Compliance matrix
What every build is held to, and the evidence you receive at handover.
| Standard | What we build to | Evidence at handover |
|---|---|---|
| WCAG 2.1 AA and ADA | axe-core checks in the build pipeline, plus a manual keyboard and screen reader pass. | Written audit report. |
| GDPR and US state privacy | No third-party tracking by default. US or EU hosting, agreed up front. | List of every external request the site makes. |
| Role-based access | Separate administrator and editor roles, MFA enforced for staff. | Role matrix and access list. |
| Edge security | TLS, web application firewall and DDoS protection, security headers. | Configuration in the repository. |
| Availability and recovery | Automated deploys, edge caching, scheduled backups. | Backup and restore steps. |
Check your RFP requirements
Bring the compliance section of your RFP.
Legacy CMS or a stack you own
| Topic | Typical legacy CMS | Anviq stack |
|---|---|---|
| Speed | Plugin-heavy pages built per request. | Static pages cached at the edge. |
| Attack surface | Public database, admin login, plugins. | Static files, no public database. |
| Maintenance | Constant patching, often a retainer. | Little to patch. Support optional. |
| Ownership | Tied to the vendor's platform. | Code and content are yours. |
Portals that need a backend follow the same rules: isolated data, access control, audit logging and your chosen region.