Komplify Accessibility Compliance Platform

Since June 2025, Germany's Accessibility Strengthening Act (BFSG) has required many businesses that offer consumer services online to make their websites and shops accessible. In practice, the technical benchmark is the WCAG success criteria at levels A and AA.

Prevision UG commissioned Komplify for organizations that have to meet these requirements without in-house accessibility specialists, mainly small and mid-sized businesses. They need to see, without prior knowledge, where their website has barriers, how serious they are and what exactly to do about them.

The interface, all findings and all reports are available in German and English. Users sign in with email, Google or Microsoft, and the free entry point works without any account.

Automated tests only cover part of WCAG. Whether alternative text is meaningful or a focus order is logical can often be judged only partially by a machine. The platform therefore has to separate clearly what is a definite violation, what a person should review and what cannot be tested automatically at all. A tool that reports false alarms as violations quickly loses its users' trust.

Technically, this means loading third-party websites in a real browser, crawling many subpages and testing keyboard operation and focus behavior as well. The scanner processes arbitrary addresses from the internet and has to run with matching safeguards.

On top of that came product requirements: a free entry point, plans with different testing depth, recurring scans, hosting in Frankfurt and careful handling of personal data. Scans should use compute only when needed, without permanently running scan servers.

Without an account, visitors test a single page and receive a score with the most important findings. Registered users add domains and choose between three scan levels: Light checks one page with axe-core, Normal adds custom heuristics and cross-page checks, and Deep crawls up to 100 subpages and also tests keyboard operation, focus and AI-assisted criteria.

Every finding names the WCAG criterion, its severity, the affected user groups and a clear recommendation with a code example. Findings are grouped by confidence: definite violations, hints for manual review and AI-assisted assessments. Reviewed false alarms can be dismissed with a reason, and criteria without an automated test are worked through in a WCAG checklist.

Komplify consists of the website and dashboard, the API and the scanner, tied together by a shared TypeScript package for WCAG metadata and scoring logic. The frontend is built with Next.js, Tailwind CSS, shadcn/ui and SWR and served statically through S3 and CloudFront. The API is a Fastify application with Prisma, Zod and PostgreSQL, running as a Lambda function behind API Gateway. Amazon Cognito handles sign-in, and tokens are kept in httpOnly cookies.

Each scan is a Step Functions workflow: initialize, crawl and test, aggregate results, generate the report, notify the user. The scanner loads pages with Puppeteer, runs axe-core with the rule sets for WCAG 2.2 A and AA, and adds 18 heuristics, 4 cross-page checks and 5 behavioral checks. In Deep scans, 13 AI checks on Amazon Bedrock assess criteria such as link purpose and headings, and the fix suggestions also run on Bedrock in the Frankfurt region.

The scanner validates target addresses before every request and blocks access to internal networks, and every page and every scan has a fixed time limit. All data stays in Frankfurt, every database query is bound to the owner of the data, and logs contain no personal data. Users can export their data, and deleting an account removes database records, reports, the login and the Stripe customer together. IP addresses from the free check are stored only as hashes.

The infrastructure is defined with AWS CDK in twelve stacks, separated into development and production; in production, AWS WAF protects the API. Scheduled functions start due rescans and send email through Amazon SES. Backend and scanner are tested with Vitest. In GitHub Actions, linting, type checks and backend tests must pass before frontend, API, scanner, infrastructure and database migrations are rolled out. Stripe webhooks are verified by signature and processed idempotently.

Businesses get a clear inventory of their website without specialist knowledge: which criteria are violated, who is affected and how to fix the problem. Rescans and notifications show whether a change introduced new barriers, and reports document the current state.

Komplify is live in German and English and bills through subscriptions and scan credits. Scans use compute only while they run, and the entire infrastructure is versioned as code.