Built to survive the audit.

WCAG 2.1 AA is the standard the Department of Justice and the courts reference, and it is the target every build is engineered against. Accessibility is a conformance target plus an ongoing practice, so we ship the mechanisms and the public statement that documents them.

What we build

• Our own accessibility widget, built in-house and shipped on 14 sites: 7 one-click disability profiles and 22 to 25 individual adjustments
• Contrast modes that remap the design tokens themselves rather than dropping a filter over the page
• A public WCAG 2.1 AA accessibility statement page on every site, written to match what the build actually does
• Skip links, real ARIA patterns, focus traps, and keyboard paths through every interactive element
• Reduced motion honored in 10 to 38 separate places per site, not one global switch
• Heading order enforced at the data layer, so a content editor cannot accidentally break document structure

Receipts

We have built GDPR-ready sites where consent is a real gate in the code, not a banner drawn over trackers that already fired. If a user has not opted in, there is no script tag, no network request, and no cookie.

What we build

• Analytics and pixels implemented as components that return null until consent is granted, so nothing loads pre-consent
• Global Privacy Control and Do Not Track honored as binding opt-outs, not logged and ignored
• Edge middleware geo-fencing with 33 opt-in jurisdictions across the EU, EEA, UK, Switzerland and Brazil, defaulted OFF until consent
• Withdrawal that actively expires already-set _ga and _fbp cookies rather than just flipping a flag
• Accept and Reject carrying equal visual weight: no dark patterns, no pre-ticked boxes, no buried reject
• Versioned, timestamped consent records, so you can show what a user agreed to and when

Receipts

California set the pattern and 20 more states have followed, each with its own thresholds and its own opt-out mechanics. We build the rights machinery once, correctly, so a site does not need re-engineering every time another state law takes effect.

What we build

• Do Not Sell or Share My Personal Information links, wired to something that actually happens
• CCPA rights request forms for access, deletion and correction, with the response paths documented
• Global Privacy Control honored as a binding universal opt-out signal, which 12 states have required since January 1, 2026
• Data-broker registration disclosures citing four state statutes where a client's business model requires them
• SMS consent flows engineered against TCPA requirements, with the consent language and the record kept together
• Age gates for 18+ and COPPA enforced on the client AND on the server, because a client-side gate is a suggestion

Receipts

A cookie banner is not consent. Consent is whether the code can prove the tracker never ran, and most banners on the web today fail that test in the network tab.

What we build

• A consent library where every tracker is gated behind an explicit opt-in, with the gate in the component tree rather than in a tag manager
• Granular categories a user can accept or reject independently, with the choice persisted and versioned
• GPC parsed and treated as a standing opt-out on first request, before any tracking code is reachable
• A withdrawal path that is as easy to find and as easy to use as the original accept
• Privacy policy sections generated from the same typed data that configures the gate, so the two can never drift apart

Receipts

SOC 2 audits an organization, not a website, and the report is issued by your auditor. What we do is build the web layer so that when your auditor asks how a control is implemented, there is a specific answer in the code with the control number written next to it.

What we build

• Server defenses commented with the specific control they map to, so a reviewer can follow the code to the criterion
• CC6.1 on the contact route: a raw-body cap enforced before JSON parse, every field length-bounded, and type-confusion-safe coercion
• CC6.6 and CC6.7 in next.config: a Content Security Policy shipped Report-Only first with a documented promotion path, allow-listed to the exact third parties in use
• CC6.7 in the consent library and CC7.2 on contact-route logging
• P4.1 data minimization enforced in middleware
• CC8.1 change management in a RELEASING.md runbook: clean tree, green typecheck, lint and build gates, npm audit, release tagging, and deployment-ID-to-commit-SHA traceability

Receipts

The HIPAA Security Rule names a set of technical safeguards: access control, audit controls, integrity, authentication, and transmission security. We build those safeguards, and we have shipped them on regulated platform work.

What we build

• Mandatory TOTP multi-factor authentication, enforced at the middleware layer rather than as an account setting a user can skip
• 5-tier role-based access control with 13 permission keys, where an account can never grant a permission it does not itself hold
• Append-only audit logs: UPDATE and DELETE are blocked at the database level, even for the service role
• Threat detection for brute-force attempts and privilege escalation
• A 30-minute idle logout, plus durable per-IP and per-account login lockouts that survive a serverless cold start
• Row-level security on every tenant table, encryption in transit, and sanitize-on-write

Receipts