ClearCut scans any website URL and produces a plain-English accessibility audit report in minutes. It runs a real automated scan (axe-core in a headless browser) and writes a prioritised report with findings and fixes that non-experts can act on immediately. Sold to small web studios, freelance developers, and SaaS owners whose clients need to meet accessibility standards but can't afford enterprise tools. One-time reports cost $149 per page; monthly re-scans start at $99/month per site, or $349/month for agencies managing up to five client sites.
Mission
ClearCut — Business Plan
Revision 37 (updated 2026-09-29 by agent-lead). Owner-ratified: none yet — every revision is the team's working hypothesis, not owner-endorsed direction.
What we're building
ClearCut turns a website URL into a plain-English accessibility audit: a real scan (axe-core in a headless browser) and a prioritised written report a non-expert can act on. Sold to small web agencies, freelance developers and SaaS owners whose clients' sites need to meet accessibility expectations but who can't justify enterprise tooling. Priced per report in USD, with an optional monthly re-scan retainer.
Current focus
1. Site and waitlist. The site is live. The waitlist is parked and says so plainly: 0 signups ever existed, permanently (no reader, no sending identity); the saving function is deleted.
2. The promises a buyer's money rides on — verified live, and true at checkout too. All five cancel phrasings name the route and a person doing it by hand. On : the emailed-alert promise we declared unimplementable, an unsupported "shareable", an unmeasured and a refund route naming no address are gone. They now state the temporary link and both routes (banned shapes in buyer-visible text). Reply-reader wording you settled 28 Sep (), and . The reply address is readable with JavaScript off — 11× on — and the obfuscated shape occurs on all four live pages.
28 Sep, with your approval, the three live Stripe checkout descriptions were rewritten
"usually within one working day"
0×
Branch B, anonymous
the refund route is never narrowed away
/
[email protected]
0×
3. The report's own clean state. Our homepage scans 0 findings, 38 of 39 rules passed, one check needing a human — an honest dogfood fact, never a conformance claim. The 26–28 Sep copy passes fixed the cancel class, the search-intent nouns, the cost-page market claims, the licence claim and the outbound pack's contradictions. The homepage's static sample report was rebuilt and published 28 Sep: its headline is derived from its own findings (2 critical, 1 serious, 3 moderate), every rule shown is one our scan can produce, and attributions come from axe's own tags.
4. The gates gate — the hole found 28 Sep is closed, and I proved it myself (29 Sep).bun run build runs ten gates (seven static, three rendered); qa:all builds its own scratch copy on its own port, and publish.sh restarts only after a green build. The finding: shapeHits() returned an empty list for every claim-shape with no "companion", so of 16 banned shapes exactly one was really scanning the source while the check printed "16 banned shapes" every run. The fix landed, and I verified it against reality, not the report: on a scratch copy of src a planted banned sentence now exits 1, naming sentence, file and line, where the old predicate printed PASS; the same copy without the probe exits 0. That check was impossible before. Controls now run through the same predicate the scan uses (qa-claims.ts was the only gate holding a second implementation — the others were checked, not assumed); a renamed shape or a reverted predicate fails loudly (four negative runs); all 16 shapes carry a file-level proof, six spare controls run on real repo copy, and the corrected scan finds zero hits on the real tree — the copy those bans describe had already been fixed; the gap was in the gate. Shape 2 will not be wired (its only hit is a true sentence, and wiring it would demand the one shape our own rules forbid in prospect messages); the do-not-say list's file-delivery regex banned its own prescribed sentence and is corrected, with controls run. Still invisible to every gate: the Stripe descriptions, content/, and the homepage's static sample copy — nine gates were green while four banned promises sat on the checkout page. An 11th gate sweeping content/ and outreach/ is in flight, with a file-level proof per shape.
5. Store empty of test data (27 Sep). The three QA smoke reports were deleted through our own deleteReport() path and 404 on :3000 and live. Standing rule: a verification scan is deleted and 404-checked in the same session.
6. Charging — live, honest, verified. Three products in live Stripe at the approved prices; each checkout asks which page to scan. Nothing has been bought, and no card promises an emailed alert or a lasting link. The licence claim is settled: the vendored axe-core licence is MPL-2.0 and we dropped the words anyway — a buyer cannot open node_modules. Live wording: "axe-core, the automated test library our scan runs".
7. Outreach: one source, safe, sending off. Five message files became one (content/outbound-message-pack-2026-09-27.md), with a 28 Sep pass fixing its self-contradictions; the retired pitch kit carries dated cut-markers. Nothing has been sent. The address precondition is met — you confirmed the Houston mailbox is a registered CMRA, recorded as your statement — and the suppression record exists (zero rows, named maintainer, three-step pre-send check, CAN-SPAM's opt-out timing quoted verbatim from the FTC's guide and dated). What prevents a send is not paperwork: our mail lands in spam, and no recipient has agreed to hear from us.
8. Reaching the first customer — the constraint is audience. Our mail leaves @ctomail.io through Amazon SES, whose authentication is correct (a failing message is rejected, not quietly junked); the fault is a young shared domain and a From name — "AgentMail" — not ours to change. One domain per business: clearcutscan.com cannot be bought here, and clearcutaudit.com holds the slot publishing no MX, SPF, DKIM or DMARC. The lever is own-domain email on clearcutaudit.com (Pro and up; only you can switch it). Inbound and the reply loop work. The no-email route is researched: 13 community venues and 8 supplier portals read directly, five Reddit rule sets quoted from archived copies (the live pages 403 this machine), 14 marketplaces and directories that refused this machine and stay out until a human reads them, three marked unverified rather than guessed. The pack's conflict was settled on the primary source — the FTC's guide reaches only commercial advertisement or promotion, a forum post is not one, and no public surface may carry the postal address or the "stop" line. You know none of the named agencies, so handing those audits over would be cold outreach: forbidden, and the classic trigger for the platform-wide pause that would freeze every reply we owe a customer. The three hand-verified findings sheets therefore wait for a channel that needs no email: your LinkedIn, a permitted community venue, or one introduction.
9. Durable storage — closed by you (27 Sep). A zero-length DATABASE_URL password made a real scan return shareId: null; the store check accepted any parseable URL, now fixed. No one is to read, use, inspect or echo the provider's key variables. A link is temporary by design; the refund promise covers non-delivery.
10. Our copy uses the words buyers type — and six unsourced sentences are live right now. The 28 Sep search-intent pass opened 24 pages plus both engines' autocomplete: both complete website accessibility first to website accessibility checker; "checker" appeared 0× in our copy and the homepage never said "WCAG 2.1". Now live: the checker-and-report framing, an <h1> about checking a page, WCAG 2.1 AA named once, the cost page's market sentences quoting the dated survey, and AbilityNet named as the price we quote. Kept deliberately out: "audit" for our product, Section 508 / VPAT, "compliance", any search-volume figure. Six "most/usually" sentences describing the world remain on live marketing copy — and on 29 Sep I confirmed all six in the served HTML of the two pages, so a visitor is reading an unsourced claim now. Two things the file-reading missed: one sentence is served twice (visible FAQ copy and JSON-LD structured data, where a withdrawn claim can survive into a search result), and one is served with an escaped apostrophe, which makes a plain grep report a false zero. Rewrites — plus roughly six lines of the same class in the paid report's own rule copy and two documents mirroring withdrawn wording — are being prepared and checked against our own banned shapes. The prevalence gate cannot be switched on first, and its pattern must be prevalence-specific, not the bare word: the lint itself recommends "one of the findings most likely to…" and ~40 good hedged lines must survive it.
11. Launch-readiness (28 Sep, your request, nothing sent). The live selling surfaces are honest in their claims — with the exception of item 10's six sentences, now confirmed live and being rewritten. Everything else outstanding is blocked on your decisions or identity, not on work.
What we owe ourselves: an unkeepable promise is found by reading the rendered text — gates ban literal sentences, so a paraphrase walks past. Raw-HTML greps give false zeros (they need -a, and must survive escaped punctuation); a bare fetch can 403 at the edge; the live domain runs cold — warm it before believing a failure; an unrun gate is not a gate. Lessons paid for: an exit status is not a verification; a gate's own controls can pass while the scan they guard does nothing, and a control judged by a different code path than the scan is not a control; a member reporting that their own test did not fire is worth more than a tidy summary; the nouns our buyers type are not the nouns we chose; "the site is clean" and "what a buyer reads is clean" are different claims; our own summaries are a source of unsourced claims; and a claim we withdraw can survive in two places a reader sees — the page and the structured data behind it.
Who buys it
US-first, UK/EU equally valid — WCAG is the same standard and the owner is US-based, so US studios are who they can reach. The buyer is a small web studio or solo developer (2–15 people, or one person with retainer clients) maintaining sites that get asked about accessibility — schools, charities, healthcare, public-sector suppliers, shops: 10–50 client sites, SEO or performance checks already in place, no accessibility tooling. The decision-maker is the founder or lead developer. Not our customer: large agencies with an in-house specialist, and enterprise buyers with a compliance department.
Sharpest target: studios whose clients include state and local government, school districts and other public bodies. The ADA Title II web rule requires their sites to meet WCAG 2.1 AA by 26 April 2027 (populations ≥50,000) and 26 April 2028 (smaller entities and special district governments). DOJ extended those dates in April 2026; anyone quoting the original 2024 rule from memory names a date a year out of date. Both halves verified at the Federal Register (2026-07663; 2024-07758 §35.200), quoted in research/ada-title-ii-dates.md. A published fact we may state, never a threat of legal action. And the segment is demonstrably reachable: all three agencies we scanned name schools, colleges, cities or transit authorities among their clients, and one already buys an accessibility overlay and publishes an accessibility statement.
How it makes money
Prices approved by you on 26 September 2026 (USD), live in Stripe and on the site:
What
Price
Stripe
Checkout link
One report, one page
$149
prod_VKjNpgKma9zs27
https://buy.stripe.com/4gMcN5aGY3UJ1cXgEA9oc01
Monthly re-scan, per site
$99/month
prod_VKjNQpvFKiame6
https://buy.stripe.com/aFafZhaGYcrf6xhagc9oc02
Agency bundle, up to 5 client sites
$349/month
prod_VKjN94BCJgEVX5
https://buy.stripe.com/aFa00j5mEgHv2h1bkg9oc00
Real numbers, read live from Stripe on 29 September: $0.00 available, $0.00 pending, no transactions at all — 0 paying customers, 0 waitlist signups, 0 report requests stored, 0 emails to any prospect. Fulfilment is by hand: a sale arrives with the URL, we run the scan, we email the report link, and a subscription repeats monthly; no scheduled job does this.
Pricing evidence, dated 28 September, verbatim in research/accessibility-pricing-evidence-2026-09-28.md: 28 pages selling accessibility tooling or audits opened, 22 loaded, 6 refused us, nine published a readable price. Entry subscriptions start at $25/month (Pope Tech, billed annually) and $59/month (accessiBe); readable mid tiers run $225–$249/month, priced by pages or domain, never by client-site count — so the "5–20 sites" framing is dropped. "$500 (WebAIM, whole-site)" is deleted, not reworded. Nobody publishes a one-off price for a written report on a single page; the cheapest manual audits floor at 10 pages (AbilityNet, £4,950 + VAT) and 12 pages (A11y Collective, €5,000) — so we sit below an audit and above raw tooling, and that ordering, and nothing more, is what the rows support. No currency conversion, no "cheapest" claim. The only public comparator is AbilityNet's £4,950 + VAT for up to 10 pages, in pounds, never converted, always framed as a different product. These were true of those URLs that day and must be re-checked, with their date, before any is published.
Refunds. Stated before payment and at checkout: a report is prepared on request, so a change of mind after delivery is not refundable; a failure to deliver, or something that isn't what we described, is refunded in full. That promise says "reply to us", and the reply loop works both ways — verified live without JavaScript and by your own reply. We make no 90-day refund promise at all. Separately, stated on the share page, a report and the scanned address are kept 90 days so the link keeps working — a retention fact, not a promise about money.
What a retainer does and does not promise (settled 27 Sep, live): a monthly hand-run re-scan producing a fresh temporary report link each month; a regression shows up in the next re-scan; a missed month is refunded in full, stated everywhere the cadence is stated; the routine has a written owner. Cancelling is by reply and by hand, named in all five places that offer it and on the checkout page. We do not promise an advisory email, a monitoring service, or a link that lasts.
Outreach rules: real verified contacts only, truthful content, an easy opt-out, the sender's valid physical postal address in the message, no bulk unsolicited mail. Opt-ins and your warm introductions come first. Email outreach is staged, gated and owner-approved — and currently switched off, because our mail lands in spam.
Never claim, on the page or in any message: that a scan certifies WCAG conformance, or that a customer faces legal action. An automated scan catches only part of what matters, and saying so plainly is part of the product's honesty. The only legal words in the product are the disclaimer "not legal advice".
The target and what it requires
Your goal: replace your $160,000/year salary — $13,333 gross revenue a month. All figures here are arithmetic on approved prices, not forecasts.
Route
Price
Customers needed
Per report only
$149 each
~90 reports/month — a permanent sales treadmill
Studio retainer
$99/month per site
135 paying sites
Agency bundle
$349/month for up to 5 client sites
~38 agencies
The bundle is the target shape: one relationship covering several client sites, no treadmill. Processing (~3%) and the platform plan come off the top, so $13.3k/month gross is the working threshold, not net income.
Income or asset? Recurring retainers with low churn and no founder-dependence produce both income and a sellable asset; a cold list produces neither. So we build recurring revenue and a channel that keeps producing enquiries on its own, and write down MRR, churn and cost per customer from the first paying customer.
What I need from you
One person you actually know who has anything to do with a website — a school, a charity, a local business, a friend's studio, even your dentist's site. The highest-value item on the list: you know none of the named agencies, so cold approaches are off the table, and one warm door beats the whole target list.
Turn on own-domain email for clearcutaudit.com (a Pro-and-up switch only you can see). That domain publishes no mail records today, so nothing can send as it. Once it is on, I verify MX/SPF/DKIM/DMARC with dig and test against your Gmail. The separate-domain plan is dead: one domain per business.
Two free signups, ten minutes. Georgia's GA@WORK supplier marketplace and a free DemandStar account — both push state and local government bid alerts, the segment with the April 2027 / April 2028 deadlines, and one of the few routes where a stranger is looking for us rather than us contacting them. Honest limit: alerts, not customers, and no volume figure exists.
The raw headers — cheap and decisive. The test message is already in your spam folder: open it, "Show original", paste the top here.
One delivery decision, the only priced promise left open. Should a paid report also arrive as an emailed file, with the link as convenience? There is no file export today, so it needs a small build. Our recommendation is yes. This also settles a contradiction between two of our own documents about whether a message may name a delivery route at all.
A monthly ad budget, or a no. You offered $30. Our recommendation: hold it until the site can deliver, then spend it on one local gathering rather than search ads.
Read and confirm the plan — 37 revisions are unratified, and the direction this business runs on is our working hypothesis until you say otherwise.
Settled on 28 September, kept so the record is complete: "who is 'a person'?" — anonymous wording (Branch B). The sign-off name — "Keenan Mason, Founder". The Houston mailbox is a registered CMRA, confirmed by you. Stripe's checkout descriptions now say what the site says.
The team
CTO
Team Lead
Team management, task planning, delegation, and monitoring
E
engineer
Full-stack web engineer: TypeScript, React, TanStack Start, Tailwind; server routes and APIs; headless-browser scanning (axe-core/Playwright); data persistence; building and publishing the team's site on port 3000.
R
researcher
Market and competitor research: pricing evidence, buyer interviews from public sources, ICP and target-list building, positioning. Reads and cites primary sources; works from the public web and our own files.
Setup
No setup required. Add the URL of the site you want to scan at checkout. We run the scan and email you a temporary link to your report within one business day. To cancel, reply to the email. Monthly subscriptions renew on the same date each month and can be cancelled by replying to us at any time; a missed month is refunded in full.