Compliance and Security, Handled
When you’re using the ReachWell platform, you don’t have to worry about meeting evolving compliance and security expectations. It’s built in from the start, so every message your team sends is set up to meet language access, accessibility, public records, texting compliance, and data security standards.
We Understand the Stakes Behind the Messages You Send
Messages your agency sends carry real exposure.
- Miss a resident who needed an alert in their language and you are looking at a civil rights complaint, and the fines and lost federal funding that can follow.
- Send messages people cannot read on a screen reader or cannot enlarge to read, and you face the same kind of complaint under the ADA.
- Then the audit or the records request arrives, and the proof is scattered across translators, spreadsheets, and separate systems, so your team loses days pulling it together, and you still may not find all of it.
The Standards and Security Controls You Get With ReachWell
Each obligation below comes with its own set of standards. ReachWell is built to support each one, and protects your data with the safeguards your IT and security teams ask about.
Foundational Compliance Obligations
These apply to nearly every government agency and community organization.
-
Language Access
Title VI, Section 1557
Organizations that receive federal funding must take reasonable steps to provide meaningful access to residents with limited English proficiency, and failing to provide translated communication is the most common civil rights complaint organizations face. ReachWell translates every message into the languages your residents speak, with optional translation review. Each translation is linked to its original, so you can always show what you sent and in which language.
Primary sources -
Records and Transparency
State Public Records Acts
Resident messages are public records, so when an audit or an open-records request comes, an agency has to show what it sent, in which language, and when. ReachWell keeps every message in one export that pairs each original with its translations, recipients, timestamps, channels, and delivery outcomes, so answering a request is a matter of pulling the record rather than rebuilding it across separate systems.
Primary sourcesNARA electronic records management State open-records acts (each state’s own statute) -
Texting Compliance
A2P 10DLC, TCPA
Any organization that texts residents has to register its brand and campaigns with the carriers and send with consent, or the messages get filtered out and the alerts never arrive. ReachWell handles that registration inside the platform, along with opt-in, STOP, and HELP handling and throughput visibility, so your texts stay registered, consented, and deliverable.
Primary sources -
Accessibility
ADA Title II, Section 504
State and local agencies must bring their websites and apps up to WCAG 2.1 Level AA, with larger agencies required to comply by April 2027 and smaller agencies and special districts by April 2028. Even before those deadlines, residents who are visually impaired can take legal action when they cannot read what an agency sends. ReachWell builds its web and app screens to WCAG 2.1 AA and maintains Accessibility Conformance Reports in VPAT format for web, iOS, and Android, so your messages work with screen readers and assistive technology.
Primary sources
Sector-Specific Obligations
Depending on the agency you serve, additional obligations apply.
-
Emergency Alerting
IPAWS, Wireless Emergency Alerts
Emergency teams send public warnings through FEMA’s IPAWS, and the Wireless Emergency Alerts it delivers reach phones in English and Spanish today. By June 2028, participating carriers must support alert templates in English, the 13 most commonly spoken languages, and ASL, but only for a fixed set of pre-scripted emergencies. A warning only works if the residents in its path can understand it, so ReachWell sends the same alert in the languages your community speaks, in your own words, across every channel.
Primary sources -
Student Privacy
FERPA
Student messages can carry personally identifiable information from education records, which a district cannot disclose without consent, and a school that does risks its federal funding. ReachWell lets a district control what goes in each message and who receives it, and keeps a record of what was sent and to whom, so a message reaches the right family and no one else.
Primary sources -
Health Privacy
HIPAA, 42 CFR Part 2
Public health and behavioral health agencies work under HIPAA, and substance use disorder records carry added protection under 42 CFR Part 2. ReachWell is built so that protected health information does not flow through the platform, which keeps a department’s HIPAA exposure out of the communication layer while it still reaches residents in the languages they speak.
Primary sources -
Fair Housing
Fair Housing Act
Limited English proficiency is not itself a protected class, but it is closely tied to national origin, which is, so selective or pretextual language practices can become a fair housing violation. ReachWell lets a housing authority reach its residents in the language they speak, consistently rather than selectively, with a record showing each resident got the same message.
Primary sources
Security Controls
The safeguards your IT and security teams ask about, each one named with the artifact behind it, and an independent attestation underneath them all.
-
Data Protection
Encrypted in transit and at rest
ReachWell encrypts data in transit and at rest, so the contact information you bring and the record of everything you send stay protected in motion and in storage. Data is hosted with a major cloud infrastructure provider under that same protection, and the specifics of hosting and data residency are shared with your team during security review.
-
Access Control
Role-based permissions and least privilege
Role-based permissions and least-privilege access mean each staff member sees only what their role requires, and an agency administrator controls who has access to what. The same permissions model is what lets colleagues in other departments and agencies view a campaign without being able to change it.
-
Single Sign-On
SAML or OIDC through your identity provider
Agencies sign in through single sign-on using SAML or OIDC, so access follows the identity provider and the offboarding process your IT team already runs.
Primary sources -
Audit Logging
ReachWell captures administrative activity in an audit log that records who did what and when, which an agency can review and export for its own oversight and reviews.
-
Independent Attestation
SOC 2 Type II
ReachWell's SOC 2 Type II attestation is underway, meaning an independent auditor examines its security controls over a period of time, not just at a single moment. The report will be available to your team under NDA on completion.
Primary sources
ReachWell has made it easier for CASA Academy to build meaningful connections with our families by breaking down language barriers. Providing communication in multiple languages ensures our families feel informed, included, and connected to our school community. We love that ReachWell helps make communication more accessible for every family!
Frequently Asked Questions
About how ReachWell meets each obligation and protects your data
How does ReachWell help an agency clear procurement, legal, IT, and security review?
Reviewers look for each communication obligation to be met and documented, and for the data behind it to be protected by named controls like encryption, role-based access, single sign-on, and audit logging, backed by an independent attestation. ReachWell brings both into one platform, with a SOC 2 Type II attestation underway, the report available under NDA on completion, so procurement, legal, IT, and security can each sign off from one place.
What language access does Title VI require of government agencies?
It depends on the agency. Health programs that receive federal funding must provide language help under Section 1557 of the Affordable Care Act. Several states, including California, New York, and Maryland, have laws that require state agencies to translate important documents. Title VI of the Civil Rights Act of 1964 bans every agency that receives federal funding from discriminating against residents based on national origin. Title VI still applies after Executive Order 14224 made English the official language in 2025. The Department of Justice says that refusing language help can be evidence of national-origin discrimination. ReachWell sends every message in the languages residents speak, lets the agency approve each language before anything sends, and keeps each translation linked to its original.
Does the ADA require WCAG compliance for government agencies?
Yes, for state and local governments. A 2024 Department of Justice rule under ADA Title II requires state and local government websites and mobile apps to meet WCAG 2.1 Level AA. After an April 2026 extension, governments with 50,000 or more residents must comply by April 26, 2027, and smaller governments and special districts by April 26, 2028. ReachWell’s web and resident app screens are designed to meet WCAG 2.1 AA and Section 508. Accessibility Conformance Reports in VPAT format are available for web, iOS, and Android, and agencies can request them during evaluation.
Does FOIA apply to the text messages and emails agencies send?
Yes. The federal Freedom of Information Act (FOIA) covers federal agency records in any format, including text messages and emails. Every state has its own public records law for state and local agencies. In 2015, the Washington State Supreme Court ruled that government employees’ text messages, even on their private phones, can be public records. ReachWell keeps one complete record of every message, pairing the original with its translations, recipients, timestamps, communication channels, and delivery outcomes, in a single export. Agencies use that export to respond to FOIA and state open-records requests.
What does A2P 10DLC registration mean for government agencies?
A2P 10DLC is the system US mobile carriers use to register application-to-person text messaging sent over standard 10-digit phone numbers. An agency registers its organization as a brand and each texting program as a campaign through The Campaign Registry. Since February 2025, carriers block text messages from senders that are not registered. Only government entities and their contractors can register Emergency campaigns, which carry public health and safety notices. With verified government entity status, an agency’s texts also have no daily cap on T-Mobile. Every sender must also collect opt-in consent and honor STOP and HELP requests. The ReachWell team registers the agency’s brand and campaigns with the carriers, and the platform handles opt-in, STOP and HELP, and throughput visibility, so an agency’s text messages are registered, consented, and deliverable rather than filtered or blocked.
What is ReachWell’s SOC 2 status and what does it cover?
ReachWell’s SOC 2 Type II attestation is underway, with the report available under NDA on completion. An independent auditor examines ReachWell’s security controls over a period of time, including encryption, role-based access, single sign-on, and audit logging.
How does ReachWell protect and host agency and resident data?
ReachWell hosts agency and resident data with a major cloud infrastructure provider. The platform encrypts data in transit and at rest. Agencies receive specific hosting, data-residency, and infrastructure details during security review.
How does ReachWell handle single sign-on?
ReachWell supports single sign-on through SAML or OIDC, so staff sign in with the agency’s existing identity provider.
Reach More of the People You Serve
See how ReachWell helps you reach and engage more residents, in every language and on every channel, with the recordkeeping and safeguards your team needs already built in.