Most audit products say "we have dozens of checks." We say how each one decided, how sure it is, and what it cannot prove — on every finding, in every report. A compliance scan that hides its uncertainty is worse than no scan.
A regression corpus pins every check's behaviour, but we write those fixtures ourselves, so it is a build gate — not evidence. What can tell you something is a measurement we do not control.
WCAG checks are executed by axe-core — the same open-source engine auditors and browser dev tools use — driven through a real browser, not a static parser. A rule that axe cannot decide is reported as undecided rather than guessed, and the EAA view is a mapping of those results onto the Act's requirements, not a second opinion about them.
What this does not prove. Most compliance questions have no industry reference tool to score against — there is no axe-core for "is this privacy notice adequate". For those checks "as accurate as the leader" is not a claim anyone can make, us included, which is why each finding carries its own confidence level instead. Automated accessibility testing also reaches roughly a third of WCAG: the rest needs a person, and the report says so rather than implying a clean scan means a compliant site.
None of these run today — they are design notes, listed so the gap is visible rather than implied. The one thing below that is real is the confidence label, and it ships on every finding.
Saying "this is compliant, this isn't" isn't enough. How the finding was produced is always visible in the report. The user can answer "how much should I trust this?" from the report itself.
Every finding's JSON output also carries mandatory method (how it was measured), limitations (caveats), and evidence.guidelines (regulator reference) fields. When an auditor asks "how did you produce this finding?" the answer comes straight from the report.
Everything below is in the report you get, not a promise about our internal process.
A finding cites the article or guideline it rests on and whether that source is binding, quasi-binding or guidance. You can check our reading against the text instead of taking our word for it.
How the check decided — parsed header, DOM pattern, rendered browser, language model — and the limitations of that method, printed next to the result rather than buried in documentation.
If a bot challenge or an error page stands between us and the site, the run is marked invalid. No score is produced from a page nobody saw — an empty finding list is not a clean bill of health.
Every report opens with the same sentence: this is not a compliance certificate. It is what an automated scanner observed at one moment, and the decisions stay yours and your counsel's.
What each check decided, how sure it is, and what it cannot prove — on the finding, not in a footnote.