We change code on live websites. Here is why that is safe.
Clients grant us access to their platforms so we can fix accessibility at the source. This page sets out the checks every change goes through and how we hold your credentials and data.
The safeguards on every change
The checks a remediation job goes through, and what you can undo afterwards.
A visual check before any write
Before a fix is written, the system renders the page with the whole batch of fixes in place and compares it with the page as it is now. If the page would look different, the batch is held and nothing is written.
A snapshot of every change
Every applied fix is stored with the original content next to the fixed content, byte for byte. On Squarespace the snapshot is saved before the write, and the write is refused if it cannot be saved.
Rollback from your dashboard
On the platforms we write to, any fix, or all of them, can be reverted from your dashboard. Rollback writes the snapshot back and records the reversal in the audit log.
Confidence gates on every AI fix
Each generated fix gets a confidence score. On WordPress, Shopify, Webflow and Squarespace, fixes at or above the automatic threshold are applied, fixes between the review and automatic thresholds wait in your review queue, and fixes below the review threshold are not applied. On GitHub every fix goes into a pull request, which we merge only if you turned on automatic merging.
A check after the write
After a write, the system reloads the live page and checks it still looks the same, and on the platforms where it can, checks the fix is present. If the page changed more than an accessibility fix should, the change is queued for rollback where the platform supports it and the job is held.
How we hold your credentials
Platform credentials (WordPress application passwords, Shopify and Webflow API tokens) are encrypted at rest with AES-256-GCM using a key derived through scrypt. They are decrypted only on our servers at the moment a job or integration call needs them, never rendered in a browser, never written to logs, and deleted when you disconnect an integration.
Where a platform offers scoped access, we use the narrowest scope that can apply a fix. On GitHub, fixes arrive on a new branch as a pull request, and by default the pull request waits for you to merge it. If you ask us to turn on automatic merging, we merge it into your default branch as soon as it opens, unless your branch protection requires a review. Fixes to app source code are always left for you to merge.
Each step of a remediation job, from the gate before the write to the check after it and any rollback, is written to an audit log with timestamps, so there is always an answer to "what exactly did you change, and when?" Sign-in and account security events go to a separate log whose database trigger rejects edits and deletes.
Infrastructure and data
- TLS everywhere, with HSTS preload. Frame denial, a strict referrer policy, and a Content Security Policy ship on every response. The policy still allows inline scripts, so it limits where scripts load from but does not yet block injected inline code.
- Data lives in managed Postgres (Supabase) with row-level security enabled on every table. Our backend services share one server-side database key that bypasses those policies, so access control between customers is enforced in our application code.
- Payments are handled by Stripe (PCI-DSS Level 1). Card numbers never reach our servers.
- AI analysis and fix generation use the Anthropic API, which does not train models on API inputs. We send what each check needs: page snippets and screenshots for websites, images and the text around them for documents, screenshots and source excerpts for apps, page titles and descriptions for SEO fixes, and the change requests you type in your review queue. Never your database.
- Referral attribution uses two first-party cookies, set only if you allow them and never shared. No third-party ad trackers and no advertising pixels.
- GDPR and CCPA rights (access, deletion, portability, opt-out) are honored through the dashboard and support@remediada.com. When you close your account, erasure starts 30 days later and waits while a subscription, monitoring, a suspension or an open payment dispute is still on the account. A held account is checked every week.
The legal detail lives in our Privacy Policy, sub-processors list and Terms of Service. To report a vulnerability or ask a security question, email security@remediada.com.
Trust is earned in the audit log.
See how many accessibility issues your homepage has, highlighted on the page. Free, about a minute. The full report with fixes comes with a paid audit.