Agentic remediation and evidence for online stores
Fixes your developers merge. Evidence you can hand to anyone.
HexCore scans your store, opens pull requests for the accessibility defects it can fix deterministically, inventories every script running on the pages that lead to checkout, and records all of it in a hash-chained ledger anchored to RFC 3161 timestamps and the Bitcoin blockchain.
We scan with your permission, not before. A scan is a few public pages, fetched by a crawler that identifies itself and obeys your robots.txt.
360
new ADA web accessibility lawsuits filed in September 2026 alone; 91 of the defendants were running an accessibility widget when sued. UsableNet tracker
44%
of Q1 2026 ADA website suits named stores on Shopify — 459 of 1,037 cases. EcomBack Q1 2026
95.9%
of the top one million home pages had a detectable WCAG failure in 2026, reversing six years of improvement. WebAIM Million via accessibility.build
How it works
Four steps, each one recorded.
The product is built around a rule: when we are not sure, we abstain and say so. An unmerged guess costs you an engineer's afternoon and teaches them to ignore the next one.
You ask, we scan
Home, category, product and cart pages, rendered in a real browser so runtime-injected scripts are seen, not just source. axe-core rules for accessibility; a full script register for checkout integrity.
Pages your robots.txt disallows are skipped and listed as skipped. Checkout itself is scanned only on your written instruction.
Fixes arrive as pull requests
For the defects with one correct answer — a contrast ratio, a missing label — we locate the file in your repository and open a PR with the measured before and after. Your review is the control. We never merge our own work.
Repository access is one scoped token you grant and can revoke in one click. Contents and pull requests, nothing else.
Every script, inventoried
Each third-party host on the pages leading to checkout: how it was delivered, whether it carries integrity hashes, what it is for. Written in the form an assessor asks for under PCI DSS 6.4.3 and 11.6.1.
Whether those requirements apply to your checkout depends on how it is built. The pack says which case you are in rather than assuming.
Recorded, then anchored
Every scan, finding, patch and outcome is appended to a hash-chained ledger. Each run is committed to a Merkle root, timestamped by an RFC 3161 authority and submitted to the Bitcoin blockchain. You get an inclusion proof per entry.
A broken chain is never repaired. It is disclosed and appended to.
What we never claim
We do not sell a verdict. We sell fixes and the record of them.
- ✕A verdict on your legal standing. Whether a site meets the ADA or qualifies for a given PCI questionnaire is decided by courts, acquirers and assessors. We measure and fix; we do not adjudicate.
- ✕That automated fixes are enough. Most accessibility findings need a human decision about your markup. We fix the deterministic ones and tell you which the rest are.
- ✕That an overlay or widget helps. We do not install one. A quarter of 2026 lawsuits named sites already running one.
- ✕That the ledger proves you did the right thing. It proves what was observed, when, and that nothing has been altered since. That is all a record can honestly do, and it is a great deal.
Every piece of outbound copy, this page included, is run through an automated linter that refuses the vocabulary of promised outcomes — the four words a vendor reaches for when it wants to sell a result it cannot deliver. We adopted that rule after the FTC's 2025 order against an overlay vendor for exactly those claims. FTC press release
Evidence
What a record looks like.
These are real entries from our own ledger: the first scan we ever ran, anchored on 20 September 2026. Each entry carries the hash of the one before it, so changing any entry breaks everything after it.
The 44 entries of that run were committed to one Merkle root. A public timestamp authority signed it at 17:00:10 UTC, and the OpenTimestamps calendar committed the same root into Bitcoin block 967,911. Anyone can verify either without trusting us.
Clients receive the inclusion proof for every entry about them, and nothing else — the ledger holds hashes and events, not your source code.
chain verified · 119 entriessha256 · append-only
seq1
ts2026-09-20T16:59:20Z
client.created
prev0000000000000000000000000000000000000000000000000000000000000000
hash3efa385879dbf3b64c1c298b44648047a2899d1c1cea4c1433219a5eae199cf5
seq44
ts2026-09-20T17:00:10Z
scan.finished
prevc4589a0f0b616eb91d7dfb56ee6cf3f5559d634fb7e4803f4c2c1f47ade0b237
hashd0fe2e8c976b405ba44f193090672c63ab312b919b4aa552da84ae4b8c86139c
rootd866d0fd49dff99a636f058c8730b3c74b60beb4b294bc58b9db4f461a1d7896
merkle root over seq 1–44
RFC 3161timestamped Sep 20 17:00:10 2026 GMT · freetsa.org
Bitcoincommitted in block 967911 · OpenTimestamps
Pricing
Priced per store, per month. No contract longer than the work.
Two things are for sale — fixes and evidence — and you can buy either without the other.
Monitor
$0/ month
- Monthly scan of five funnel pages
- Accessibility findings with rule references
- Third-party script count
- Ledger entries, no proofs
Remediate
$800/ month
- Everything in Monitor
- Deterministic fixes as pull requests
- Human-decision findings itemised for your team
- Merge outcomes tracked
Attest
$1,600/ month
- Everything in Monitor
- Full script register with justifications
- Checkout-model determination
- Inclusion proofs, RFC 3161 and Bitcoin anchors
Bundle
$2,200/ month
- Remediate and Attest together
- Fixes recorded in the same ledger as the evidence
- Quarterly evidence pack for your acquirer or counsel
- Priority on new fix rules
Agencies and platforms: channel pricing is negotiated. One-off audits run $2,500–5,000. Every plan can be cancelled at the end of any month; your ledger proofs stay yours.
Security and data
Posture enforced by checks, not asserted in prose.
The honest inventory of what we hold and what we deliberately do not. The security review that precedes a repository grant usually starts here.
HELD What we keep
- Storefront URLs, page titles, and a SHA-256 of each rendered page — not the page
- The markup of the specific elements that failed a rule, a few hundred bytes each
- Third-party script hosts, delivery method and integrity status per page
- Repository name, branch, PR number and commit SHA for each delivered fix
- The hash-chained ledger and its anchor receipts
NOT HELD What never enters the system
- Cardholder data of any kind — we observe what a page loads, never a payment
- Logged-in sessions, carts, orders or customer records
- Store admin credentials — access is one scoped token you can revoke
- Full page copies or screenshots of your site
- Your source code — read to locate a fix, never retained
Fourteen automated posture checks run before every commit and on demand: file modes, secrets outside source and process arguments, bind-address refusal without a token, webhook signature verification, claim language, incident plan currency, anchor freshness. python -m hexcore audit prints the result. An incident-response plan exists whose first scenario is a merged patch that broke a store, because that is the incident this business actually has.
One human running a company of AI agents, with a ledger that keeps all of us honest.
HexCore operates from San Jose, California. The scanning, patching, inventory and anchoring are done by software agents; the judgement calls, the merchant conversations and the responsibility are one person's.
That structure is why the ledger exists. An agent that can write code into your repository needs a record of what it did that neither it nor its operator can quietly edit. We built that record first and the product around it.
Get started
Tell us the store. We will ask before we look.
Send the storefront URL and, if you have one, the name of whoever reviews pull requests. We reply with a scope — which pages, which rules, what we will and will not touch — and scan once you say yes.
hello@hexcore.us