Accessible, GDPR-compliant website monitoring for public authorities
Public portals must be accessible, available and demonstrably secure — and their data belongs in Germany. XICTRAQ bundles accessibility checks, availability, security, status pages and evidence reports in one platform hosted in Germany.
- 1 Accessibility (WCAG / BITV 2.0)
- 2 Data residency in Germany
- 3 Availability of citizen portals
- 4 SSL, security headers, DNSSEC
- 5 Evidence for audit & oversight
Accessibility as a legal obligation — in detail
For websites and apps of public bodies, digital accessibility is not a voluntary improvement but a legal requirement. Equal-opportunity laws have for years obliged administrations to make their online services accessible in line with the relevant technical standard. Recent accessibility legislation additionally brings the topic into sharper focus for many affiliated services, public enterprises and municipal companies — the legal classification in each case remains with you.
In practice, accessibility is not a one-time state but a moving target. Every content change, every new form and every lazily loaded module can create barriers: missing alternative texts for images, insufficient colour contrast, unlabelled controls or keyboard navigation that leads nowhere. A typical scenario: a press office adds a news item with an embedded PDF, the preview image is left without a description — and a barrier has arisen that the next manual audit will flag, yet went unnoticed for weeks.
This is exactly where continuous checking comes in. XICTRAQ examines the monitored page automatically against the technically measurable WCAG criteria and shows violations, their severity and the score history over time. After a relaunch the next run shows which violations the page currently has and whether the score rose or fell, instead of you learning it only at the next audit. It remains important that an automated check covers only the machine-detectable aspects and does not replace a full accessibility audit with manual review. It does, however, provide a robust pre-check and a factual basis for the accessibility statement.
Data in Germany as a procurement criterion
Hosted in Germany, processing within the EU, one data processing agreement under Art. 28 GDPR — no US sub-processors, one documented processing location for the whole platform.
Where a monitoring service processes its data is rarely a side note for the public sector. In tenders and procurement documents the processing location is regularly used as a suitability or award criterion, and data protection officers scrutinise exactly which sub-processors are involved and in which country they reside. XICTRAQ is hosted in Germany, processing takes place within the EU, and a data processing agreement under Art. 28 GDPR is provided.
Monitoring and measurement run on servers in the EU; only AI features such as the assistant and AI visibility use a processor in the USA on the basis of the EU standard contractual clauses. The built-in analytics are cookieless too: they set no tracking cookies; visits are told apart by a pseudonymous daily identifier, and the IP address is not stored. For plain traffic measurement of your portals, a consent banner is therefore usually not required — you receive complete usage figures including Web Vitals without confronting visitors with a cookie dialog.
What to watch for in procurement: request a complete list of sub-processors with their country of seat, the data processing agreement and a clear statement on the hosting location. With XICTRAQ the data protection evidence is considerably simplified — one provider, one contract, one documented processing location instead of a collection of separate tools each with its own privacy review. How these points are to be weighted in a specific procurement or audit procedure is decided by your responsible bodies.
Availability of public services — and fast diagnosis
- Step 1
Measurement
Three EU nodes check availability and response time around the clock.
- Step 2
Consensus
An outage is only reported once several nodes confirm it.
- Step 3
Auto-diagnosis
DNS resolution, HTTP response, traceroute and screenshot are attached to the incident.
- Step 4
Alert
Alert with the error the check saw via email, webhook and messengers.
Online application flows, appointment booking and citizen portals must be available when people need them — often outside office hours, in the evening or at the weekend. XICTRAQ monitors the availability and response times of your portals around the clock across three distributed EU nodes in Nuremberg, Helsinki and Falkenstein. Helsinki is in Finland; thanks to the geographic distribution it is possible to tell whether an issue lies with the server itself or with a single network route.
An outage is only reported once several nodes confirm it — this multi-node consensus reduces the false alarms that easily arise with a single measuring point, for instance when just one network route briefly stalls. If a genuine issue occurs, XICTRAQ alerts the responsible staff across several channels: email, webhook and common team messengers. IT can thus react before complaints accumulate or the telephone enquiry desk is overwhelmed.
So that remediation does not start from zero, the alert on a confirmed outage states the error the check saw — for example an expired certificate, a timeout or a faulty server response — and an auto-diagnosis adds DNS resolution, HTTP response, a traceroute and a screenshot. The diagnosis appears in the timeline of the related incident. For more complex application flows you can additionally configure browser monitors with assertions that replay real click paths — such as "open form, fill required field, see confirmation" — and raise an alert when a step fails even though the start page still formally responds.
Transparent status pages for citizens
When a citizen portal is unreachable, uncertainty quickly arises: is it the visitor own connection, the browser or the authority? A public status page answers this question factually. It shows the current operating state of the individual services, announces planned maintenance windows and reports ongoing disruptions — preventing people from starting an application in vain or calling the switchboard repeatedly.
The status page can be fully adapted to your visual identity: crest, logo, colours and an own domain such as status.example.com. Citizens can subscribe to status updates via double opt-in and are automatically notified of a disruption or planned maintenance — without setting up yet another mailing list. For embedding into existing sites there is also an embeddable widget that shows the current status as a small banner or card directly on the homepage.
Transparency thus becomes a service: citizens receive reliable information instead of guesswork, the administration communicates planned maintenance in advance, and the telephone enquiry desk is noticeably relieved. Especially for heavily used services — such as appointment booking or vehicle registration — this open communication pays off.
- Citizen portal operational
- Online appointments operational
- Vehicle registration maintenance planned
- Application upload operational
Reporting and evidence towards oversight and auditing
In the public sector, the operation of digital services must be evidenceable — towards management, auditing or an oversight authority. For this XICTRAQ generates automatic reports with uptime percentage, mean time to recovery (MTTR) and concrete downtime per portal. These SLA reports can be produced and dispatched as PDF on a schedule — for example monthly or quarterly — so that robust figures replace mere assertions.
Besides availability, XICTRAQ also documents the security and compliance state: SSL lifetimes, security headers, DNS and email authentication (SPF, DKIM, DMARC) and DNSSEC. An approaching certificate expiry is reported in good time instead of leading to a surprise outage. The dated accessibility finding for the monitored page, with its score history, rounds out the picture and can be used for the accessibility statement.
Decision aid: if your institution must report on operations regularly, switching from manually compiled spreadsheets to scheduled reports pays off from just a few portals onwards. You save the recurring manual effort and obtain a uniform, traceable proof from a single source — across all 21 modules that XICTRAQ unifies in one interface.
SLA reports as PDF
Uptime percentage, MTTR and concrete downtime per portal — dispatched monthly or quarterly on a schedule.
Documents for procurement
Details on hosting in Germany, EU processing, the sub-processor list and the DPA under Art. 28 GDPR.
Accessibility finding
Dated WCAG finding for the monitored page with score history as a factual basis for the accessibility statement.
What public bodies need to cover
Eight areas of responsibility that XICTRAQ unifies in one interface and one invoice.
Document accessibility
Automated checks against measurable WCAG criteria as an indicator for BITV 2.0 requirements, with a severity per violation for the monitored page and a score history from the Lighthouse runs.
Data in Germany
Processing within the EU, hosted in Germany, with a data processing agreement under Art. 28 GDPR and no US sub-processors.
Ensure availability
Round-the-clock availability monitoring of citizen portals across three distributed EU nodes with multi-node consensus.
Check security
SSL lifetimes, security headers, DNS and email authentication (SPF/DKIM/DMARC) and DNSSEC continuously monitored.
Document evidence
PDF reports with uptime, audit state and history — as factual evidence for management, auditing and oversight.
Transparency for citizens
Public status pages inform citizens factually about maintenance and outages of public services — with crest, logo and own domain.
Auto-diagnosis on incidents
When a portal fails, the alert states the error the check saw, and XICTRAQ adds DNS resolution, HTTP response, a traceroute and a screenshot to the incident — IT does not start from zero.
Usage without cookie banner
Cookieless traffic measurement and Web Vitals show how citizens use online services, without cookies and without storing IP addresses.
Separate tools vs. one bundled platform
What matters in the public sector — and how XICTRAQ reduces the effort.
| Criterion | Multiple separate tools | XICTRAQ |
|---|---|---|
| Processing location | Spread across several providers, partly outside the EU, to be reviewed per tool. | Hosted in Germany, processing within the EU, one documented location for all modules. |
| Data processing agreement | Multiple agreements each with their own sub-processor lists, approved individually. | One data processing agreement under Art. 28 GDPR for the whole platform. |
| Accessibility indicator | Often only one-off spot tests, without a continuous history. | Continuous WCAG checks of the monitored page with severity per violation and a score history. |
| Traffic measurement | Frequently cookie-based, with consent banner and third-country question. | Cookieless, without re-identification identifier, usually without a banner. |
| Availability measurement | Often a single measuring point, prone to false alarms on network issues. | Three EU nodes in Nuremberg, Helsinki and Falkenstein with consensus before alerting. |
| Citizen information | Status updates mostly manual, by notice or telephone. | Public status page with crest and own domain, subscriptions via double opt-in. |
| Evidence | Data to be compiled manually from several tools. | Scheduled PDF reports with uptime, MTTR and downtime per portal. |
| Procurement | Multiple contracts, invoices and renewal dates to manage. | 21 modules, one interface, one invoice — free plan or from 12 euros per month, cancel monthly. |
The table describes typical constellations and names no specific third-party providers.
The right modules for public administration
Frequently asked questions from authorities
Does XICTRAQ replace an official accessibility audit?
No. XICTRAQ checks the monitored page of a website automatically against technically measurable WCAG criteria and surfaces violations with their severity as well as the score history. A full accessibility audit also includes manual reviews — such as the clarity of language or a sensible operating sequence — that software cannot replicate. Our evaluation is a continuous pre-check and documentation aid; the legal assessment in each case remains with you.
How does XICTRAQ support the accessibility statement?
Most public bodies must publish an accessibility statement and keep it current. XICTRAQ provides a continuously renewed, dated finding for the monitored page: which criteria are currently flagged and how the score has evolved since the last relaunch. This history makes it easier to justify the statement factually and to evidence improvements — the final wording and classification you make yourself.
Where is data from public institutions processed?
XICTRAQ is hosted in Germany and processing takes place within the EU. We provide a data processing agreement under Art. 28 GDPR and name the only flow to the USA in the privacy policy: AI features such as the assistant and AI visibility, on the basis of the EU standard contractual clauses. This makes it easier to document the data-location requirements set out in procurement documents — one provider, one contract, one processing location.
How can data location be evidenced in a procurement procedure?
In tenders the processing location is regularly used as a suitability or award criterion. From us you receive the details on hosting in Germany, EU processing and the sub-processor list, plus the data processing agreement under Art. 28 GDPR. These documents can be attached to the procurement file. Whether they suffice in the specific procedure is assessed by the responsible procurement body and your data protection officer.
Do the built-in analytics need a cookie banner?
The analytics run cookieless; visits are told apart by a pseudonymous daily identifier, and the IP address is not stored. For plain traffic measurement of your portals a consent banner is therefore usually not required, and you still receive complete usage figures including Web Vitals. Whether this is sufficient in your specific case is something you or your data protection officer assess yourselves.
Across how many locations is availability measured?
XICTRAQ measures across three distributed EU nodes in Nuremberg, Helsinki and Falkenstein. Helsinki is in Finland — the geographic spread makes it possible to tell whether an issue lies with the server itself or with a single network route. An outage is only reported once several nodes confirm it (multi-node consensus). This reduces the false alarms that easily arise with a single measuring point.
How do public status pages help towards citizens?
A status page shows the current operating state of your portals and announces planned maintenance or ongoing disruptions. Citizens can factually see whether a service is reachable instead of starting an application in vain. The page can carry your crest, logo and own domain; citizens can subscribe to status updates via double opt-in. This also relieves telephone enquiries.
What happens technically when a portal goes down?
Once several nodes confirm an outage, the alert states the error the check saw — for example an expired certificate, a timeout or a faulty server response — and an auto-diagnosis adds DNS resolution, HTTP response, a traceroute and a screenshot to the incident to narrow down the cause. The alert goes out with the error across the configured channels and the diagnosis follows shortly after in the incident timeline, so the responsible staff do not start from zero but with a starting point for remediation.
How is availability and response time evidenced to supervisors?
XICTRAQ generates automatic reports with uptime percentage, mean time to recovery (MTTR) and concrete downtime per portal. These PDF reports can be sent on a schedule — for example monthly — and serve as traceable evidence for management, auditing or oversight authorities. Reliable figures on operation thus replace mere assertions.
Is it worth it for small municipalities or public enterprises?
Yes. There is a permanently free plan for one website, so a small administration or public enterprise can start without budget approval and assess the benefit. Paid plans begin at 12 euros per month, cancel monthly, and bundle 21 modules into one interface and one invoice instead of multiple separate contracts — which also simplifies recurring procurement and renewal.
Ready for accessible, demonstrably operated citizen portals?
Start free with one website or talk to us about your institution requirements — accessibility, data in Germany, availability and evidence in one platform.