switch with role="switch", aria-checked toggles on Space/Enter — GDPR compliant
Date Picker "Missing label" Combobox + grid calendar with full four-directional keyboard nav, aria-selected on chosen date

30 W3C APG Patterns We Validate

Accordion Alert Alert Dialog Breadcrumb Button Carousel Checkbox Combobox Dialog Disclosure Feed Grid Landmarks Link Listbox Menu Button Menubar Meter Radio Group Slider Spinbutton Switch Table Tabs Toolbar Tooltip Tree View Treegrid

How Behavioral Validation Works

🔍
1. Capture AX Tree
We capture the full Accessibility Tree via Chrome DevTools Protocol — the same tree screen readers consume. Not DOM heuristics.
⌨️
2. Interact via Keyboard
We Tab, Arrow, Enter, Space, Escape — the same keys your users press. Real key events that trigger your JavaScript handlers.
📊
3. Diff the State
We capture the AX tree after each interaction and compare. Did aria-expanded toggle? Did aria-selected change? Did focus move correctly?
✅
4. Validate Against APG
We check every observed behavior against the W3C APG specification for that widget pattern. Pass or fail — with the exact requirement that was violated.
Why Nobody Else Can Do This
APG pattern validation requires full AX tree access, keyboard simulation, before/after state capture, and the APG spec mapped to validation rules. Static analysis tools read the DOM once — they can detect missing attributes but cannot verify behavior. DeepScan is the only automated tool that combines AX tree exploration with APG pattern validation.
Plan of Action & Milestones

From Scan to POAM — The Complete Loop

A traditional accessibility audit takes 2–4 weeks of manual testing, produces a static PDF, and requires another audit when anything changes. SmartQCompliance runs the same depth of analysis daily — automatically. Your team focuses only on what requires human judgment.

THE COMPLIANCE LOOP
SCAN → QUANTIFY → REMEDIATE → DEPLOY → VERIFY → POAM

What Your POAM Tells You

After automated scanning and remediation, your Plan of Action & Milestones shows exactly which WCAG Success Criteria are handled — and which still need human review. Focus your team's time where it matters.

Success Criterion Status Risk Action
1.4.3 Contrast (Minimum) ✓ AUTOMATED — Daily scan verified
2.1.1 Keyboard ✓ AUTOMATED — DeepScan interaction verified
4.1.2 Name, Role, Value ✓ AUTOMATED — APG pattern validated
1.1.1 Non-text Content ⚠ MANUAL REVIEW MEDIUM AI-generated alt text needs approval
1.3.1 Info & Relationships ⚠ MANUAL REVIEW LOW Semantic structure audit
2.4.1 Bypass Blocks N/A — Single-page app, no blocks
AUTOMATED
Scanned daily. AI-remediated. Deployed. Verified. No human review needed — the system handles it continuously.
MANUAL REVIEW
Requires human judgment. Risk-scored so you prioritize high-impact items first. One-time review, then automated monitoring.
N/A
Success criterion doesn't apply to your content type. Documented in your ACR for procurement reviewers.
Save Time. Focus on What Matters.
Traditional audits: 2–4 weeks of manual testing. Static report. Re-audit when anything changes.

SmartQCompliance: Daily scans + AI remediation + APG validation + cryptographic proof + risk-scored POAM. Your team reviews only what automation can't handle — and the POAM tells you exactly what that is.
OptioRegistry

Verification, Not Directory

OptioRegistry enables anyone to verify your certification status — without publishing a customer directory. Your certification badge links to your verification page. We never expose who our customers are.

✓
ARA CERTIFIED
Domain example.com
Certification ARA (Accessibility)
Certified Since March 15, 2026
Last Verified August 9, 2026
VPAT/ACR ✓ Verified
TPM Attestation ✓ Hardware-bound
TSA Timestamp ✓ RFC 3161
OV Signature ✓ CA-verified
The Deterrent Effect
Like a "Protected by ADT" sign, your ARA Certified badge signals to plaintiff lawyers that you have continuous monitoring, a legal defense package ready, and court-admissible evidence. They move on to easier targets.
Reference

Relevant Standards

SmartQCompliance evaluates against these accessibility and compliance standards:

WCAG 2.1 / 2.2
Web Content Accessibility Guidelines — the international standard for web accessibility. Level AA is the typical compliance target.
Section 508
U.S. federal requirement for accessible ICT. Aligns with WCAG 2.0 Level AA since the 2017 refresh.
ADA Title III
Americans with Disabilities Act — covers public accommodations including websites. Courts increasingly reference WCAG.
EN 301 549
European standard for ICT accessibility. Required for public sector procurement in EU member states.
ARIA 1.2
Accessible Rich Internet Applications — semantic attributes for dynamic web content and assistive technology support.
ATAG 2.0
Authoring Tool Accessibility Guidelines — for tools that produce web content (CMSs, editors, etc.).

Ready to Get Certified?

Start with a free scan. See your ARA score, VPAT summary, and remediation roadmap in minutes.

Get Started →