BizHub365 Accessibility Conformance Report
How BizHub365 meets WCAG 2.2 Level AA and EN 301 549, criterion by criterion. The group accessibility statement explains how to report a problem or ask for another format.
International Edition, based on VPAT® Version 2.5 INT
| Name of product | BizHub365 web application, customer portals, generated documents and emails, and the BizHub365 iOS/Android app |
|---|---|
| Vendor | Tweed Tyne Technologies Ltd |
| Report date | 28 September 2026 |
| Contact | [email protected] |
| Standards | WCAG 2.2 Level A and AA; EN 301 549 V3.2.1 (chapters 9, 10, 11 and 12) |
Status
Published. BizHub365 partially conforms to WCAG 2.2 Level AA. Accessibility-tree tests run in CI on every change, and VoiceOver (macOS) and NVDA (Windows) are driven through core journeys every week; both pass. JAWS, VoiceOver on iOS and TalkBack on Android have not yet been tested, and this report will be updated when they are.
Summary across 55 criteria: 7 Not Applicable, 23 Partially Supports, 25 Supports.
Evaluation methods used
- Automated: axe-core 4.13 crawl of every page reachable with seeded data (163 pages, signed in and out, including customer portals, the public booking page and error pages), WCAG 2.2 A/AA rule tags. Runs in CI on every pull request and fails on serious or critical issues.
- Automated: reflow at 320 CSS px, WCAG text-spacing overrides and a keyboard focus crawl (focus visible, not hidden behind sticky content, no traps) on every crawled page.
- Automated keyboard-only journeys: sign in, add an expense, create an invoice, book an appointment on the public booking page, finalise and submit a VAT return, run payroll through to FPS submission (HMRC simulated); browser tests for dialogs, drag alternatives, the error summary, suggestion lists and status messages.
- Automated accessibility-tree tests (Playwright ARIA snapshots): landmarks, heading levels, names, roles and states on sign-in, the dashboard, the invoice form and the public booking journey, including where focus lands at each step.
- Real screen readers: VoiceOver (macOS, Safari) and NVDA (Windows, Chrome) driven by Guidepup through sign-in, the error summary, dashboard navigation and the public booking journey, asserting on what is spoken. The first NVDA run found that moving to the next booking step was silent; the step is now also announced.
- Static: template lint for labels, alt text, lang, dialog names, positive tabindex, submit-on-change and email layout tables.
- Documents: tagged PDF/UA structure checks for every generated PDF (documents, payroll forms, exports, reports, accounts, HMRC records).
- Mobile: eslint-plugin-react-native-a11y (all rules) and a theme contrast test in CI.
- Source review against each criterion, recorded in docs/accessibility/wcag_2_2_aa_checklist_bizhub365.xlsx.
Applicable standards
| Standard | Included |
|---|---|
| WCAG 2.2 Level A | Yes |
| WCAG 2.2 Level AA | Yes |
| WCAG 2.2 Level AAA | No |
| EN 301 549 V3.2.1 | Yes (chapters 9 to 12; chapters 5 to 8 do not apply to this software) |
Terms
- Supports: the functionality has at least one method that meets the criterion without known defects.
- Partially Supports: some functionality does not meet the criterion.
- Does Not Support: the majority of functionality does not meet the criterion.
- Not Applicable: the criterion is not relevant to the product.
WCAG 2.2 Report (also EN 301 549 clause 9, Web)
Table 1: Success Criteria, Level A
| Criteria | Conformance Level | Remarks and Explanations |
|---|---|---|
| 1.1.1 Non-text Content | Supports | Crawl: role-img-alt on FullCalendar toolbar icons fixed (bookings manager, dispatch board). Lint: no <img> without alt in templates. 27 Sep 2026 (later): Crawl of 163 pages axe-clean. Emails: alt text on logos, decorative images alt="" (lint rule). Open: the document template image block has no alt field, so images are decorative only. 27 Sep 2026 (follow-up): Image and Logo blocks in document templates now have an Alt text field and a Decorative option; alt text reaches the tagged PDF (branding/tests_alt_text.py). Brand and chrome images generally have equivalent alt text (base.html logos, HMRC MTD recognition mark, email/document logos). Store badges correctly use empty alt with an aria-label on the parent link. Gaps: user-authored images in doc_blocks/image.html always use empty alt; some decorative Font Awesome icons are not marked aria-hidden. Source-code review of Django templates only — not tested with a screen reader. |
| 1.2.1 Audio-only and Video-only | Not Applicable | No <audio> or <video> elements in Django templates. Product is forms, tables, and documents rather than pre-recorded media. |
| 1.2.2 Captions | Not Applicable | No synchronized video in templates. Captions are not applicable. |
| 1.2.3 Audio Description or Media Alternative | Not Applicable | No pre-recorded video. Audio description / media alternative not applicable. |
| 1.3.1 Info and Relationships | Partially Supports | Lint --fix linked 54 labels to their controls across 12 templates; line-item tables (orders, journals) now carry aria-labels matching column headers. Crawl: 0 label / select-name violations on reachable pages. 27 Sep 2026 (later): Shared form pattern (static/js/a11y-forms.js): hints linked with aria-describedby, error summary with links. Line-item tables keep a label per field when stacked on phones. Tagged PDFs have table headers (th scope). Screen reader confirmation pending (task 12). 27 Sep 2026 (follow-up): Every generated PDF is now tagged (list exports, reports, accounts, HMRC records, deletion export), except the CT600/CS01 form fills (core/tests_pdf.py). Public/auth pages use labelled controls, headings, and (on login, signup, onboarding, contact) aria-invalid plus aria-describedby. App tables often use <th>. Gaps: many in-app forms still use placeholder as the only name; not every error is tied to its field. Staff/accountant business switchers have visually-hidden labels. |
| 1.3.2 Meaningful Sequence | Partially Supports | Source order follows typical Bootstrap layout: skip link, header/nav, then main#main-content. No CSS that deliberately reverses reading order was found. Complex dashboards were not fully audited with a screen reader. |
| 1.3.3 Sensory Characteristics | Partially Supports | Instructions are mostly text (VAT/ITSA copy, form help). Status uses Bootstrap alert text as well as colour. Residual risk: colour-coded status chips. |
| 1.4.1 Use of Color | Partially Supports | Links inside running text are now underlined (base.css); axe link-in-text-block cleared. Errors and links usually include text, not colour alone. Residual: status styling that relies on colour without a text equivalent. |
| 1.4.2 Audio Control | Not Applicable | No auto-playing audio found in templates or reviewed static JS. |
| 2.1.1 Keyboard | Partially Supports | Fixed: dashboard cards swallowed Enter/Space from links and buttons inside them; the dispatch board's unscheduled tasks and calendar events were mouse-only; GrapesJS palette blocks were not focusable. Full keyboard-only walkthrough still to do. 27 Sep 2026 (later): Keyboard crawl tabs through every page. Keyboard-only journey tests: sign in, add expense, create invoice. Fixed: public booking page service cards and calendar days were clickable divs (now buttons); address and Companies House suggestions now work with arrows/Enter/Esc. VAT return, payroll run and booking journeys still need the manual pass (task 12). 27 Sep 2026 (follow-up): Crawl now fails on clickable elements the keyboard cannot reach; booking slots, VAT return rows and anchor-buttons fixed; accessibility-tree test of the full public booking journey. 28 Sep 2026: Keyboard-only journey tests for the VAT return (open it from the list, finalise through the declaration dialog, request and enter the email code, submit to the simulated HMRC service) and the payroll run (start the pay run, enter pay, finalise, build and submit the FPS), checking that focus is visible at every step. They found no new keyboard problems. Core flows use native HTML. Skip link and modal close buttons are keyboard operable. Risks: onchange navigation on filters/pagination/business switcher. No full keyboard-only walkthrough. |
| 2.1.2 No Keyboard Trap | Supports | 27 Sep 2026 (later): Keyboard crawl of 163 pages (40 stops each, date/time segments allowed): no traps. Dialog tests check Esc and Tab containment. No custom widget that obviously traps focus without Escape was found. Cookie banner and overlays were not keyboard-tested end to end. |
| 2.1.4 Character Key Shortcuts | Supports | GrapesJS's page-wide single-letter shortcuts (w/s/a/d) removed from the template editor (tested). No single-character shortcuts in BizHub365 code. GrapesJS (template editor) registered w/s/a/d page-wide; removed 27 Sep 2026. |
| 2.2.1 Timing Adjustable | Supports | Session timeout warning added: a dialog 5 minutes before the 8-hour idle limit, with Stay signed in (shared across tabs; tested in core/tests_a11y.py and user/tests.py). Flash errors/warnings no longer auto-dismiss; success/info pause on hover/focus and Esc closes. Email 2FA codes expire after 5 minutes but can be resent (extend). A code search found no other auto-hiding UI. Django SESSION_COOKIE_AGE is 8 hours (SESSION_SAVE_EVERY_REQUEST = True). There is no timeout warning or extend control. Users can lose unsaved form data after idle expiry. |
| 2.2.2 Pause, Stop, Hide | Partially Supports | Site-wide prefers-reduced-motion rule added (base.css). prefers-reduced-motion is honoured in several stylesheets and on the home page. There is no site-wide pause/stop/hide control for other moving content. |
| 2.3.1 Three Flashes or Below Threshold | Supports | No flashing content, blink, or marquee found. |
| 2.4.1 Bypass Blocks | Supports | base.html provides a skip link to #main-content; the main landmark uses that id. |
| 2.4.2 Page Titled | Partially Supports | Pages set title via Django title blocks, often including the brand name. Every authenticated view title was not audited. |
| 2.4.3 Focus Order | Partially Supports | 27 Sep 2026 (later): Install App dialog: focus moves in, stays in, returns to trigger. Booking calendar keeps focus on the chosen day after redraw. DOM order is the tab order; no positive tabindex found. Dropdown/modal tab order was not keyboard-tested across the app. |
| 2.4.4 Link Purpose | Partially Supports | Account menu avatar link had no name on every signed-in page (axe link-name, 64 pages) - fixed. Icon-only search/calendar/copy buttons named. Many links have visible text. Icon-only controls often have aria-label. Ambiguous pagination and icon-only actions still appear. |
| 2.5.1 Pointer Gestures | Supports | To check with task 10 (mobile). 27 Sep 2026 (later): Web: no multipoint or path gestures. Mobile: no swipe/pan gestures; pull-to-refresh has a Refresh button. Missing from the 2.1 workbook. No multipoint gestures in the web app; mobile swipe gestures not yet reviewed. |
| 2.5.2 Pointer Cancellation | Partially Supports | Native buttons/links complete on activation. Custom pointer-down-only handlers were not comprehensively searched. |
| 2.5.3 Label in Name | Partially Supports | Visible button/link text generally matches accessible names where both exist. Placeholder-only fields fail when the placeholder is the only name. |
| 2.5.4 Motion Actuation | Not Applicable | No motion-sensor / device-motion actuation found as a required input method. |
| 3.1.1 Language of Page | Supports | PDF document base (doc_blocks/_document.html) had no lang; now en-GB. 27 Sep 2026 (later): Emails, document PDFs and the Authorize.Net hand-off page now declare en-GB. Primary chrome sets html lang="en-GB". A few standalone templates still use lang="en". |
| 3.2.1 On Focus | Partially Supports | No onfocus navigation was found as a pattern. Focus on dropdowns/modals was not fully tested. |
| 3.2.2 On Input | Supports | All 13 submit-on-change controls fixed: an explicit Update/Apply/Switch button, or (bank auto-match switch) visible advance notice that it saves immediately. scripts/check_template_a11y.py fails CI on new inline or scripted submit-on-change. Changing a control auto-navigates without a visible advisory: pagination Show select, status filters, and staff/accountant business switchers (labels are visually hidden). Fails until those controls use an explicit submit or a visible prior warning. |
| 3.2.6 Consistent Help | Supports | To audit (task 5). 27 Sep 2026 (later): Web: help (support portal and contact) is in the shared footer on every page; customer portals end with the same Need help? block (includes/portal_help.html). Mobile: Help tile is always last on the home menu. Support portal link and footer help appear on most pages; placement not yet verified across app, portals and mobile. |
| 3.3.1 Error Identification | Supports | 27 Sep 2026 (later): Errors are described in text: flash messages (role=alert, stay until closed), form_status summaries, and the shared error summary with links and per-field messages for browser validation and .is-invalid fields (browser test). 27 Sep 2026 (follow-up): Create invoice, quote, recurring invoice and credit note validate on the server and come back with errors listed and all values kept (finance/tests_create_validation.py). Server-side errors and several public/auth flows identify errors in text and mark fields aria-invalid. Many in-app forms only show a generic error list. |
| 3.3.2 Labels or Instructions | Supports | 27 Sep 2026 (later): All controls labelled (lint gate at zero). Required fields show (required) unless the label already marks them. Hints linked to fields. Labels exist on most auth and settings fields. Gaps: placeholder-as-label; required fields not consistently indicated. |
| 3.3.7 Redundant Entry | Supports | To audit (task 5). 27 Sep 2026 (later): Audited onboarding, invoice/quote/recurring/credit note, payroll, HMRC MTD and booking flows; 11 flows now keep entered values on error or carry data forward (tests in */tests_redundant_entry.py and payroll/tests.py). Not yet audited across onboarding, invoice/quote, payroll and HMRC multi-step flows. |
| 4.1.2 Name, Role, Value | Partially Supports | Pagination aria-label on a non-interactive span removed; navbar toggles are real buttons with names. 27 Sep 2026 (later): Dialogs named by their titles (lint rule dialog-name). Suggestion lists are comboboxes with listbox options. Booking choices use aria-pressed. Mobile shared components expose role, label and state. Screen reader confirmation pending. Native HTML controls expose name/role/value. Unlabelled or placeholder-only inputs fail name. Dynamic VAT/ITSA updates are not consistently exposed. |
Table 2: Success Criteria, Level AA
| Criteria | Conformance Level | Remarks and Explanations |
|---|---|---|
| 1.2.4 Captions | Not Applicable | No live audio or video in the product. |
| 1.2.5 Audio Description | Not Applicable | No pre-recorded video. Audio description not applicable. |
| 1.3.4 Orientation | Supports | 27 Sep 2026 (later): Mobile app now allows landscape (app.config.js orientation default). Viewport is width=device-width with no maximum-scale lock and no orientation lock. |
| 1.3.5 Identify Input Purpose | Partially Supports | Added autocomplete to password change/reset (current-password, new-password), reset request (email) and delete-account (username). Login, 2FA, contact information, onboarding, and several customer-create fields use autocomplete tokens. Other address/business profile forms are not consistently marked. |
| 1.4.3 Contrast | Supports | Fixed: Bootstrap outline buttons (#0d6efd/#6c757d at 4.0-4.2:1) now use brand tokens (6.0:1+); text-bg-secondary/danger/warning badges corrected (were 3.3:1, 1.8:1, 2.3:1); --bh-info darkened to 5.7:1. Crawl: 0 color-contrast violations. 27 Sep 2026 (later): Axe color-contrast clean on all 163 crawled pages. Business brand colours are darkened to 4.5:1 in documents and emails and the branding page warns (branding/contrast.py, tests). Default email header title was white on a pale gradient; now dark. Email warning colours fixed. Mobile theme tokens pass a contrast test in CI. Brand tokens are intended as AA pairings on public/auth pages. App UI still mixes Bootstrap muted greys. Contrast was not measured with a meter on every screen. |
| 1.4.4 Resize Text | Supports | 27 Sep 2026 (later): 200% zoom at 1280px is a 640px viewport, inside the 320px reflow check that passes on every page. Mobile respects font scaling up to 2x on constrained labels. Viewport allows zoom. Layout is largely responsive. Zoom to 200% was not verified in a browser for dense VAT, invoice, and payroll tables. |
| 1.4.5 Images of Text | Partially Supports | Primary UI copy is HTML/CSS. Logos are images (an allowed exception), as is HMRC-approved artwork if it is ever shown. |
| 1.4.10 Reflow | Supports | Not yet tested at 320px. (Previous remark was a copy of 1.4.1.) 27 Sep 2026 (later): Crawl measures page overflow at 320 CSS px on all 163 pages: none. Invoice/quote line items stack into labelled cards below 576px (browser test). FullCalendar and the template editor scroll inside themselves (two-dimensional exception). Layout is responsive Bootstrap; dense tables scroll horizontally inside .table-responsive. Not yet verified at 320 CSS px. |
| 1.4.11 Non-Text Contrast | Partially Supports | Form control borders raised to #6F83A3 (3.85:1 on white, was 1.47:1). Focus ring is a 3px brand outline. Input borders were 1.47:1 against white until 27 Sep 2026. Icons and focus indicators to be verified per page. |
| 1.4.12 Text Spacing | Supports | Not yet tested with a text-spacing bookmarklet. (Previous remark was a copy of 1.4.1.) 27 Sep 2026 (later): Crawl applies the WCAG text-spacing overrides on every page and checks that no text ends up outside a clipping box: none found. No fixed-height text containers found in shared CSS. Not yet verified with text-spacing overrides. |
| 1.4.13 Content on Hover or Focus | Partially Supports | Bootstrap tooltips only; not yet tested for hoverable/dismissable. (Previous remark was a copy of 1.4.1.) Bootstrap tooltips and dropdowns; hover content not yet tested for dismiss/hover/persist. |
| 2.4.5 Multiple Ways | Supports | Primary nav, module search, public sitemap.xml, footer links, and FAQ search on support. |
| 2.4.6 Headings and Labels | Partially Supports | Public pages and many app views use headings and labelled fields. Heading levels are inconsistent on some dashboards. |
| 2.4.7 Focus Visible | Supports | Global :focus-visible outline added (3px, white on dark surfaces). Navbar menus changed from href="#" links to buttons. 27 Sep 2026 (later): Keyboard crawl checks every focus stop on every page has an outline or ring: all pass. Component resets (accordion, Choices.js, summary, focusable regions) restored. Public/auth/footer/cookie controls get a visible focus ring. Authenticated app uses .site-navbar--app, which is excluded from that CSS, so many in-app actions have no visible focus. |
| 2.4.11 Focus Not Obscured | Supports | scroll-padding-top now tracks the measured navbar height; Esc dismisses flash alerts without moving focus. Install prompt and TTT cookie banner not yet tested. 27 Sep 2026 (later): Keyboard crawl checks no focused element is wholly behind sticky/fixed content on any page. Flash messages sit below the navbar and their height is reserved; the TTT cookie banner's height is reserved while shown (browser test). Install App dialog locks the page behind it. App navbar is sticky; flash alerts and the PWA install prompt are fixed. Cookie banner is the shared TTT component. |
| 2.5.7 Dragging Movements | Supports | Browser tests for both in core/tests_a11y.py (27 Sep 2026; the dispatch board was removed on 12 Oct 2026). 27 Sep 2026 (later): Mobile reviewed: only pull-to-refresh, which now has a Refresh button. Web drag alternatives covered by browser tests. Web app: every drag has a single-click alternative. Dashboard: Reorder cards mode with Move earlier/later. Template editor: click to add, Move up/down on the block toolbar. Mobile app gestures not yet reviewed. |
| 2.5.8 Target Size | Supports | axe target-size rule reports no failures on the crawled pages. Tables with row actions and pages behind parameters not yet checked. 27 Sep 2026 (later): Axe target-size clean on all pages; .btn-sm, pagination and close buttons at least 24px (base.css); mobile pressables at least 44pt. Bootstrap buttons are 38px+; btn-sm and btn-close are borderline. |
| 3.1.2 Language of Parts | Partially Supports | Product is English throughout. Passages in another language are not marked with lang; risk is low. |
| 3.2.3 Consistent Navigation | Partially Supports | Shared nav is consistent for a given user/business. Feature-flagged items change which links appear. |
| 3.2.4 Consistent Identification | Partially Supports | Shared components give similar icons/labels for similar actions. Module-specific patterns still vary. |
| 3.3.3 Error Suggestion | Partially Supports | 27 Sep 2026 (later): Error summary shows the browser's suggestion per field. Server messages vary in quality. Validation messages often describe the problem. Suggestion quality varies. Password fields do not suggest the secret. |
| 3.3.4 Error Prevention | Partially Supports | VAT declaration modal and ITSA final declaration have review/confirm patterns. Session idle timeout can still cause data loss. |
| 3.3.8 Accessible Authentication | Supports | Verified in templates and apps/mobile/app/login.tsx on 27 Sep 2026. Mobile Field now exposes labels and a named show/hide password control. 27 Sep 2026 (later): Emailed codes can be pasted with spaces or a hyphen (web and server); no maxlength truncation. Login, 2FA, onboarding and reset use autocomplete tokens (username, current-password, new-password, one-time-code) and do not block paste. Bot checks use Cloudflare Turnstile, which is not a cognitive test. Mobile login sets autoComplete/textContentType. |
| 4.1.3 Status Messages | Supports | Flash messages: role=alert for errors/warnings, role=status otherwise (duplicate nested live regions removed). AJAX saves and copy-to-clipboard feedback not yet announced. 27 Sep 2026 (later): Page live regions (static/js/a11y-announce.js); copy to clipboard announced; async status text has role=status/alert; mobile announcements helper. Browser test. Missing from the 2.1 workbook although it is a 2.1 AA criterion. |
EN 301 549 Report
| Chapter | Conformance | Remarks |
|---|---|---|
| 9 Web | See the WCAG 2.2 tables above | Web application, public site and customer portals. |
| 10 Non-web documents | Supports | Every PDF BizHub365 generates is tagged PDF/UA with language, title, headings and table headers: invoices, quotes, receipts, payslips, P45, P60, CIS statements, list exports, reports, annual and management accounts, HMRC records and the account export. The CT600 and CS01 PDFs fill in HMRC's and Companies House's own forms and cannot be tagged; the same figures are on accessible report pages. |
| 11 Software (mobile app) | Partially Supports | WCAG 2.2 applied through WCAG2ICT: roles, labels and states on shared components, 44pt targets, font scaling, landscape, announcements, colour-independent status labels. Not yet tested on devices with VoiceOver or TalkBack. PDFs and images can be uploaded from Files as well as the camera and photo library (from the next app release). |
| 12.1 Product documentation | Supports | The user guide is HTML (WCAG 2.2 AA crawl-clean), tagged PDF and EPUB 3 with EPUB Accessibility 1.1 metadata (EPUBCheck clean). |
| 12.2 Support services | Partially Supports | Support is by email and the TTT support portal, whose accessibility is owned by the TTT group. |
Legal disclaimer
This report describes BizHub365 as evaluated on the report date. It is not a legal certification.