Accessibility · Privacy · Search · Performance · Uptime

Audit every client site.
Evidence, not an overlay.

Evidalux scans the sites you build and run for clients — WCAG accessibility mapped to the ADA, US and EU privacy law, SEO and AI-search readiness, Core Web Vitals and uptime — and hands you a report under your own brand where every finding says how it was measured and how sure we are.

No card on Free Every module on paid plans Data hosted in 🇳🇱 NL
83
Plugins across five modules
32
Laws · US, EU, UK, Canada
2
Viewports per accessibility scan (desktop + mobile)
6
Alert channels (Slack/Discord/Teams/Telegram/Email/Webhook)
500
Pages per site scan on Agency
Accessibility · ADA Title III

ADA website suits keep coming. Widgets do not stop them.

Plaintiffs filed 3,117 website-accessibility lawsuits in US federal court in 2025, up 27% on 2024 (Seyfarth Shaw, Mar 2026). In the first half of 2025, 22.6% of the suits UsableNet tracked named sites that already had an accessibility widget installed (UsableNet, Jul 2025). In April 2025 the FTC ordered one widget vendor to pay $1 million for claiming its tool made sites WCAG-compliant (FTC, Apr 2025).

Evidalux does not paint over a site. It runs axe-core in a real browser, at desktop and at phone width, and lists every failing WCAG success criterion with the elements behind it — mapped to ADA Title III and, for European clients, to the EAA and EN 301 549.

  • What the automated rules can test: reported, per criterion, per page
  • What they cannot — roughly two thirds of WCAG, like keyboard flow and meaningful alt text — named as needing a manual check
  • We never label a site "ADA compliant". A clean automated scan is a clean automated scan.
accessibility: WCAG → law
WCAG 1.4.3 Contrast (Minimum)FAIL · 12 elements
WCAG 2.5.8 Target Size — phone onlyFAIL · 7 elements
WCAG 3.1.1 Language of PageFAIL · 1 element
ADA Title III §12182 · EAA Art. 4(1)DETECTED
Five modules, one report

Everything a client asks you about their site

Every paid plan includes every module. Each card links to the checks behind it.

Compliance & accessibility

35 plugins audit a site and return an article-by-article matrix. Every finding carries a confidence label, the method behind it and its limitations.

32 laws across the US (13, including ADA Title III, CCPA/CPRA and CIPA), the EU (13), the UK (4) and Canada (2).

One finding can cite a US law and its EU, UK or Canadian counterpart at once. Every law and how it is checked →

Visibility

16 plugins for technical and on-page SEO across the whole site: meta tags, structured data, canonicals, sitemaps, robots.txt, broken links, duplicate content and Lighthouse.

What Visibility checks →

Trust

8 plugins for AI-search readiness: whether AI crawlers may read the site, whether its content is quotable, and whether its entity and schema signals hold together. Static checks — we do not query chatbots.

What Trust checks →

Quality

10 plugins for performance and robustness: Core Web Vitals from the field and the lab, security scanning, cross-browser and responsive rendering, load tests.

What Quality checks →

Uptime

14 plugins for TLS, DNS and email authentication, security headers, redirects and exposed files — plus uptime monitors, public status pages and on-call alerts.

What Uptime checks →

Regulation Radar

A scan tells you where a site stands today. Radar watches the US Federal Register, EUR-Lex, the EDPB and UK and Canadian regulators, maps each change to the checks it makes stale, and tells you only when a site you audit is affected.

AI classifications are labelled suspected. Not legal advice. Included on Studio and Agency. How Radar works →

Who it's for

The people clients call when their site is in trouble

Web agencies

Watch every client site from one panel, and turn accessibility, privacy and SEO findings into a monthly care plan your clients can see.

Freelance web designers

A handful of client sites, one person. Scheduled scans catch the regression before the client — or a demand letter — does.

In-house web teams

Your own sites, audited on a schedule, with the evidence your legal and marketing colleagues ask for already attached.

Privacy + agency tooling

One scan, one panel, one evidence trail.

compliance: cookie_consent
CRITICAL — Trackers loaded before consent
6 tracker families detected
Google Analytics 4PRE-CONSENT
Google Tag ManagerPRE-CONSENT
Microsoft ClarityPRE-CONSENT
Meta PixelPRE-CONSENT
GDPR Art. 7 + ePrivacy Recital 3011 refs
Privacy

What loads before anyone agrees

The scanner loads each page in a real browser before any consent is given and lists the trackers that fire anyway, the cookies they set and the notices a visitor should have seen. Findings cite the law that applies to the site — US state privacy and wiretap statutes, GDPR and ePrivacy, UK PECR, Canada's PIPEDA and Law 25.

  • Pre-consent tracker and cookie detection, IAB TCF v2.2 decoding
  • Session-replay and ad-pixel checks read through California's wiretap law (CIPA) and, on pages with video, the VPPA
  • Chatbot and AI-content disclosure checks for the state AI laws
  • We never claim "this site is compliant" — only evidence, method and limitations
Agency tooling

Your brand on the report, your client in the loop

Reports go out under your name and logo, not ours. Send a client a read-only link to their latest report — no account for them to create, and you can revoke it at any time.

  • White-label reports on Freelancer, Studio and Agency
  • Read-only client links, expiring or revocable
  • Sub-tenants on Agency: up to 50 client workspaces under one login
dashboard: your agency
A
Your Agency
12 clients · 47 sites
→ ACME Holding14 sites · 88 score
→ Northwind Retail3 sites · 76 score
→ Lumen Studio1 site · 92 score
→ NewsCorp1 site · 41 score
→ Test Services2 sites · 63 score
35 compliance plugins

What each plugin checks, and against which law

Every plugin below is registered and runs today. Names, legal references and scope are kept in step with the plugin registry by hand — if you find a row that disagrees with a report you received, that is a bug and we want to hear about it.

Accessibility (WCAG 2.2) WCAG 2.2 AA · EAA Annex I Runs axe-core in a real Chromium and reports every violated rule. The same rule failing on 80 pages collapses to one row with the affected URLs behind it.
EAA Legal Mapping EAA — Dir (EU) 2019/882 Translates the engineering-level axe violations into the EAA articles they breach, so legal reads obligations instead of CSS selectors.
Accessibility Statement EAA Art. 4(1)(c) + Annex VI Checks for a published accessibility statement and whether it declares conformance level, known non-conformities, an alternative-format contact and an assessment date.
Advertising Transparency DSA Art. 26 Tests whether ads are identifiable as ads in real time and whether the party on whose behalf they run is named.
Robust Age Assurance UK OSA 2025 · DSA Art. 28 · COPPA · TX SCOPE · FL HB 3 · Quebec Art. 14 Goes beyond a self-declared “are you 18?” gate — which several of these laws call insufficient — and looks for an actual third-party age-assurance vendor.
AI Disclosure (static) AI Act Art. 50(1) Detects chatbots and AI assistants, then checks whether the user is told they are talking to a machine.
AI Disclosure (visual) AI Act Art. 50(2) + 50(4) Takes a screenshot and asks a vision model whether synthetic media and deep-fakes carry the disclosure the article requires.
AI Training-Data Transparency California AB 2013 Checks whether a generative-AI developer publishes the dataset documentation summary the statute requires.
Content Credentials (C2PA) AI Act Art. 50(2) · California SB 942 Fetches a sample of the page's media and detects an embedded C2PA provenance manifest by its JUMBF structure — the marking mechanism both laws accept.
Child Consent GDPR Art. 8 · COPPA Decides whether the site addresses minors and, if it does, whether an age or parental-consent gate exists at all.
CIPA / VPPA Pixel Wiretap CIPA §631 / §638.51 · VPPA §2710 Records every outbound request before any consent interaction and flags session-replay and video pixels — the two US litigation waves that are web-observable.
Cookie Consent GDPR Art. 6-7 · ePrivacy Art. 5(3) Loads the page in a fresh browser profile and lists the trackers that fire before the visitor touches the banner, plus the banner's own quality.
Cross-Border Transfer GDPR Chapter V (Art. 44-49) Identifies non-EU processors loaded by the page, then reads the privacy policy for the SCC / BCR / adequacy / DPF safeguard that would justify them.
Dark Pattern (static) DSA Art. 25 · EDPB Guidelines 03/2022 Looks for pre-ticked consent, false-urgency copy and confirmshaming button text in the served HTML.
Dark Pattern (visual) DSA Art. 25 Compares the visual prominence of accept and reject controls in a screenshot — the asymmetry a text scrape cannot see.
Data Subject Request GDPR Art. 12 + 15 Checks that the rights channel actually works: a contact address, a form or request page, and the rights themselves named — not just “you have rights.”
DPO Contact GDPR Art. 37-39 Reads the linked privacy policy for a named data protection officer, a dedicated address or a working contact route.
Greenwashing (static) EmpCo Dir (EU) 2024/825 · FTC Green Guides Finds environmental and sustainability claims in body text and classifies whether each one is substantiated on the page.
Greenwashing (visual) EmpCo Dir (EU) 2024/825 Catches the green claims that live in badges, seals and imagery rather than in text.
EU Representative GDPR Art. 27 For controllers outside the EU that serve EU data subjects: is an EU representative designated and findable?
Geo-blocking Surface Reg (EU) 2018/302 Surfaces the single-region-observable signals of nationality, residence or establishment discrimination — country redirects, blocked checkouts, restricted payment options.
IAB TCF v2.2 (static) IAB TCF v2.2 Detects whether a TCF consent surface is installed at all, from the served markup.
IAB TCF v2.2 (live) IAB TCF v2.2 Invokes window.__tcfapi in a real browser and reads the returned TCData — purpose-level consent as the ad-tech chain actually receives it.
Legal Disclosure / Imprint e-Commerce Dir 2000/31 Art. 5 · TCC Art. 1524 Finds the imprint page and checks the minimum disclosure set: identity, geographic address, contact details and registration data.
Marketing Opt-in GDPR Art. 7 + 21 · ePrivacy Art. 13 · İYS Flags pre-ticked marketing boxes and opt-out-shaped signup — invalid consent under Planet49 (C-673/17).
EU ODR Link Reg (EU) 524/2013, repealed by 2024/3228 The ODR platform closed on 20 July 2025. This flags the stale link still pointing at it, which now sends consumers to a dead service.
Pay-or-Consent Wall EDPB Opinion 28/2024 · GDPR Art. 7(4) Detects the “consent or pay” model the EDPB held generally fails the freely-given-consent standard.
Political Advertising Reg (EU) 2024/900 Art. 11-12 Checks political ads for the required “this is a political advertisement” statement, the sponsor's identity and the per-ad transparency notice.
Pricing Indication Omnibus Dir 2019/2161 · Price Indication Dir 98/6 Tests discount claims against the 30-day prior-price rule and checks unit-price labelling.
Privacy Policy Content GDPR Art. 13 Reads the policy for its four required pillars: processing purposes, lawful basis, retention period and data subject rights.
Purchase Disclosure Consumer Rights Dir 2011/83 Art. 8(2) + 9 Checks that the order button states the payment obligation explicitly and that the right of withdrawal is disclosed before purchase.
Ranking & Marketplace Transparency Omnibus / UCPD Art. 7(4a) · CRD Art. 6a Looks for paid-placement labelling on listing surfaces and, on marketplaces, disclosure of trader status and the main ranking parameters.
Required Policy Pages GDPR Art. 13 · ePrivacy · UK DPA 2018 Walks the homepage link graph for the four pages the law expects to be reachable: privacy, cookies, terms and the data-request route.
Review Authenticity Omnibus / UCPD Annex I 23b · UK DMCC 2024 Checks whether a site claiming genuine consumer reviews shows any sign of the verification steps that claim legally requires.

Regulation Radar adds no scan plugins of its own — it watches regulator feeds and re-runs the plugins a change actually touches.

Pricing

Priced per client site · every module on paid plans

US dollars, plus applicable tax. No card on Free. Pay yearly and get 3 months free. Plans differ by how many sites you watch and whether reports carry your brand.

Free
$0/mo
No card needed
One site — for a site owner, or an agency trying the product.
  • 1 site · 2 users
  • 1 site scan a month
  • Up to 5 pages per site scan
  • Compliance, accessibility, SEO, AI search, uptime
  • Performance, load & security testing
  • White-label reports
  • Regulation Radar
Start free
Freelancer
$35/mo
or $315/year — 3 months free
A web designer looking after a handful of client sites.
  • 5 client sites · 2 users
  • Weekly site scans
  • Up to 25 pages per site scan
  • Every module
  • White-label reports
  • Regulation Radar
Start Freelancer
Agency
$229/mo
or $2,061/year — 3 months free
Agencies running a full client portfolio.
  • 50 client sites · 10 users
  • Weekly site scans
  • Up to 500 pages per site scan
  • Every module
  • White-label reports
  • Regulation Radar included
Start Agency

More than 50 sites, SSO, on-prem or a custom DPA? Talk to us about Enterprise.