How we work, and who runs it

You are about to hand someone your website and a legal problem. You should know who, and how.

Who runs MendAccess

Parveen Sharma. I built the audit engine this service runs on, and I read every report before it reaches you.

MendAccess is not yet incorporated. It is a service I operate, and invoices and agreements are issued in my name. I would rather say that plainly than imply a company that does not exist — you can verify a name; you cannot verify a logo.

There is no sales team, no account manager, and no ticket queue. When you email, I answer.

How an engagement runs

1. You tell me the site and the problem. If a demand letter is involved, your attorney handles the legal question — I answer the technical one.
2. You authorize the scan in writing. A specific scope, agreed before anything runs. I do not scan a site without it.
3. The engine scans it. Two independent rule engines and a screen reader, on the pages we agreed.
4. I triage every finding by hand. This is the part that cannot be automated, and it is where most of the value is.
5. You get the report. Each defect with its location, the WCAG criterion, a screenshot, and the fix written for the developer who has to make it — organized by template, because fixing one template fixes every page using it.
6. You fix, I re-scan. A verification run showing what changed, so a fix is confirmed rather than assumed.

What the engine is

Three independent witnesses, and a person:

• axe-core — an open-source rule engine, widely used and independently maintained.
• IBM Equal Access — a second engine, different rules, different authors, driven through our own pipeline.
• A screen reader — every page is read aloud and the transcript saved, so a report can show what a page announces, not only what its markup declares.
• Human triage — me, reading the output before you see it.

When two engines independently report the same defect on the same element, it is marked corroborated. When they disagree, the report says so instead of picking a winner. Every screenshot and transcript is SHA-256 hashed at capture, so a report can be re-verified later.

The engine is checked by 42 automated gates and 65 sabotage tests — deliberately broken inputs that each gate must catch. You can read the result of it scanning this very site.

What the engine is not

Automated coverage is a floor, not a verdict. Rule engines find what machines can decide. They cannot tell you a site is accessible.

The clearest example is in our sample audit: a product image with alt="IMG_4821.jpg". Every engine reports it as passing, because alt text is present. Only a person reading it knows a customer learns nothing. That single defect is why a human triages every report.

The limits, stated before you ask

• No legal advice. I am not a lawyer and will not act like one.
• No compliance certification. No automated method can issue one. Anyone offering it is selling something they cannot deliver.
• Third-party apps and embeds get reported, but the vendor owns the fix. I will tell you which vendor.
• One screen reader, not every screen reader. NVDA and JAWS interpret markup differently.
• Fixes regress. A theme update can undo a month of work, which is why every report is dated.

Talk to me

Request a free scan, or write to parveen@mendaccess.com.