Normos.io

ACCESSIBILITY

Accessibility Statement

Normos.io is committed to making our platform accessible to everyone. This statement explains our current conformance status, what we have done, and what we are working on.

Last updated: 16 May 2026

Conformance Status

Normos.io aims to conform to the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. These guidelines explain how to make web content more accessible to people with disabilities.

Our current status is partially conformant with WCAG 2.1 Level AA. Partially conformant means that some parts of the content do not fully conform to the accessibility standard. The known limitations are documented below with our commitment to address them.

This statement covers both normos.io (our public website) and app.normos.io (our platform dashboard).

What We Have Done

The following accessibility improvements have been implemented across both the public website and platform dashboard.

Form Label Association

DONE

All form inputs are correctly associated with their labels via htmlFor and id attributes. Screen readers can correctly announce field labels.

ARIA Roles and Labels

DONE

All icon-only buttons have aria-label attributes. Decorative icons are marked aria-hidden. Interactive elements have appropriate ARIA roles.

Error Announcements

DONE

All error messages use role=alert and aria-live=assertive. Success states use aria-live=polite. Screen readers announce dynamic content changes.

Focus Visibility

DONE

All interactive elements have visible focus indicators using focus-visible:ring styles. Keyboard navigation is fully supported.

Form Autocomplete

DONE

All form inputs have appropriate autocomplete attributes to assist users who rely on browser autofill or assistive technology.

Semantic HTML

DONE

Navigation, main, header, and footer landmarks are correctly used. Lists use ul/ol/li elements. Headings follow a logical hierarchy.

Language Declaration

DONE

All pages declare lang=en on the html element, enabling screen readers to use the correct language profile.

Image Alt Text

DONE

All meaningful images have descriptive alt text. Decorative images and icons are marked with aria-hidden or empty alt attributes.

Modal Dialogs

DONE

Modal dialogs use role=dialog, aria-modal, and aria-labelledby. Focus is managed correctly when modals open and close.

Colour Contrast

DONE

Primary text meets WCAG AA contrast ratios. Teal on navy achieves approximately 7.2:1. Body text on white achieves approximately 4.6:1.

Loading States

DONE

Loading spinners have role=status and aria-label. Disabled buttons use aria-disabled in addition to the HTML disabled attribute.

Password Strength

DONE

Password requirement indicators use aria-live=polite and aria-label to announce whether each requirement is met as the user types.

Known Limitations

We are committed to transparency about areas where we have not yet fully met WCAG 2.1 AA. The following limitations are known and are on our roadmap to address.

Skip Navigation Link

ROADMAP

A 'Skip to main content' link is not yet present on any page. Keyboard users must tab through the full header navigation on every page load. This will be added in Phase 2.

WCAG 2.4.1 Bypass Blocks — Level A

Leaked Password Protection

ROADMAP

HaveIBeenPwned password checking is not available on our current infrastructure tier. This feature will be enabled when we upgrade to Supabase Pro at our first pilot customer.

WCAG 2.1 AA — Best Practice

CSP unsafe-inline

PARTIAL

Our Content Security Policy includes unsafe-inline in script-src due to Next.js development requirements. This will be reviewed and tightened in Phase 2 following Cloudflare Turnstile optimisation.

Security best practice

Third Party Components

PARTIAL

Cloudflare Turnstile and Supabase Auth UI components are third-party and may not fully conform to WCAG 2.1 AA. We have no control over their accessibility implementation.

WCAG 2.1 AA — Third party scope

PDF Evidence Packages

ROADMAP

Generated PDF evidence packages are not yet tagged for screen reader accessibility. Tagged PDFs require additional PDF generation configuration and will be addressed in Phase 2.

WCAG 1.3.1 Info and Relationships — Level A

Independent Accessibility Audit

ROADMAP

Our accessibility improvements have been self-assessed. An independent audit by a WCAG specialist has not yet been conducted. This is planned alongside our CREST penetration test.

Best practice

Technical Specification

Normos.io has been developed against the following technologies and standards:

Accessibility Standard

WCAG 2.1 Level AA

Assessment Approach

Self-assessment — independent audit planned Phase 2

Technology

Next.js 16, React, Tailwind CSS, Shadcn UI

Tested Browsers

Safari (iOS/macOS), Chrome, Firefox

Accessibility Roadmap

The following accessibility improvements are committed to our Phase 2 roadmap.

Before first paying customer

  • Skip to main content link on all pages
  • Enable leaked password protection via HaveIBeenPwned
  • Migrated HCaptcha to Cloudflare Turnstile — improved third-party accessibility and removed HCaptcha as a sub-processor

Phase 2 — The Trust Network

  • Independent WCAG 2.1 AA audit by a specialist
  • Tagged PDF evidence packages for screen reader accessibility
  • Full keyboard navigation testing across all dashboard flows
  • ARIA live region review across all dynamic dashboard content
  • Nonce-based CSP — removes unsafe-inline from script-src

Phase 3 — The Compliance OS

  • Full WCAG 2.2 review and conformance assessment
  • Accessibility testing with real assistive technology users
  • Published third-party accessibility audit report

Reporting Accessibility Issues

We welcome feedback on the accessibility of Normos.io. If you experience any accessibility barriers or have suggestions for improvement, please contact us directly.

We aim to respond to accessibility feedback within 5 business days.

Accessibility Issues

Report barriers, broken functionality, or WCAG failures.

[email protected]

General Enquiries

Questions about our accessibility approach or this statement.

[email protected]

Legal Basis

This accessibility statement has been prepared in accordance with the Equality Act 2010 and reflects our commitment to providing accessible digital services to all users regardless of disability.

While the Public Sector Bodies Accessibility Regulations 2018 apply specifically to public sector organisations, we have adopted WCAG 2.1 AA as our standard voluntarily as part of our commitment to inclusive design and our own compliance principles.

This statement was prepared on 16 May 2026 and will be reviewed and updated as improvements are made and following any independent audit.