Indigo Trust

https://indigotrust.org.uk · 35/92 checks passed · not_for_profit

Compliance report (framework 0.8)

Gate passed (every Core check must pass) · not counted towards the gate: paused 35, draft 48, ready for review 54.

Site level: 0 (no scored checks yet).

By level

Level	Result
Level 1 — Basic	23/37 (10 failed)
Level 2 — Enhanced	2/27 (4 failed)
Level 3 — Advanced	0/10 (6 failed)

By category

Category	Result
Accessibility	10/13
Accountability	0/5
AI & Automation	2/8
Interoperability	0/3
Privacy	8/16
Provenance	0/2
Security	5/11
Transparency	0/13
Responsibility to the Future	0/3

Level 1 — Basic

Accessibility

FAIL Keyboard navigability

No focusable elements detected on the page.

FAIL Skip navigation link present

PASS WCAG 2.1 Level A automated testing

PASS Valid semantic HTML structure

PASS Text alternatives for images

PASS Decorative images properly marked

PASS Proper heading hierarchy

PASS Sufficient colour contrast

PASS No auto-playing media without controls

PASS Media elements have controls

AI & Automation

FAIL No undisclosed AI-generated content

human_or_disclosed: The page returns a 403 Forbidden error with no accessible content, so authorship or AI disclosure cannot be verified.
Fix: Restore access to the page and include a clear statement about whether content is human-authored or AI-assisted.

FAIL Dedicated AI policy page exists

Not found at any of: /ai-policy, /ai.

SKIPPED AI use policy in place

Skipped: Target page not found in captured content

PASS AI content disclosure in metadata

PASS robots.txt AI crawler rules

Privacy

FAIL Data-leaking third-party services

Detected 2 data-leaking services across 1 category: google fonts (fonts.googleapis.com, fonts.gstatic.com).

PASS No third-party tracking scripts

PASS No third-party cookies

PASS No fingerprinting script patterns

PASS No behavioural or targeted advertising scripts

PASS First-party cookies functional only

PASS Session cookies only

PASS No hidden iframes or tracking beacons

PASS No tracking pixels

Security

FAIL HTTPS enforced

strict-transport-security: header not set on the response.

FAIL HTTP to HTTPS redirect

Redirect chain (1 hops): https://indigotrust.org.uk

FAIL Referrer-Policy header

referrer-policy: header not set on the response.

PASS Security headers present

PASS Content Security Policy header

PASS No mixed content

PASS Valid TLS certificate

PASS TLS certificate not expiring soon

Transparency

FAIL Contact email present

Not found at any of: /contact, /contact-us.

FAIL Contact form present

Not found at any of: /contact, /contact-us.

SKIPPED Contact information present

Skipped: Target page not found in captured content

SKIPPED Statement of purpose present

Skipped: Target page not found in captured content

SKIPPED Funding/sponsorship disclosure

Skipped: Target page not found in captured content

Level 2 — Enhanced

Accessibility

PASS Mobile responsive design

PASS Form labels accessible

Accountability

SKIPPED Named responsible person

Skipped: Target page not found in captured content

SKIPPED Published response timeframes

Skipped: Target page not found in captured content

SKIPPED Documented complaints process

Skipped: Target page not found in captured content

SKIPPED Clear appeals process

Skipped: Target page not found in captured content

AI & Automation

SKIPPED Published AI use policy (detailed)

Skipped: Target page not found in captured content

SKIPPED AI-assisted content clearly marked

Skipped: Target page not found in captured content

SKIPPED Human oversight of AI documented

Skipped: Target page not found in captured content

Interoperability

FAIL RSS/Atom feeds present

No RSS/Atom feeds discovered.

SKIPPED Content in open formats

Skipped: Target page not found in captured content

Privacy

FAIL Cookie banner partner disclosure

banner_present: The page only displays a '403 - Forbidden' error with no cookie or consent banner visible.
Fix: Restore access to the page and ensure a cookie/consent banner is served on all pages including error pages if cookies are set.
partner_sharing_mentioned: No banner or consent copy is present, so no disclosure of third-party partner data sharing is made.
Fix: Add a consent banner that explicitly discloses any data sharing with third-party partners before non-essential cookies are set.
partner_count_specific: No partner sharing is disclosed and no numeric count of partners is stated on the page.
Fix: If partner sharing occurs, state the specific number of partners (e.g., 'We share data with X partners') in the consent banner.

SKIPPED Human-readable privacy policy

Skipped: Target page not found in captured content

SKIPPED Plain language data practices

Skipped: Target page not found in captured content

SKIPPED Data collection limited to necessity

Skipped: Target page not found in captured content

SKIPPED Published data retention periods

Skipped: Target page not found in captured content

SKIPPED No dark patterns in consent flows

Skipped: Target page not found in captured content

SKIPPED Advertising clearly labelled if present

Skipped: Target page not found in captured content

Provenance

FAIL Basic authorship metadata

No author or date metadata found on the page.

SKIPPED Authorship metadata assessment

Skipped: Target page not found in captured content

Security

FAIL security.txt published

security.txt not published.

Transparency

SKIPPED Named responsible person in contact

Skipped: Target page not found in captured content

SKIPPED Substantive statement of purpose

Skipped: Target page not found in captured content

SKIPPED Funding disclosed with detail

Skipped: Target page not found in captured content

SKIPPED Governance structure disclosed

Skipped: Target page not found in captured content

SKIPPED Algorithm explanation if applicable

Skipped: Target page not found in captured content

SKIPPED Annual data practices statement

Skipped: Target page not found in captured content

Level 3 — Advanced

Accessibility

FAIL Published accessibility statement

known_issues: The statement only vaguely says the site 'is a work in progress' and 'there is always more that can be done' without naming any specific accessibility issues or limitations.
Fix: List the specific known accessibility problems (e.g., failing WCAG 2.1 AA criteria, non-conformant pages or components) so users know what barriers to expect.
remediation_timeline: The statement offers no timeline or dated commitment for resolving accessibility issues, referencing only an aspirational 2025/26 WCAG 2.1 AA compliance goal without a concrete remediation schedule.
Fix: Add specific target dates by which identified issues will be fixed and commit to a review/update schedule for the statement.
feedback_channel: A feedback email (indigo@sfct.org.uk) is provided, but there is no stated commitment on how quickly the site owner will respond.
Fix: State a clear response commitment, such as acknowledging feedback within a defined number of working days.

Accountability

SKIPPED Published moderation policies

Skipped: Target page not found in captured content

Interoperability

FAIL Published uptime/status page

Not found at: /status

Security

FAIL Incident response plan published

plan_exists: The page covers governance, investment, safeguarding, DEI, and accessibility policies but contains no published incident response plan or security incident policy.
Fix: Publish a documented incident response plan describing how the Trust identifies, manages, and remediates data or security incidents.
notification_commitment: There is no commitment anywhere on the page to publicly notify affected users of significant security or data incidents.
Fix: Add an explicit statement committing to notify affected individuals and the public when significant incidents occur.
timeframe: The page states no timeframe for disclosing incidents to affected users since no incident response content exists.
Fix: Specify a concrete disclosure timeframe (e.g., notifying affected users within 72 hours of discovering an incident).

SKIPPED Responsible disclosure or bug bounty

Skipped: Target page not found in captured content

Transparency

SKIPPED Algorithmic decision criteria published

Skipped: Target page not found in captured content

SKIPPED Open source code or tech docs

Skipped: Target page not found in captured content

Responsibility to the Future

FAIL Environmental / sustainability disclosure

specific_metrics: The page contains no specific environmental figures such as carbon emissions, energy use, or measurable sustainability targets.
Fix: Publish quantified environmental metrics (e.g., annual carbon footprint, energy consumption, or emissions reduction targets) alongside the sustainability commitments.
hosting_disclosure: The accessibility and about sections mention the website but disclose nothing about the carbon or energy profile of its hosting infrastructure.
Fix: Add a statement disclosing the website's hosting provider and its carbon or energy profile, ideally noting use of green/renewable-powered hosting.

FAIL Succession and continuity plan

plan_exists: The governance page describes trustees, investment, DEI and safeguarding but contains no published plan for what happens if the organisation fails, winds down, or exits.
Fix: Publish a wind-down/exit plan describing how the Trust would cease operations, including timelines and responsible parties, on the governance page.
data_and_content_fate: The page does not address what would happen to user data or published website content in the event of the organisation closing.
Fix: Add a statement specifying how user data would be handled and whether website content would be preserved, transferred, or deleted upon closure.
custodians_or_mirrors: No custodians, mirrors, or archive partners are identified anywhere on the page for preserving content after an exit.
Fix: Name a specific custodian or archive partner (e.g., a web archive or SFCT successor entity) responsible for maintaining or mirroring the site's content if the Trust ceases operating.

FAIL Worker wellbeing policy

policy_exists: The page references an SFCT DEI Policy and employment practices but contains no published policy specifically addressing worker wellbeing or working conditions.
Fix: Publish a dedicated worker wellbeing or working conditions policy (or link to one) covering staff welfare on the About page.
accountability: The page names accountability for investment (Investment Committee) and safeguarding contacts but does not identify who is responsible for overseeing worker conditions or wellbeing.
Fix: Name a specific role, committee, or contact responsible for overseeing worker conditions and wellbeing and how staff can raise concerns.