conditions what it is held to

held to standards we can name, and to none we can’t:

Every standard below is one we design and test to, or whose principles are built into how we work. The wording is deliberate: designed and tested to is not certified, and aligned with is not compliant.

Close up, one blank key pressed down on a dark keyboard among its neighbours, its edges catching a thin cool light. — Every control, reachable from a keyboard alone.

accessibility W3C

WCAG 2.2, level AA

The Web Content Accessibility Guidelines 2.2 became a W3C Recommendation on 5 October 2023 and added nine success criteria to version 2.1. We design and test to level AA. Two of its criteria are easy to measure and easy to get wrong, so we built a check for them: contrast, where 1.4.3 asks for 4.5 to 1 at AA and 1.4.6 for 7 to 1 at AAA, and target size, where 2.5.8 asks for at least 24 by 24 CSS pixels at AA and 2.5.5 for 44 by 44 at AAA.

Testing means a keyboard, the screen readers built into phones and computers, text spacing and zoom, reflow on narrow screens and reduced motion, not one automated scan. We never call anything fully accessible.

mobile security OWASP

OWASP MASVS

The Mobile Application Security Verification Standard, release 2.1.0 from January 2024, groups its controls as storage, cryptography, authentication, network, platform, code, resilience and privacy; privacy was added in 2.1.0. It is tested with its companion testing guide. Our mobile security checks are aligned with it. There is no MASVS certificate, and we do not offer one.

personal data UK law

Data protection

UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025 and is being brought into force in stages. We design for data minimisation, set a retention period for each kind of data, and help you write the privacy notice for what you build. We never call software GDPR-compliant: whether processing is lawful depends on how it is used, by whom and why.

supplier conduct DSIT and NCSC

Software Security Code of Practice

Published by the Department for Science, Innovation and Technology with the National Cyber Security Centre in May 2025: fourteen principles in four themes, from secure design and development to how a supplier talks to its customers. Our method follows them:

an established secure development framework, and a second reader on every change
a list of every component inside the software
testing before each release, and signed releases
changes to the build environment controlled and logged
a published way to report a vulnerability, and timely security updates
a stated level of support, at least a year’s notice before it ends, and word to you about any notable incident

and none we can’t.

We hold no Cyber Essentials certificate, no ISO certificate and no accreditation of any kind, and nothing on this site should be read as saying otherwise. If that changes, the certificate will be named here with its number so that it can be checked. Until then there are no badges on this site, and no software of ours is called certified, compliant or secure as a promise.

this site accessibility statement

Accessibility statement for this site

This statement covers every page of vistarasoftware.site, the client room included, and is published by VISTARA SOFTWARE LTD.

How far it meets the standard

We aim for WCAG 2.2 level AA. We believe the site meets it, apart from the limits listed below. That belief rests on our own testing, set out here with its numbers; the site has not been audited by anyone independent, and we do not call it fully accessible.

What was tested, and what it measured

Widths: Every page at 320, 390, 820, 1280 and 1600 CSS pixels wide, scrolled top to bottom: nothing runs off the side at any of them, so the page reflows at 400% zoom as WCAG 1.4.10 asks.
Colour schemes: With the device set to light and to dark. The site keeps one dark scheme in both, and the automated check of ground, type scale and painted controls found nothing wrong on any page in either.
Contrast: Body text 16.1 to 1 on the page ground; the quietest text, grey on a panel, 6.0 to 1. Text over pictures was measured pixel by pixel under every line it covers: the worst pixel anywhere is 5.47 to 1, against the 4.5 to 1 level AA asks, and a deliberately failing control on each picture proves the measurement can fail.
Targets: Every link in the site’s navigation and small print is at least 44 by 44 CSS pixels at rest; level AA asks for 24.
Keyboard: Every page, form and the Go to palette worked with a keyboard alone: Ctrl K or Cmd K opens Go to, the arrow keys move, Enter goes, Esc closes. Focus is always drawn as a 3-pixel outline, and a skip link comes first.
Structure: One main heading per page with the others in order, a label on every field, landmarks for the header, navigation, main content and footer, and words for every picture: checked on every page in November 2026.
Motion: With reduced motion asked for, every animation stops and the finished state shows.
No JavaScript: Every page reads in full. Go to becomes a link to the main pages, and the brief form and every form of the client room still send.

Known limits

The sentence demonstration on the home page moves on its own. It has a Pause button, and its three sentences are written out as text beside it.
The site has one dark colour scheme. It does not switch to a light one when a device asks for it.
A form sent within three seconds of its page opening, or more than two hours after, comes back once with your answers kept and asks to be sent again. It is how robots are kept out.
A full session with each screen reader built into phones and computers has not yet been done on this site. Until it has, we do not claim it works well with all of them.
The copy of your data from the client room is a JSON file, which reads as plain text but is laid out for machines.

Prepared on 13 November 2026 from the tests above, reviewed whenever the site changes and at least every six months.

In another format

Ask at contact@vistarasoftware.site for any page, or your data from the client room, as plain text, in large print or as a document. We reply within five working days.

Something hard to use?

Write to the same address with the page and what happened. We answer within two working days and tell you what we will change, and when.

If you are not happy with our reply

The Equality Advisory and Support Service advises on discrimination and the Equality Act 2010 in England, Scotland and Wales. The Equality and Human Rights Commission is the body that enforces that Act. You can also use our complaints policy.

disclosure report a vulnerability

Reporting a security problem

If you find a vulnerability in this site, or in software we built, write to contact@vistarasoftware.site with a subject line that starts “Security”. What is in scope, how to test in good faith and what we commit to are in our security disclosure policy, and the same address is in this site’s /.well-known/security.txt.