Everything Proof does, in the order you’ll use it.

Point Proof at a website and it discovers every linked PDF: resumable breadth-first crawl, robots.txt respect, per-host politeness, crash recovery. Findings are reviewed, then imported. Most tools wait for you to upload files — Proof goes and finds them.

Staged multi-file dropzone: drop files, set Collection, tags and language, upload. Multi-file drops auto-create a Collection; exact duplicates are deduplicated by content hash.

Paste one URL or a list. Hardened background fetching (HTTPS-only, SSRF guards, size caps), per-item status that survives reloads, retry and cancel. Language auto-detected.

Upload a .zip of PDFs — up to 500 MB / 1,000 files — extracted and run through the same ingest path.

Priority lanes keep interactive work responsive while a 3,000-document import churns; a completion email tells you when the corpus is fully analyzed.

Every import — crawl, upload, URL, zip — lands in one hub inside the Library with per-batch status. Documents you already hold are re-checked against their source and refreshed when the published copy changes.

A three-column workspace: status lenses with live counts, a feed grouped into priority bands a remediator actually works in (needs-you-now, quick-wins, in-flight…), or a dense table view.

Every document carries its triage signals: tri-state verdict, fail count, blocker kind, % auto-fixable, estimated hours. Hover for a full-size peek.

Three organizing primitives plus computed facets (image-only, has-table, untagged, 25+ pages). Bulk tag, assign, archive, and bulk auto-fix.

Every fix or re-upload mints a new version; the source is never overwritten. Per-version download and report regeneration.

One-click export of the corpus state, honoring the live filter and sort — feeds your own reporting.

One document, every address: Proof records each URL where a document is published, rolls publication state up per address, and surfaces drift and stale publications on the admin Source Integrity dashboard.

Source-integrity sweeps on a cadence you set — daily, weekly, or monthly: every publication address re-checked and drift surfaced in a digest. Refreshing a drifted certificate stays a human-confirmed step.

Every document checked against a WCAG 2.1 AA rule profile built on veraPDF 1.30.1 — the validator auditors use — plus Ockem’s own detectors. Runs at ingest and after every fix.

Image crops of the offending figure, extracted OCR text, per-page reading-order flags, per-run color-pair analysis. You always see why a rule fired.

Compliant (green), Needs review (amber), Failed (red — confirmed violations only). A document awaiting human review is never called failed.

The contrast detector suppresses text hidden behind full-bleed artwork — a false-positive class other checkers hand you raw.

Long operations stream page-by-page progress — “Tagging page 12 of 84” — as one continuous task.

Exposure KPIs, remediation-path lanes, a live effort calculator (hours → FTE-weeks), per-criterion WCAG scorecard, analytics CSV.

Structure and tagging, tables, text and language, visual contrast, links and forms — deterministic fixers covering the mechanical majority of findings.

One action runs every safe applicable fixer, re-verifies with the rule engine, and commits only if the verdict improves — one new version, per-fixer history.

Contrast reframed as 2–3 decisions instead of 550 findings; reading-order review with numbered overlays on flagged pages only; scan-confirm-dismiss queues for figures and artifacts.

On documents with no structure tree, Proof routes you through tagging first instead of letting fixers silently no-op. No fake progress.

Judgment criteria are cleared by named, attributed attestations that flow onto the certificate. An attestation can never override a machine failure.

Documents whose source content is unrecoverable get a “needs re-authoring” advisory and an escalation path — never an infinite retry loop.

Mark header rows and columns, set scope, author grids the detector missed — even when the table is only a picture, via region OCR — every edit guarded by a live re-check that aborts anything that would fail a new rule.

A vision model drafts alt text with the figure crop beside the draft; a human approves or edits in a review queue before anything is written.

LLM-drafted table summaries and title suggestions when the title is missing or just echoes the filename — human-reviewed, always.

Models run self-hosted on the platform. Customer documents don’t leave for a third-party model by default — a decisive answer for government and healthcare security reviews.

The structure-tree auto-tagger is benchmarked across six dimensions; changes ship only with zero compliance or safety regression. One pass was built and deliberately not shipped because the gate caught a regression.

A four-hour production soak at 1,000 documents/hour of analysis load finished with zero failures and zero lost documents across ~18,700 jobs — including through a full production redeploy mid-run.

A corpus momentum funnel, a computed next-best-move card, one-click program runs, and an activity feed with outcome deltas.

Named programs scoped to the corpus, a folder, or a filter: Baseline Auto-Remediation, Metadata Sweep, Auto-tag, OCR, AI-Assist. Programs converge — re-running picks up only new or changed documents.

Draft queues (accept/edit/reject AI suggestions) and attest queues (confirm human checks), sorted by completion leverage — “N documents are 1 check from Compliant” — with keyboard shortcuts.

Token-bucket rate limits and priority lanes: another tenant’s 3,000-document batch can’t slow your interactive work. Covered by required-pass cross-tenant isolation tests.

Every document moves through an explicit status flow — claimed, in review, escalated, approved — with the approve action gated so a document sitting in amber or red can never be signed off. The gate is the product.

Contrast decisions, reading-order review, figure scan-confirm-dismiss, AI-draft accept/edit/reject, and human attestation each run as a dedicated queue — sorted by completion leverage (“N documents are one check from Compliant”), keyboard-driven, with a live burn-down.

Pull a document to yourself to work it, escalate an unrecoverable source for re-authoring instead of looping forever, and approve only once every check — machine and human — is resolved.

Per-document comments and a full status history record who did what and when — the review conversation and the audit trail live on the document, not in a folder of emails.

Configurable review gates enforced at the approval transition — org-wide or overridden per folder — plus teams with per-user library access, managed from the Tenant Admin console.

Rule-based routing of incoming documents to a person or team, with assigned work leading each member’s feed.

Every approved document ships with a rendered accessibility report: tri-state verdict and seal, per-criterion results, original→delivered comparison, and the named attestation record — stamped with your organization’s logo. N/A is rendered honestly — never a vacuous green.

Every certificate carries a QR code resolving to a public verification page — an auditor or constituent can confirm a certificate is genuine without trusting the attachment.

Machine checks + named human attestations + a pessimistic gate: a document is never certified while any check is unresolved. Automated + attested — never “fully automatic.”

A document status state machine with claim, escalate, and approve actions, status history, and per-document comments. Amber and red both block approval.

Remediated PDF + certificate via expiring links that re-issue on demand — a saved export never rots. Bulk ZIP assembly parallelized for 200+ document deliveries, tracked in an org-wide Downloads manager.

Every query is org-scoped in the application and enforced by PostgreSQL Row-Level Security underneath — fail-closed, covered by required-pass CI tests.

One global identity, multiple organization memberships, Google SSO, optional TOTP two-factor, a workspace picker for people who belong to several orgs.

Self-service admin for org owners: people and roles, teams and access grants, workflow review gates, security policy, audit activity, API keys and webhooks.

Org-prefixed object storage, presigned expiring download links, structured logging, nightly backups. Trial documents deleted after 30 days.

Scope a library, an import or a crawl to a project — run several sites, districts or clients under one organization without them bleeding into each other. Each member returns to the project they were last in.

Bearer-token API keys — hashed at rest, org- and role-scoped, covered by the same row-level security.

A document-pack purchase provisions the organization, admin identity, and prepaid document balance — no sales call required.