Frequently Asked Questions

A VPAT® (Voluntary Product Accessibility Template) is a document in which a technology vendor self-reports how their product conforms to accessibility standards, typically WCAG 2.1 or 2.2. A completed VPAT is called an Accessibility Conformance Report (ACR).

An ACR (Accessibility Conformance Report) is a completed VPAT. Vendors fill in the VPAT template to produce an ACR, describing how each WCAG success criterion is supported, partially supported, or not supported in their product.

A HECVAT (Higher Education Community Vendor Assessment Toolkit) is a security and risk assessment questionnaire widely used by higher education institutions to vet third-party vendors. Inclusive Digital evaluates HECVAT responses to surface security gaps and risk-tier vendors for procurement decisions.

WCAG (Web Content Accessibility Guidelines) is the internationally recognized standard for digital accessibility, published by the W3C. WCAG 2.1 AA is the most commonly required conformance level in procurement and legal contexts. WCAG 2.2 adds a further nine success criteria. Inclusive Digital scores against both.

The platform accepts PDF, DOCX (Word), XLSX (Excel), and CSV files. For best results, upload the vendor's full ACR or HECVAT as provided — avoid scanned images or password-protected files, as these cannot be read by the AI.

Generative AI reads the full document and evaluates it across two dimensions: how completely the vendor has addressed each required criterion, and the quality and credibility of the claims made. Both dimensions feed into a proprietary calculation that produces the final score. The result is designed to surface genuine risk rather than reward documents that are long or well-formatted but light on substance.

Scores are designed to be consistent and reproducible — the same document will always produce the same score. The AI follows strict rubrics rather than making subjective judgements. That said, VPATs and HECVATs are self-reported by vendors and may not always accurately reflect real-world accessibility or security. We recommend using scores as a starting point for vendor conversations, not as a definitive pass/fail.

Yes. The review interface lets you see the AI's suggested score for each criterion, read the supporting evidence pulled from the document, and override the score if you disagree. Your final report reflects your reviewed scores.

No. Scores are based on what the vendor has written in their VPAT or HECVAT — they reflect the quality and completeness of the document, not a verified audit of the product itself. VPATs and HECVATs are self-reported, and the AI evaluates those self-reports.

Our outputs are probabilistic — the same document will produce a consistent score, but AI-based analysis can miss nuance or misread ambiguous language. Scores should inform procurement decisions and vendor conversations, but should not replace manual review by a qualified accessibility professional, and do not constitute a legal determination of WCAG conformance or regulatory sufficiency.

The risk rating summarizes how well a product's document covers the relevant criteria. Scores run from 0–100 and map to four tiers:

• Low risk (90–100): Strong, well-evidenced coverage across criteria
• Moderate risk (71–89): Reasonable coverage with some gaps worth investigating
• High risk (41–70): Significant gaps or unsupported claims — follow-up required before procurement
• Critical risk (0–40): Severe deficiencies — escalation to legal or security teams recommended

The rating helps you quickly compare vendors or prioritize which ones need follow-up before procurement proceeds.

The Access Plan is a free template that documents temporary accessibility accommodations for a product or service that does not yet fully meet accessibility requirements. It captures who is responsible, what the barriers are, how affected users will be supported in the meantime, and when remediation is expected.

In the US this is commonly called an EEAAP (Equal Electronic and Information Technology Access Plan); in Australia it may be called an Accessibility Action Plan (AAP).

The Accessibility Remediation Roadmapis a free template for documenting, tracking, and resolving specific accessibility issues identified in a vendor's product. It is typically completed jointly by the customer and vendor, based on findings from a VPAT or ACR.

For each identified issue, the roadmap captures: the WCAG criterion, exact location in the product, users impacted, severity, recommended fix, responsible party, target date, and validation method.

They serve different purposes and are often used together:

• A Remediation Roadmap focuses on fixing the product — it holds the vendor accountable for resolving specific accessibility barriers with defined timelines.
• An Access Plan focuses on supporting users in the meantime — it documents interim accommodations while remediation is in progress.

If accessibility issues cannot be resolved immediately, both documents should be in place alongside each other.

Yes. Both the Access Plan and the Accessibility Remediation Roadmap are completely free. Fill them in online and download a pre-filled DOCX — no account required.

A Remediation Roadmap should be created whenever accessibility issues have been identified and remediation is required — for example when:

• A VPAT or ACR includes “Does Not Support” or “Partially Supports” ratings
• Accessibility testing identifies barriers in key user flows
• The product is being procured, renewed, or expanded
• Accessibility risk needs to be formally managed and tracked

Yes. Security is built into the platform at every layer:

• Encrypted in transit and at rest. All connections use HTTPS with HSTS enforced. Data stored in our database is encrypted at rest using AES-256.
• Hardened HTTP headers. The platform enforces a strict Content Security Policy, X-Frame-Options, and cross-origin resource policies to protect against common web attacks.
• Authentication via Clerk. We do not store passwords. Authentication is handled by Clerk, a SOC 2 Type II certified identity provider. Accounts support multi-factor authentication.
• Rate limiting. API endpoints are rate-limited at the IP and user level to prevent abuse.
• Isolated data. Your evaluations and uploaded documents are not accessible to other users or organisations.

For full details on data handling practices, see our Privacy Policy.

Yes. Documents you upload are processed to generate your assessment and are not shared with other users or third parties. Please review our Privacy Policy for full details on how we handle uploaded data.

No. We will not use documents you submit to train, fine-tune, or improve AI models without your prior express written consent. This commitment is set out in our Privacy Policy.

Uploaded documents and assessments are retained for the duration of your active account, plus 90 days for backup recovery after account deletion. See our Privacy Policy for the full retention schedule.

Yes. You can cancel your subscription at any time via the Dashboard → Manage Billing, or by emailing hello@inclusivedigital.co. You will retain access until the end of your current billing period.

Yes. You can switch between monthly and annual billing on the Pricing page. Annual plans are billed upfront for the full year and save approximately 10% compared to paying monthly.

Monthly plans are non-refundable. If you cancel, your access continues until the end of the current billing period — no partial-month refunds are issued.

Annual plans are generally non-refundable. However, we may issue a pro-rata refund for unused full calendar months remaining if a cancellation request is made within 30 days of your annual renewal date. Such refunds are not guaranteed — email hello@inclusivedigital.co to request one.

If you believe you have been charged in error, contact us within 30 days of the charge and we will investigate. Full details are in our Terms of Use (Section 15).

We offer four VPAT Evaluator tiers and equivalent HECVAT tiers:

• Starter ($29/mo): 4 evaluations/month, 1 user
• Professional ($99/mo): 30 evaluations/month, up to 5 users
• Business ($449/mo): 100 evaluations/month, up to 15 users, dedicated CSM
• Enterprise (custom pricing): Unlimited evaluations, unlimited users, SSO/SAML, API access, white-label options, SLA guarantees

See the Pricing page for full details. Bundle pricing is available if you need both VPAT and HECVAT evaluation.

Email us at hello@inclusivedigital.co and we'll respond as quickly as we can. We're a small team and aim to reply within one business day.

Yes. Use our demo request form or email hello@inclusivedigital.co to arrange a product demonstration.