Procurement pack

Every document

Six columns, and the one that decides whether this page is worth anything is Dated. A procurement pack whose security overview might be two years old is worse than none, because it is a written representation to a government buyer that has quietly stopped being true. A Voluntary Product Accessibility Template (VPAT) produces an Accessibility Conformance Report (ACR), and both names appear in the first row because a compliance reviewer looks for them there.

A row with a date is a document you can open now. A row without one is a document nobody has written, and it says so in the row rather than reading “current” or “available on request”. There are 8 of the second kind, and each one names what answers your question today.

One archive

Download the 6 published documents (ZIP, 37 KB)

barrierops-procurement-pack-v7-2026-10-23.zip

• Every document carries its date on the line under its title. A section of our security page carries the day that page was last reviewed. The subprocessor list and the US data residency statement are generated from our subprocessor register, so they carry the day the pack was generated.
• MANIFEST.txt lists every other file in the archive with its date and its SHA-256 hash, so you can show your auditor that the copy in your file is the copy we published.
• README.txt names the pack version, the generation date and the address of this page, and lists the 8 documents that are not published yet.
• The pack is regenerated whenever any document in it changes, and the version number goes up by one.
• The subprocessor list is in it twice: as a web page, and as a CSV file that opens in a spreadsheet.

The archive is a convenience, not the mechanism. Every published document is reachable on its own from the table above, because a purchasing office usually needs three of the fourteen and should not have to unpack all of them to get one.

Vendor information you can copy

These are the fields that go into a vendor master record, and each retyping is a chance to get a digit wrong. Where a value is not published yet the row stays, so the list is still the checklist of what to ask for. Who we are, and how the company is set up, is on our about page.

Legal entity name

Not published yetAs it must appear on a purchase order. It comes back with your quote, in writing.

Doing business as

BarrierOps

Entity type and state of incorporation

Not published yet

Employer Identification Number (EIN)

Not published yetThe W-9 is the authoritative copy.

Unique Entity ID (UEI)

Not published yetSAM.gov registration is not complete, so there is no UEI to quote.

CAGE code

Not published yetIssued with the SAM.gov registration.

NAICS codes

513210 Software Publishers · 541511 Custom Computer Programming Services · 541512 Computer Systems Design Services · 541519 Other Computer Related ServicesNot yet confirmed against our own registration. Tell us which code your vendor record needs and we will confirm it in writing before you file it.

Remit-to address

Not published yetThe same postal address that will be printed on the W-9.

Payment methods

ACH or check. Remittance details are printed on every invoice. No card is required and no card is stored.

Payment terms

Net 30 by default. Net 45 and net 60 on request.

Contract term

12 months, paid in advance, invoiced against a purchase order

Currency

US dollars

Procurement contact

procurement@barrierops.com

Accessibility contact

accessibility@barrierops.comMonitored by a person.

If your state or entity requires vendor registration in a portal before a purchase order can be raised, tell us which portal. We register at no charge and it is normally done within one business day.

Our own accessibility conformance report

In several states a compliance reviewer reads this before technical evaluation begins, which is why it is the row that decides the review rather than one of fourteen.

Our conformance report is not published yet, and neither is our accessibility statement or our dated remediation plan. No run of the assistive-technology matrix has been completed, so there is nothing to generate one from and we will not generate one from a scanner. If a conformance report is a scored component of your solicitation — several states score it — ask us for the current state before you score it rather than after.

These are the rules the report will be written to. They are also the test you can apply to every other vendor’s report, including the ones you are comparing us against:

• It will be generated from a completed manual test run, not from a scanner. Automated testing reliably evaluates a small minority of the criteria, and a report generated from one is not a conformance claim.
• Eight flows will be tested and the report will name them. We will not test “the whole application” and we will not say we did.
• Every entry that is not “Supports” gets a dated remediation plan entry: the criterion, what fails, and a target date. A report with “Supports” on all 50 criteria reads as untested.
• It will state the date it was evaluated and the product version, and it will say that it does not certify ongoing conformance.
• The HTML is canonical and will itself conform to WCAG 2.1 AA. An inaccessible accessibility report is the most embarrassing artifact a vendor can publish.

What you can do instead is test us. This site and the product are built to be keyboard-tested and screen-reader-tested by the person scoring the bid, you do not need our permission, and we would rather you did it before the demo than after.

It will be published at /vpat, which does not resolve today. Our own accessibility posture — what runs on every push, and what a person still owes — is on the about page.

Security and data residency

Not repeated here. Two copies of a security statement is two things to keep current and the second one always rots, so this page links the one that is maintained and takes its dates from it.

• The two stores that will hold customer data are both in the United States. The database is Vultr Managed PostgreSQL 18 in New Jersey, a region we last verified on 16 September 2026. Object storage is a Cloudflare R2 bucket created in the US jurisdiction, which we last verified on 1 October 2026.
• The R2 jurisdiction is fixed when the bucket is created and cannot be changed afterwards, and it is not a location hint. Our own code refuses to start against a bucket outside it, which makes this the one residency control you can verify by reading our source rather than by believing us.
• 11 providers are named in the register, each with its purpose, the customer data it can reach, its region and the date that region was verified, whether its own attestation has been obtained, and whether it is engaged today.
• We hold no credential that can sign in to your site, and we scan public pages only.
• The full security page is the source every security row in the table above points at. There is no second copy of it on this page that could disagree with it.

Business continuity

• Automated backups of the production database are taken by the managed database provider, in the same account and the same region as the cluster.
• A second copy at a different provider is set up and not running yet: its bucket exists, in the US jurisdiction, and stays empty until the server that writes the nightly copy is deployed. Until it runs, a failure that took the provider account would take the backups with it, and we would rather you read that here than discover it in an incident.
• We publish no Recovery Time Objective (RTO) and no Recovery Point Objective (RPO), because we have not yet exercised a recovery against production. The restore test has run once, on a local copy, and that is not the same evidence. When the first production restore runs, the date, how long it took and what it recovered are published on this page — including the parts that did not go well.

A recovery target nobody has exercised is a number, not a control. If a vendor shows you one with no date beside it, that is a fair thing to ask them about — including us.

Getting your data out, and deleting it

A vendor who answers this early wins the question, and the honest answer names which parts are built.

• The evidence ledger is hash-chained, and the chain verifies with your own tools. It does not depend on us being here for you to check it, which is the point of building it that way.
• Any member of an organisation can export all of it as one archive, from Data, exports and imports in the organisation’s settings, with no support ticket. The archive is JSON: every asset’s issues, occurrences, documents, scan history and evidence ledger with its hashes, plus vendor products, the audit trail and every finished report. Deleted assets are not in it.
• Deleting an asset marks it deleted and removes nothing: its pages, documents and issues are retained, and the deletion can be undone by us.
• Evidence is never deleted automatically, never by cascade, and never as a side effect of deleting an asset. Deleting it at all requires written instruction from an organisation owner.
• Account deletion as a documented process — a grace period, a final export, a written confirmation — is not built and not written down yet. Ask for the contract term instead; we will send you the clause before you sign.
• There is no exit fee, no data-retrieval fee and no charge for the export.

Insurance

Errors and omissions (E&O) and cyber liability are the two certificates a solicitation normally asks for. Neither is published here, and the table above says so on its own row.

Limits vary by solicitation. Commonly requested is $1,000,000 per occurrence and $2,000,000 aggregate. No certificate is published here, so this page quotes no limits of its own. Tell us what your solicitation requires and we will tell you in writing what can be in place and by when, before award rather than after it.

We name your entity as an additional insured on request, at no charge, once a policy is in force.

Quote and contract

• A one-page quote, returned the same business day. What we need: your entity’s legal name as it appears on a purchase order, the billing contact, the website address, and a purchase order number if your policy requires one on the quote.
• We will sign your paper. Tell us which clauses you cannot move and we will tell you the same day whether we can accept them.
• We supply the facts. Whether they justify a sole source is your purchasing officer’s determination, not ours, and the template says so on its face.
• The published price is on the pricing page and it is the same price in the quote. There is no procurement discount and no list price we quietly discount from.

The line-item vocabulary is fixed, and it is the part of this section that costs somebody an afternoon when it is wrong: a clerk matches the quote line to the invoice line to the contract line, so an invented shorthand on any one of the three has to be reconciled by hand.

• BarrierOps Platform — Standard edition · Annual subscription
• BarrierOps Services — Accessibility Audit · Up to 10 representative templates

The editions are Starter, Standard, Professional, Portfolio and Enterprise, and the published price for each is the price in the quote. The Standard edition is the one the first example names. The services are these seven and nothing else:

• Accessibility SnapshotThe lead-in assessment: 3 to 5 important pages.
• Accessibility Audit
• Comprehensive Accessibility AuditEvery page in scope rather than a sample of templates. The scope is written into the quote line, because a scope that is not on the line is a scope nobody can hold us to.
• Remediation Services
• Document Remediation
• Retest & VerificationWe verify that a named person checked a named criterion by a named method, for a stated scope. Nobody issues a certificate and we do not imply one.
• Program Review

Buying through another agency’s contract

Every contract we sign carries the clause Other public agencies may purchase under the same terms. — it costs nothing, and it turns each customer into a shortcut for the next.

Piggybacking authority is state-specific and it is contested. Washington requires an interlocal agreement on file and the host to have advertised the solicitation online; New York requires the awarding government to have made the contract available through contract terms, not merely by the vendor offering it, and it does not apply to public works. A 2026 decision held that piggybacking on another government’s contract was not a substitute for competitive bidding in that case. Ask your own counsel. This is not procurement advice.

At $2,400–18,000 most buyers do not need any of this — the price is under every direct-purchase threshold we have checked. The thresholds table is on the pricing page with the date it was checked.

What we do not have

• SOC 2 Type II report — Not audited. We will not claim it before the report exists.
• GovRAMP or FedRAMP authorisation — none, and no application in progress.
• GSA Multiple Award Schedule — not held.
• A state term contract or cooperative agreement — none yet. We will pursue one where a customer needs it, and we will say plainly that it does not exist today.
• A reseller or distributor — none. You buy from us directly.
• An ISO 27001 certificate — not held.
• A completed Higher Education Community Vendor Assessment Toolkit (HECVAT) answer set — not written yet. Send us yours and we will fill it in.
• A third-party penetration test — not yet commissioned. It is scoped and it runs before the first customer’s data enters the system.

If your policy requires any of these, tell us now rather than at contract stage. We would rather lose a deal in week one than discover it in week nine.

Questions purchasing offices ask

Something a purchasing office asks for that is not on this page is a missing row rather than a question. Write to procurement@barrierops.com or use any address on our contact page, and we will publish it rather than send it to you privately.