Accessibility and security at Liftnow

We build the portal so that people who navigate by keyboard, screen reader, magnification, or any other assistive technology can complete the same work as anyone else. The product has undergone a full accessibility remediation effort targeting WCAG 2.1 Level AA, and accessibility is treated as an ongoing obligation that travels with every change we ship.

• Remediated to WCAG 2.1 Level AA

  We completed a full remediation effort against an internal audit of the portal, closing every finding rated Critical or High severity. That work covered programmatically associated form labels, validation errors that announce themselves to assistive technology, color contrast across the interface, focus management in dialogs, and a skip-to-content link on every page.

• Verified by hand, not just by scanner

  Automated tooling (axe-core and static JSX linting) runs against the product, but automated scanning alone catches only a fraction of real barriers. Our fixes were confirmed with real keyboard-only navigation, live browser testing, and screen-reader testing — the checks that actually establish whether a control can be reached, operated, and understood.

• Accessible documents, not just accessible screens

  The compliance reports and audit packets the portal generates carry document language, title metadata, tagged structure, table header scoping, and alternative text for images — so the artifacts you hand to your own auditors are usable too.

• Tracked in the open, internally

  Remaining lower-severity items are documented in a living audit record with severity, affected surface, and the specific WCAG success criterion at issue — rather than being closed out and forgotten. Accessibility checks are part of our normal development workflow, not a one-time project.

• We want to hear about barriers

  If you encounter a barrier anywhere in the portal, please tell us — reports from real users are the most reliable signal we get. Email support@liftnow.com with the page and what went wrong, and we will respond with a remedy or a timeline.

What we are not claiming: Liftnow has not completed an independent third-party accessibility audit, and does not hold an accessibility certification or publish a VPAT / Accessibility Conformance Report. The work described above is remediation to the WCAG 2.1 AA standard, internally verified. We would rather tell you exactly where we stand than claim a conformance status we have not earned.

The portal holds equipment records, inspection history, and compliance documentation for multiple customer organizations on shared infrastructure. Keeping that data separated and correctly gated is the security property that matters most, and we work at it proactively — actively looking for gaps in our own access-control logic rather than waiting for something to surface.

• Organization-level data isolation

  Every read and write is scoped to the requesting user's organization at the server boundary, so one customer's data is never reachable from another customer's session. We treat access-control logic as a standing audit target: we periodically re-review the isolation checks and admin gating paths specifically looking for gaps, rather than assuming the original implementation still holds as the product changes.

• Role-based access control

  Users hold explicit roles — owner, manager, or technician — that determine what they can see and do, and technicians can be further restricted to specific facility locations. Permissions are enforced on the server for both page loads and API calls, not merely hidden in the interface.

• Gated administrative access

  Liftnow staff tooling sits behind a separate, explicitly granted super-administrator authorization that is independent of email domain or ordinary account role. The gate fails closed: if it cannot positively verify authorization, access is denied.

• Administrative lifecycle controls

  Organization access can be suspended and reactivated immediately. A suspension takes effect across both the web interface and the API, so access can be cut off in one action if an account needs to be shut down.

• Secure infrastructure practices

  All traffic is served over HTTPS/TLS. Data is encrypted in transit and at rest, third-party integration credentials are encrypted at rest with AES-256-GCM, and API endpoints are rate limited. Security review is integrated into our ongoing development workflow as a continuous process — every change is reviewed with these concerns in mind, not audited once and set aside.

What we are not claiming: Liftnow does not currently hold SOC 2, ISO 27001, or any other formal security certification. This page describes our engineering practices and our diligence, not an attested compliance status. If your procurement process requires a security questionnaire or documentation of specific controls, we are glad to complete one.