- Q01Has Bubble ever published a VPAT or WCAG conformance statement?
- No. Bubble does not publish a VPAT, an ACR, or an accessibility statement for the platform itself. Neither WCAG nor ADA appears on the 'Other frameworks' page or in the security and compliance docs. The position has been silent for the entire history of the product. Accessibility lives entirely on the developer side, and the burden of proof for procurement attaches to your app.
- Q02Will an accessibility plugin or overlay solve WCAG on Bubble?
- No. Accessibility overlays are now a documented liability rather than a solution — 25% of the 4,187 digital-accessibility lawsuits filed in 2024 (UsableNet 2024 Year-End Report) explicitly cited overlays as barriers. Plaintiff firms know what they look like, and procurement teams have seen enough of them to discount their value. The DOJ rule is about the underlying markup, not a script that sits on top.
- Q03What does the hybrid actually look like in practice?
- You rebuild the public-facing pages and any surface that procurement gates on accessibility as a Next.js frontend, using accessible primitives like Radix UI or React Aria. Internal tooling, admin views, and lead-capture flows can stay on Bubble — they're not in scope for the VPAT. The ACR covers only the rebuilt surfaces and explicitly scopes them.
- Q04How long does a WCAG-friendly frontend rebuild take?
- Eight to sixteen weeks for a typical mid-complexity product. Two weeks for design system and accessible component primitives. Four to six weeks for the main public surfaces. Two to three weeks for forms and dynamic flows. The final stretch for the manual audit, remediation, and ACR sign-off. Automated axe checks land in CI alongside the work so regressions don't sneak back in.
- Q05Does WCAG overlap with SOC 2, HIPAA, or any other framework in the cluster?
- Mostly no. WCAG is orthogonal to the data-protection and infrastructure standards. The exception is procurement — many state, university, and large enterprise procurement processes ask for a VPAT alongside the SOC 2 report and the DPA. The standards live on different axes (frontend semantics versus backend controls), and the VPAT is a different artefact from the SOC 2 report or BAA.
- Q06Can you sign a VPAT / ACR with us?
- Yes. We deliver a real manual VPAT / ACR against WCAG 2.1 AA for the surfaces we rebuild, with a documented testing methodology (screen readers, keyboard-only, contrast, automated axe in CI). The ACR is signed by the engineering lead and is scoped to the surfaces we rebuilt — not blanket statements that fail under scrutiny.