Spider Digital Group
Start

Stay compliant

Let someone using a screen reader, a keyboard, or one hand get a quote from you, and have the statement to prove it.

Someone using a screen reader, or a keyboard, or one hand, can still get a quote from you, and you have the statement to prove it.

Start the briefAll eleven services

Compliance engineering · proven on 3 live builds

Why people call

If any of these is true

  • You got a demand letter, or you heard about the company down the road that did.

  • Somebody sold you an accessibility overlay and told you that was that.

  • Your customer's auditor sent a questionnaire and nobody knows how to answer it.

How it works

The technical part

Open what you care about. Nothing here is required reading to hire us.

Overview

Most agencies treat compliance as a widget you add in the last week: drop in a consent banner, install an accessibility overlay, paste in a privacy policy nobody read. It does not hold. A March 2026 forensic audit of 7,634 sites found all 11 consent platforms tested still failed to reliably block advertising cookies after opt-out, and 55% of those sites set advertising cookies anyway, 125,106 of them, after the user had already said no. We build it the other way around. The enforcement is the render tree: the tracker components return null until consent is granted, so there is no script tag, no network request, and no cookie to fail. You can verify that in your own network tab. That is an engineering claim, not a badge. Our role here is engineering, not legal advice: we build the mechanisms, your counsel signs off on the policy.

The enforcement is the render tree

A tag that exists but is told not to fire is a tag that can fire. We gate trackers at the component level so there is nothing to block and nothing to misconfigure. 2026 wiretapping cases have narrowed to one question, whether tracking fired before the user acted on the banner, and roughly 1,500 of those suits were filed in the 18 months to August 2025.

A widget is a preference tool, not a defense

We ship an accessibility widget with one-click profiles and contrast modes that remap the design tokens rather than filtering the page, because it genuinely helps people. We are straight about its limits: the FTC fined an overlay vendor $1,000,000 and barred it from claiming automation makes a site WCAG-compliant, and monthly US filings against sites that had a widget installed held at 95 to 155 through 2025. Conformance lives in the markup.

Mechanisms from us, sign-off from your counsel

Compliance is a legal determination about an organization, and a build either implements the required controls or it does not. We engineer and document the controls, then hand your lawyer and your auditor something specific to review instead of a claim to take on faith.

What this covers

Four things, first one matters most

Accessibility built to WCAG 2.1 AA

WCAG 2.1 AA is the standard the DOJ and the courts reference, and it is the bar the Title II rule sets for April 2027. We build to it in the markup: semantic structure, real ARIA patterns, focus management, skip links, heading order enforced at the data layer, contrast locked in the palette. Every site also ships a public accessibility statement you can stand behind. It matters because the baseline is bad: WebAIM found detectable WCAG failures on 95.9% of the top million home pages in 2026, averaging 56.1 errors each.

Consent and cookie architecture that actually blocks

Consent components that return null until opt-in, so nothing fires before the user acts. Global Privacy Control and Do Not Track honored as binding opt-outs, which twelve states have required since 1 January 2026. Withdrawal expires already-set cookies instead of only future ones. Accept and Reject carry equal visual weight, with no dark patterns, and every decision is recorded with a version and a timestamp.

Privacy and legal surfaces that match the code

Privacy policies written as typed data that describes what the build actually does, plus Do Not Sell or Share links, rights request forms, age gates enforced on the client and the server, and geo-aware gating where the jurisdiction calls for it. The point is that the disclosure and the runtime behaviour cannot quietly drift apart.

Security hardening mapped to SOC 2 control IDs

SOC 2 audits an organization, never a website, so what we build is the part your auditor has to review: server defenses commented with the control they map to. CC6.1 on the contact route with a raw-body cap enforced before the JSON parse and every field length-bounded, CC6.6 and CC6.7 on the Content Security Policy shipped Report-Only first with a documented promotion path, CC7.2 on route logging, P4.1 data minimization in middleware, and CC8.1 change management written down in a release runbook. The goal is a build that survives your auditor's review and can be traced back to a commit.

Receipts

Numbers from live builds

  • A self-built accessibility widget shipped on 14 sites, with 7 one-click profiles and 22 to 25 adjustments
  • A WCAG 2.1 AA accessibility statement page live on every site we ship
  • 346 Lighthouse runs across 195 routes, all 100 on accessibility
  • Reduced motion honored in 10 to 38 places on a single build

Where we have done it

These are live right now

The bundle explained by example rather than by definition, with the services each one bought on the card.

Every case study

What you get

What is in your hands

  • A site built to WCAG 2.1 AA, with a public accessibility statement page
  • An accessibility widget for user preference on top of real conformance, never as a substitute for it
  • A consent layer where every tracker is gated in the render tree, verifiable in your own network tab
  • Global Privacy Control honored as a binding opt-out, with withdrawal that clears cookies already set
  • A privacy policy, Do Not Sell or Share link, and rights request flow generated from the build's real behaviour
  • Server-side defenses annotated with the SOC 2 control each one maps to, for your auditor to trace
What every build includes as standard

Straight answers

What this does not do

You have been oversold once already, so here is exactly where the line is.

  • SOC 2 audits an organization and never a website. Spider Digital Group is not SOC 2 audited and does not claim to be. What we build is the part your auditor has to review: server defenses commented with the control they map to, so your audit has something specific to trace back to a commit.

  • There is no such thing as an ADA certificate. Nobody can issue one. What exists is conformance in the markup, a public statement you can stand behind, and a record of the work.

  • HIPAA is a capability here, with a gate stated plainly. We build the technical safeguards the Security Rule calls for and we have shipped them. A HIPAA engagement requires a signed Business Associate Agreement and HIPAA-eligible hosting, and that is scoped per project before any protected health information is involved.

  • Our role is engineering, not legal advice. We build the mechanisms and document them. Your counsel signs off on the policy.

Before you ask

Four questions about this one

Is an accessibility widget enough?
No. We ship one because it genuinely helps people set their own preferences, and we are straight about its limits: the FTC fined an overlay vendor $1,000,000 and barred it from claiming automation makes a site WCAG-compliant. Conformance lives in the markup, and that is where we build it.
What does it mean that your consent banner actually blocks?
The tracker components return null until consent is granted, so there is no script tag, no network request and no cookie to fail. You can verify it in your own network tab. In a March 2026 audit of 7,634 sites, all 11 consent platforms tested still failed to reliably block advertising cookies after opt-out.
Can you help with our customer's SOC 2 questionnaire?
Yes, for the part that is ours. The build ships server defenses annotated with the SOC 2 control each one maps to, CC6.1 on the contact route, CC6.6 and CC6.7 on the Content Security Policy, CC7.2 on route logging, P4.1 in middleware, CC8.1 in a release runbook. The audited organization is you, not us.
What do we get on paper?
A documentation pack: security policy, incident response, risk register, runbook and subprocessor disclosure, plus a public WCAG 2.1 AA accessibility statement live on the site.
Back to all eleven services

Tell us what you need

Six questions, no call required, and you get a written scope, a fixed price and a timeline.

Start the brief