Compliance

This document discusses the following aspects of OneSpan Sign's compliance with accessibility standards:

• Our Commitment

• Steps Taken to Comply

• Accessibility Conformance Reports (VPAT)

• External Audits

Our Commitment

OneSpan is committed to providing best-in-class electronic signature services that are accessible to people of all abilities, including blind and visually impaired signers. The company currently does this by complying with the Web Content Accessibility Guidelines of WCAG 2.0 Level AA.

Accordingly, our OneSpan Sign product has an Accessibility Support component that enables blind and visually impaired signers to review and click-to-sign PDF documents that are presented in a supported browser.

Because OneSpan Sign is compliant with WCAG 2.0 AA , it automatically complies with many local regulations. Among those are the following:

• US ADA

• US Section 508

• Canadian Standard on Web Accessibility

• Ontario AODA

• Quebec SGQRI 008

• ISO/IEC 40500

Our teams are working to finalize compliance with the latest WCAG 2.1 AA standard. When that is achieved, OneSpan Sign will be fully compliant with the following additional regulations:

• European Directive (EU) 2016/2102

• French RGAA

Steps Taken to Comply

To facilitate OneSpan Sign's compliance with WCAG guidelines:

• OneSpan hired a full-time Subject Matter Expert in Web and mobile accessibility.

• The teams have been trained in Web accessibility.

• A full audit is run every year.

• The QA team performs the following manual accessibility tests: (1) tests of new features during the development process; (2) tests of new releases, based on the new features; (3) regression tests of OneSpan Sign's multiple Production environments; (4) regular exploratory tests.

• Daily automatic regression tests are run using Lighthouse and aXe.

• Colors are tested using the Color Contrast Analyser.

• OneSpan Sign is tested for low-vision users using ZoomText.

• Occasionally, specific criteria are tested using Web Developer Toolbar, aXe, NoSquint and Stylish.

• When bugs are identified in a Production environment, they are assessed and prioritized. They are recorded in OneSpan's tracking system, and are tracked until they are resolved.

The above tests are conducted by evaluating OneSpan Sign's Signer Experience in English and French for all supported (screen reader, browser) combinations.

OneSpan Sign supports the (screen reader, browser) combinations listed below. Their selection was based on the results of the most recent WebAIM survey.

Desktops & Laptops

• JAWS with Chrome (PC)

• JAWS with Edge (PC)

• NVDA with Firefox (PC)

• NVDA with Chrome (PC)

• VoiceOver with Safari (Mac)

Mobile Devices

• VoiceOver/iOS with Safari (iPhone)

• Talkback/Android with Chrome and Firefox (Smartphone)

We regularly update each screen reader and browser in the above lists, and usually support a product's two most recent versions.

Accessibility Conformance Reports (VPAT)

OneSpan provides an Accessibility Conformance Report (based on VPAT^® Version 2.4 Rev - WCAG Edition), which is updated for every release of OneSpan Sign.

The most recent reports were created by testing the English and French versions of the Signer Experience in OneSpan Sign's 11.50 release. Those reports can be accessed by clicking Accessibility Conformance Report for WCAG 2.0 and Accessibility Conformance Report for WCAG 2.1.

External Audits

If you want to run an external audit of OneSpan Sign, please follow these guidelines:

• Don’t use automatic tools. They generate many false positives, which waste everyone's time.

• Inform your tester about the context in which tests will occur (e.g., testing the Professional Edition of OneSpan Sign in a well-defined environment).

• Provide a fully accessible PDF document, as described in the section Creating an Accessible PDF. Also identify the tester who created the PDF, so they can be consulted if necessary.

If your auditor thinks they have found a bug, please send OneSpan a detailed report with:

• A description of the bug, including its context

• A description of the steps needed to reproduce the bug

• Relevant screenshots of the Signer Experience

• Screenshots of any relevant code

• The exact URL of any relevant webpage

• Any other information that might be helpful

Every year, OneSpan runs a full internal audit of OneSpan Sign.