# Executive Audit Dossier: Personio (personio.com)
**EU European Accessibility Act (EAA), WCAG 2.2, Cyber Hygiene & AI Discoverability Audit**

- **Target Domain:** `personio.com`
- **Organization:** Personio
- **Industry Vertical:** SAAS (DE)
- **Primary Tech Stack:** B2B SaaS
- **Estimated Annual Turnover:** $150M+ ARR
- **Target Executive Persona:** VP of Engineering / Head of Developer Experience
- **Audit Date:** 2026-11-06
- **Auditor:** AccessGuard Pro Executive Compliance & Cyber Defense Suite

---

## 1. Executive Summary & Statutory Exposure

| Metric | Score / Status | Severity Assessment |
| :--- | :--- | :--- |
| **WCAG 2.2 / EAA Vulnerability Index** | **78 / 100** | HIGH VULNERABILITY |
| **HTTP Security Headers Score** | **30 / 100** | Action Required |
| **AI Agent Discoverability (/llms.txt)** | **26 / 100 (D)** | Unindexed |
| **DMARC Email Anti-Spoofing Policy** | **REJECT** | Protected |

> **Statutory Regulatory Exposure:** €100,000 statutory maximum under German BFSG & EU EAA Directive 2019/882  
> Under mandatory transposition of **EU Directive 2019/882 (European Accessibility Act)** across EU member states (including the German BFSG and French Law 2023-171), digital service providers must satisfy EN 301 549 conformance effective **June 28, 2025**.

---

## 2. Technical WCAG 2.2 & EU EAA Violations

| Standard & Criterion | Severity | Status & Observed Finding |
| :--- | :--- | :--- |
| **WCAG 2.4.1 (Level A)** Bypass Blocks | Critical | Missing "Skip to main content" bypass link on initial keyboard focus. |
| **WCAG 3.1.1 (Level A)** Language of Page | Pass | <html> root tag specifies valid lang attribute. |
| **WCAG 1.1.1 (Level A)** Non-text Content | Pass | Images provide appropriate alternative text. |
| **WCAG 4.1.2 & 1.3.1 (Level A)** Form Labels | Pass | Form controls contain programmatic labels. |
| **EU Directive 2019/882** Accessibility Statement | Statutory | Missing discoverable EN 301 549 Accessibility Statement link. |

---

## 3. HTTP Security Headers & Domain Spoofing Defense

- **DMARC Policy:** `reject` (v=DMARC1;p=reject;rua=mailto:9e441b5266@rua.easydmarc.eu,mailto:dmarc-reports@personio.com;ruf=mailto:9e441b5266@ruf.easydmarc.eu;fo=1;)
- **SPF Policy:** `soft_fail` (v=spf1 include:_spf.personio_com._d.easydmarc.pro ~all)
- **Missing Security Headers:** `Strict-Transport-Security`, `Content-Security-Policy`, `X-Frame-Options`, `X-Content-Type-Options`, `Permissions-Policy`

---

## 4. AI Agent Discoverability Audit (/llms.txt)

- **AI Search Readiness Score:** 26 / 100 (Grade D)
- **Status:** No /llms.txt found at https://personio.com/llms.txt. Risk of invisible products in Claude, ChatGPT Search, and Perplexity.

---

## 5. Bespoke Remediation Sprint Proposal: $2,650 B2B SaaS EAA Compliance & /llms.txt AI Agent Indexation Sprint

- **Fixed Investment:** **$2,650** (USD)
- **Turnaround:** **48 Hours**
- **Remediation Scope:**
  - Turnkey native HTML/DOM remediation (bypass blocks, form labels, ARIA landmarks)
  - Mandatory EU EAA EN 301 549 Accessibility Statement page and footer integration
  - HTTP Security Header policy injection (HSTS, CSP report-only, X-Frame-Options)
  - DMARC policy hardening roadmap from p=none to p=quarantine/reject with SPF alignment
  - /llms.txt and /.well-known/mcp.json generation for AI search discoverability

### Direct Liquid / HTML Remediation Snippet
```html
<!-- 1. WCAG 2.4.1 Skip-to-Content link (Place immediately after <body>) -->
<a href="#MainContent" class="skip-link visually-hidden-focusable">Skip to main content</a>

<!-- 2. WCAG 4.1.2 Programmatic Label on Search & Form Fields -->
<input type="search" name="q" aria-label="Search Personio catalog" placeholder="Search..." />

<!-- 3. EU EAA EN 301 549 Mandatory Footer Disclosure -->
<a href="/pages/accessibility-statement" rel="help">Accessibility Statement (EN 301 549)</a>
```

### Zero-Call Async Checkout & Instant Onboarding (PayPal / Corporate Card)
- **Approve 48-Hour Turnkey Sprint ($2,650):** [Click to Pay & Start 48h Sprint via PayPal](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=ronan.chenlopes%40gmail.com&item_name=%242%2C650%20B2B%20SaaS%20EAA%20Compliance%20%26%20%2Fllms.txt%20AI%20Agent%20Indexation%20Sprint%20-%20Personio%20(personio.com)&amount=2650.00&currency_code=USD&no_shipping=1&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html%3Fdomain%3Dpersonio.com%26tier%3Dsprint)
- **Deploy Self-Serve Edge & Plugin Kit ($497):** [Click to Buy Instant Edge Kit ($497)](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=ronan.chenlopes%40gmail.com&item_name=AccessGuard%20Instant%20Edge%20%26%20Plugin%20Compliance%20Kit%20-%20Personio%20(personio.com)&amount=497.00&currency_code=USD&no_shipping=1&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html%3Fdomain%3Dpersonio.com%26tier%3Dtier1)
- **Subscribe Continuous CI/CD Retainer ($299/mo):** [Click to Subscribe Retainer ($299/mo)](https://www.paypal.com/cgi-bin/webscr?cmd=_xclick-subscriptions&business=ronan.chenlopes%40gmail.com&item_name=AccessGuard%20Continuous%20CI%2FCD%20Compliance%20Retainer%20-%20Personio%20(personio.com)&a3=299.00&p3=1&t3=M&src=1&currency_code=USD&no_shipping=1&return=https%3A%2F%2Fronanchnlps-bit.github.io%2Fonboarding-portal.html%3Fdomain%3Dpersonio.com%26tier%3Dtier3)
- **Direct Advisory Contact:** `ronan.chenlopes@gmail.com`

---
*Report generated by AccessGuard Pro Executive Advisory Suite.*