Scope by Screens and Workflows
We scope by the unique screens and workflows behind your login, not marketing pages. We size the engagement from that count on a short call, or over email if you prefer, and fix the fee in writing before you commit.
SaaS & Web Apps · WCAG 2.2 AA · VPAT/ACR
A WCAG Audit for SaaS, Tested Behind Your Login
A SaaS accessibility audit has to start where your users do: logged in. Harbor tests authenticated views, dashboards, and single-page apps by hand against WCAG 2.2 AA, with a keyboard and real screen readers, and delivers the signed conformance report enterprise and government procurement teams recognize. An automated scan can decide about six of the 55 WCAG 2.2 A and AA criteria on its own. In a web app, the rest is where the risk lives.
- DHS Trusted Tester TT-2606-09221
- Named, DHS-certified evaluator on every report
- Manual + automated testing
- E&O insured
Mid-deal and the buyer is waiting? An ACR does not require a clean product. It documents where the product stands, reviewers read in-progress remediation as normal, and the delivery date is committed at signing: 21 days on a Focused engagement, 45 on Standard, 60 on Professional. What stalls deals is having nothing credible to send.
Sound Familiar?
- An enterprise buyer asked “where’s your VPAT?” and the deal stopped moving
- Your product lives behind a login, and every scan or audit quote so far has only covered the marketing site
- A government, university, or Fortune 500 prospect requires accessibility documentation before the contract can close
- Accessibility landed on the product roadmap with a deal attached, and nobody on the team has been through an audit
Before You Compare Quotes
Four numbers worth knowing if this is your first accessibility audit. None of them are about us.
About 30 of 55
Criteria a Tool Cannot Decide
WCAG 2.2 has 55 Level A and AA success criteria. Most of them turn on judgement a scanner cannot make, such as whether alt text is correct rather than merely present. Automated testing is where an audit starts, not where it ends.
$100 to $350
Per Page, How Most Bill
Per-page pricing is the common model, so your page count drives your fee. A store with 300 products on one layout is 300 pages under that model. Ask any provider whether they count pages or templates before you compare two quotes.
$500 to $12,500
The Published Range
That is the span of publicly listed prices across the providers on our comparison page, and the conformance document is often billed separately on top. Quotes vary this widely because scope definitions do.
28%
Of Vendors Have One Ready
We checked 107 recognizable software companies for a conformance report a buyer could actually read. Fewer than a third could produce one without a form or a sales call. The full finding is published.
New to this? The buyer’s guide explains what you are actually paying for, why two quotes for the same site can differ tenfold, and the questions worth asking any provider, including us.
Competitor figures read from each provider’s own published pages on 2026-08-04, and re-checked quarterly. Our own figure is not among them: we size an engagement on a fifteen-minute call and fix it in writing before you commit.
How It Works
Audit + Fix Guides
Manual WCAG 2.2 AA evaluation of your authenticated product with NVDA, JAWS, and VoiceOver, plus keyboard-only passes through every workflow in scope. Findings are grouped by component, so one broken pattern is one ticket instead of twenty.
Signed VPAT/ACR
A finished conformance report in VPAT 2.5 format, signed by the DHS-certified evaluator who performed the testing, ready to hand to the buyer who asked. We re-verify fixes as your team ships them.
One flat fee by tier, following the number of unique screens or templates behind your login. A wider authenticated app sits at Enterprise. We size it on a 15-minute call, or over email if you would rather. How engagements work.
Where This Sits in the Market
- Overlays and automated scans run a few hundred dollars a year and judge only the part of WCAG a machine can judge. Procurement reviewers know this and send those reports back.
- Budget VPAT shops publish rates: the document itself from around $350, on top of a per-page audit that commonly totals $1,250 to $2,750. That buys a filled-in template covering a sample of screens, usually with no named evaluator and no committed date. If your buyer just needs a document in the vendor file, buy that one.
- Enterprise accessibility vendors do genuinely excellent work, and their reports carry real weight. They also sell annual platform-and-services contracts that commonly start in the tens of thousands and run into six figures, because that is the business they are in.
- Harbor is the rung between. One report, one flat fee, every template tested by hand by a named DHS-certified evaluator whose certificate number is published so your reviewer can read it, on a date committed at signing. Priced for a company that needs one deal unblocked, not a platform subscription.
Figures are competitors’ own published list prices where they publish at all. Most firms at this tier and above quote privately. See the full comparison.
What You Receive
- Manual WCAG 2.2 AA audit covering authenticated views, dashboards, and multi-step workflows
- Screen reader testing with NVDA, JAWS, and VoiceOver, plus full keyboard-only coverage
- VPAT® 2.5 ACR formatted for procurement and signed by the named evaluator who did the testing
- Remediation plan organized by component and file location, with before-and-after markup
- Follow-up reviews of remediated screens as your team ships fixes, with a re-issued ACR after each (2 on Focused, 3 on Standard and Professional, 5 on Enterprise)
- Up to 90 days of post-delivery email support
Want to see the real thing first? Read the sample VPAT/ACR and the sample remediation plan, published in full, or browse all deliverables.
Common Questions
- Can you audit the parts of the product behind our login?
- Yes, that is most of the engagement. You provision a test account on staging or production, whichever reflects what you ship, and we work through the product by hand: dashboards, settings, editors, wizards, every workflow in scope. We are happy to sign an NDA, and a standard test account is all we need; no customer data is involved.
- We are a React single-page app. Does that change the audit?
- It changes where the problems concentrate, and it is exactly why hand testing matters. SPAs put the risk in focus management, route changes, live announcements, and custom widgets, the criteria automated scans are weakest on. We test the app state by state, the way a screen reader user actually experiences it. The framework does not matter as long as we can reach the screens.
- What if the audit finds a lot of problems?
- In a first audit of an authenticated app it usually does, and that does not block the deliverable. The ACR marks each criterion Supports, Partially Supports, or Does Not Support with remarks, and reviewers expect a mix. What we deliver is an accurate report and a prioritized path to a better one.
- Do we need this or your VPAT service?
- They are the same engagement described from two sides. The VPAT page speaks to the document procurement asked for; this page describes how that document gets made for a SaaS product: what we test behind your login and what your developers receive along the way. A VPAT worth publishing is the output of a real audit, so you are not choosing between them. Start from whichever end your deal did.
Talk to the Auditor, Not a Sales Team
You will be talking to Andrew Szigety, the accessibility consultant who runs your audit and signs your report. Fifteen minutes, no pitch, and you can end it owing nothing. We work out what counts as a template, what your deadline needs, and where your product is awkward, and you leave with a fee and a delivery date.
Harbor provides technical audits and conformance documentation, not legal advice. No audit can guarantee compliance; what we stand behind is the accuracy of the testing and the report.