Certifications & Compliance

Web Content Accessibility Guidelines 2.1 Level AA conformance. Keyboard navigation, screen reader support, high contrast.

Section 508 of the Rehabilitation Act. Federal accessibility requirements for electronic and information technology.

Americans with Disabilities Act compliance. Accessible to people with disabilities including visual, motor, and cognitive.

European standard for ICT accessibility. Harmonized with WCAG 2.1 AA for EU public sector procurement.

EU directive requiring digital products to be accessible. Effective June 2025.

Voluntary Product Accessibility Template documenting conformance with WCAG, Section 508, and EN 301 549.

EU General Data Protection Regulation. No personal data processed server-side. Articles 5, 6, 17, 25, 32, 44 satisfied.

UK implementation of GDPR post-Brexit. Same zero-upload architecture satisfies UK data protection requirements.

California Consumer Privacy Act and California Privacy Rights Act. No personal information collected or sold.

Lei Geral de Proteção de Dados. Brazilian data protection law. No data processing occurs outside user device.

Digital Personal Data Protection Act. Indian data protection law. No personal data transferred to any server.

Personal Information Protection and Electronic Documents Act. No personal information collected or disclosed.

Health Insurance Portability and Accountability Act. No PHI exposure — files never leave the browser. No BAA required.

Family Educational Rights and Privacy Act. Student records processed locally. No student data exposure.

Service Organization Control 2 Trust Services Criteria alignment. Zero data at rest, no vendor risk surface.

International information security standard. Annex A controls alignment through zero-upload architecture.

Federal Risk and Authorization Management Program. Zero cloud dependency simplifies ATO packages.

Qualys SSL Labs server test. TLS 1.2/1.3, strong cipher suites, HSTS preload, certificate chain verified.

SecurityHeaders.com scan. HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy headers verified.

Mozilla HTTP Observatory. Security headers, cookies, content security analysis. (CSP omitted — required for ZetaOffice WASM).

Google Safe Browsing status verified clean. No malware, phishing, or unwanted software detected.

HSTS Preload list submission. Browsers will enforce HTTPS before first connection.