Ash
uxsignalstudio.com
hello@uxsignalstudio.com
UX Report

www.gravwell.io

What is working, and what is costing you.

55/100
At risk

Gravwell has the raw material for a strong page and is not using it. The product story is specific and technical, the pricing is published openly, and a commissioned Forrester study putting ROI at 264 percent is real proof most competitors cannot show. All of it is either below the fold or in a dismissible bar above the navigation. The hero names the category but never says who it is for or why anyone should pick it over Splunk, which the navigation itself admits is the comparison being made. The larger problem is compliance: there is no privacy policy, no terms, and no cookie policy anywhere on the site, and the consent banner asks visitors to accept cookies while pointing at a privacy policy that returns a 404. For a security vendor selling into enterprise procurement, that single fact will cost more deals than every design issue on this page combined.

4995
27 findings 4 critical9 high9 medium5 low
Prepared for
www.gravwell.io
Prepared by
Ash · UX Signal Studio
Scanned
7 August 2026 at 22:54
Method
Desktop 1440x900 and mobile 390x844, Chromium
Contents

What is in this report

  1. 01 VerdictThe bottom line, the first five seconds, and where the score comes from
  2. 02 Do these three firstThe changes that move the most, in order
  3. 03 What is workingProtect these in any redesign
  4. 04 What is not working27 findings, most severe first, each with a fix
  5. 05 Code analysisMeasured from the page, including legal and compliance
  6. 06 What we looked atEvery screen the review is based on
  7. 07 Art directionA design opinion, labelled as opinion
  8. 08 This is the surfaceWhat a scan reaches, and what it does not

Scored against 25 checks in three weighted categories, plus 14 signals measured directly from the page. Section 01 shows how the score is built.

Section 01

Verdict

The bottom line

A security company selling at 70,000 dollars is asking for cookie consent while citing a privacy policy that does not exist anywhere on its site.

01

The exposure

No privacy policy, terms, or cookie policy exist anywhere, yet the consent banner tells visitors to read a privacy policy and offers only an Accept button.

02

The gap

The hero names a category but never says who it is for or why it beats Splunk, while the navigation carries a Gravwell vs Splunk page.

03

The tone

A cartoon mascot, a spy in a fedora, and Whack-a-Mole language front a platform sold to security leaders at 35,000 to 70,000 dollars and up.

04

What is strong

Published pricing, a commissioned Forrester ROI study, and genuinely specific technical claims. The substance is there and the page hides it.

The first five seconds

What a stranger takes from the hero

Lands

The category, immediately. Security Data Platform, logs and metrics in one place, for cyber, IT, and OT.

Does not land

Who it is for and why it wins. No persona, no differentiator, and nothing separating it from Splunk, Elastic, or Datadog.

Where it stands

Three categories, 27 findings

4995
4 critical9 high9 medium5 low

UX and conversion

72/100 · Solid

The evidence is unusually strong and almost none of it is positioned to work. Published pricing, a Forrester ROI figure, and specific technical claims are all present, while the hero spends its space on a category label and the proof sits in a dismissible bar. These are placement decisions, which means most of this score is recoverable in a week of copy work.

Visual and behavioral

79/100 · Solid

Competently built and fast, but the visual register is aimed at the wrong reader. A cartoon mascot and mission-control language front a platform sold to security leaders at enterprise prices, and the technical copy that would earn their trust is set in the lowest contrast text on the page.

Compliance and trust

75/100 · Solid

This is the urgent category. There is no privacy policy, no terms, and no cookie policy anywhere on the site, while a consent banner asks visitors to accept cookies and points at a privacy policy that returns 404. The banner also offers no way to decline. For a security vendor facing enterprise procurement, this outranks everything else in this report.

Detail

The longer read

What this site is. Gravwell sells a security data platform: a structure-on-read data lake for logs, metrics, and security telemetry, positioned against SIEM tools and Splunk in particular. It targets cyber, IT, and OT teams at enterprise scale, is sold on-prem, cloud, or hybrid, and prices from a free community edition to 70,000 dollars and up. The page wants a free trial signup or a docs visit.

The substance on this page is better than its presentation. Published pricing, a commissioned Forrester study, and concrete technical claims put Gravwell ahead of most competitors on evidence, and almost none of that is doing work where a visitor will see it. The hero spends its space on a category label. The proof sits in a dismissible bar above the navigation. The differentiators are three sections down. Separately from all of that, the site has no privacy policy, no terms, and no cookie policy, while running a consent banner that references a privacy policy and offers no way to decline. For a security vendor that is not a design problem, it is a procurement problem, and it is the first thing to fix.

The scoring framework

Built over years of B2B and B2C product work

This is our own framework, not an off-the-shelf checklist. Every check in it earned its place by turning up repeatedly in real reviews, across products sold to businesses and products sold to consumers, where the same failure kept costing the same thing. Checks that stopped predicting anything were removed.

The scoring is deliberately mechanical, so the number does not move with who ran the review or what kind of day they were having. What stays human is the judgement: what counts as a finding, how severe it is, and what to do about it. We use AI for the measurement pass now, which catches the small things a person skims past on the fortieth screen, and that buys back the time for the part that actually needs a designer.

How the score is built

Every check in the framework

Each check starts at 100 and is reduced by its most severe finding. A category is the average of its checks. The overall score weights the three categories at 40, 35, and 25 percent, then takes five points for every unresolved critical finding, because a critical is a business consequence that strong scores elsewhere should not wash out.

Weighted categories: 75. Critical findings: 4, costing 20. Overall: 55.

CheckCategoryScoreFindings
Value proposition clarity UX and conversion 40 1
CTA clarity UX and conversion 93 1
Conversion friction UX and conversion 61 2
Trust signals UX and conversion 65 1
Messaging clarity UX and conversion 61 2
Objection handling UX and conversion 82 1
Urgency and motivation UX and conversion 100
Visual hierarchy Visual and behavioral 80 2
CTA prominence Visual and behavioral 82 1
Decision overload Visual and behavioral 93 1
Social proof density Visual and behavioral 65 1
Headline effectiveness Visual and behavioral 65 1
Dark pattern detection Visual and behavioral 100
Responsive integrity Visual and behavioral 78 2
Art direction Visual and behavioral 65 1
Misleading flows Compliance and trust 100
Hidden costs Compliance and trust 100
Forced continuity Compliance and trust 100
Confirm shaming Compliance and trust 100
Weak disclosure Compliance and trust 65 1
Transparency Compliance and trust 63 2
Accessibility risk Compliance and trust 63 2
Legal pages Compliance and trust 16 4
Cookie consent Compliance and trust 40 1
Crawl controls Compliance and trust 100
Section 02

Do these three first

01

Publish a privacy policy, terms, and cookie policy, and fix the consent banner

Closes a live regulatory exposure and removes the question that will stop the first enterprise security review this site faces. The banner must gain a Reject option with the same weight as Accept.

02

Rewrite the hero around the differentiator that already exists on the page

A buyer learns in five seconds why this is not Splunk instead of scrolling three sections to find out. The copy is already written, it is in the wrong place.

03

Move the Forrester number and a customer logo row into the hero

Puts the strongest proof on the site where the decision is actually made, instead of in the one strip visitors have trained themselves to ignore.

Before you act on these

These three are the order, not the plan

Sequencing three changes is straightforward. Knowing which one to spend a sprint on, what the replacement copy should actually say, and how to tell within a fortnight whether it worked is a different question, and it depends on numbers this report cannot see.

That is the part we would want a conversation for. Thirty minutes, your funnel data on screen, no pitch.

Walk me through these three
Section 03

What is working

Protect these in any redesign.

Pricing is published, with real numbers

Four editions from free through 35,000 and 70,000 dollars and up, with the model explained: priced per indexer, unlimited ingest capacity, no penalty for data spikes or new sources.

Keep it because: Almost every competitor in this category hides pricing behind a call. Publishing it filters out the wrong buyers and earns trust with the right ones before anyone speaks to sales.

A commissioned Forrester study with a specific number

264 percent ROI from a Total Economic Impact study, offered as a download.

Keep it because: This is third-party evidence with a figure attached, which is the strongest proof a B2B page can carry. It is currently in the weakest position on the page.

The technical claims are specific enough to be checkable

Structure-on-read data lake, ingests PCAP in raw form with no normalisation at ingest, hundreds of terabytes a day at 40 percent less compute, and installation via apt update and apt install.

Keep it because: Specificity is credibility for this audience. An engineer reads the apt line and knows immediately whether this fits their stack.

The comparison is being named rather than avoided

The product menu carries a Gravwell vs Splunk page, and a section addresses switching from SIEM to SDP directly.

Keep it because: Naming the incumbent is what a confident challenger does. The instinct is right, it just has not reached the hero.

The page is fast and clean

First contentful paint at 380ms, DOM ready at 749ms, no console errors, and a light 497-node DOM.

Keep it because: For a company selling infrastructure, a fast site is read as evidence that the team can build.

Section 04

What is not working

27 findings, most severe first. Each is grounded in the captured page.

UX and conversion

8 issue(s) · scores 72/100

The hero names a category but never says who it is for or why to pick it

hero, desktop and mobile · value prop clarity
critical observed quick win

The hero gives a category and a capability and stops. Security Data Platform, then Logs, metrics, and security. All in one place. There is no persona beyond three unlabelled icons, and no differentiator at all. Every real differentiator exists further down the page: 40 percent less compute than competitors, indexer-based pricing that does not punish ingest, structure-on-read with no normalisation. The navigation even carries a Gravwell vs Splunk page. None of it is above the fold.

Evidence
  • Headline: "SECURITY DATA PLATFORM"
  • Subhead: "LOGS, METRICS, & SECURITY. ALL IN ONE PLACE."
  • Navigation contains a "GRAVWELL VS SPLUNK" page
  • Section three: "Handle hundreds of terabytes of logs each day using 40% less compute than competitors."
  • Section three: "Our Indexer-based pricing model doesn't punish you for ingesting more."
Why it matters

This is a category owned by Splunk, Elastic, and Datadog. A buyer who cannot tell in five seconds why this one is different has no reason to keep reading, and the answer is already written on the page in the wrong place.

Fix
Put the comparison in the hero. Something close to: "The security data platform that does not charge you for the data you collect. Hundreds of terabytes a day, 40 percent less compute than Splunk." Keep the category in the eyebrow so it stays clear.

The best proof on the page sits in a dismissible bar above the navigation

top bar, desktop and mobile · trust signals
high observed quick win

A commissioned Forrester Total Economic Impact study putting ROI at 264 percent is the strongest evidence on the site. It is placed in a thin strip above the logo, in small type, in the exact position visitors have learned to ignore. Nothing in the hero, and nothing near either call to action, carries any proof at all: no customer logos, no named team, no deployment figures.

Evidence
  • Top bar: "Forrester Consulting Study: 264% ROI with the Gravwell SDP"
  • Top bar: "Download the commissioned Total Economic Impact study to learn more"
  • Hero contains no logo row, customer name, or metric
  • No proof element beside either the read the docs or try for free buttons
Why it matters

Banner blindness is the most reliably documented behaviour in web usability. A verified third-party ROI number is exactly what convinces a buyer who has to justify the spend internally, and it is being placed where it will not be read.

Fix
Move the Forrester number into the hero as a proof line under the buttons, and add a customer logo row. Keep the download as a secondary link rather than the primary home for the claim.

The page title and description are both the placeholder Gravwell Home Page

document head · messaging clarity
high observed quick win

The title element reads Gravwell Home Page. The meta description reads Gravwell Home Page. The Open Graph title and description are the same string again, and there is no Open Graph image. This is the copy that appears in every search result, every browser tab, and every link shared into Slack or LinkedIn.

Evidence
  • Title: "Gravwell Home Page"
  • Meta description: "Gravwell Home Page"
  • Open Graph title and description: "Gravwell Home Page"
  • No Open Graph image set
Why it matters

This is the first impression for everyone who has not arrived yet. A placeholder title costs search click-through, and a shared link that renders as a bare URL with no preview is a lost referral in the channel where technical buyers actually pass things along.

Fix
Set the title to something like "Gravwell, the security data platform that does not charge you for the data you collect", write a real 155 character description, and add an Open Graph image.

Page weight or request count above budget

code · conversion friction
high observed quick win

93 requests, ~1.1 MB transferred (budget: 80 requests / 2.5 MB).

Why it matters

Heavy pages lose visitors before they render, and the loss is worst on the mobile connections most visitors use.

Fix
Compress and correctly size images, serve modern formats, and defer non-critical scripts.

Pricing is published but the tiers say almost nothing

pricing section · objection handling
medium observed medium

Four tiers are shown with real figures, which is unusually good. What each one includes is one sentence of generality: perfect for small commercial projects, great for organizations with single business units, optimized for critical environments and enterprise SOCs. Nothing states indexer counts, ingest limits, support levels, or what separates the 70,000 dollar Enterprise tier from the 70,000 dollar Cloud tier.

Evidence
  • Community Edition: "Community Edition that's Perfect for small commercial projects"
  • Pro Edition $35K+: "Great for organizations with single business units that need to collect events, search, and automate"
  • Enterprise Edition $70K+ and Cloud Edition $70K+ both priced identically with no stated difference
Why it matters

Publishing the number and withholding what it buys leaves the buyer unable to self-qualify, which puts every evaluation back through sales and undoes the advantage of showing pricing at all.

Fix
Give each tier a short feature list with the numbers that matter: indexers included, support response, retention. Make the difference between the two 70,000 dollar tiers explicit.

Body text under 14px

code · messaging clarity
medium observed quick win

1 block(s) of body copy set below 14px.

Evidence
  • 12px — "This website stores cookies on your computer. We use this information "
Why it matters

Small body copy pushes readers to zoom or give up, which costs time on page and comprehension.

Fix
Set body copy to 16px minimum, and no supporting copy below 14px.

Page weight or request count above budget

code · conversion friction
medium observed quick win

7 image(s) shipped far larger than displayed.

Evidence
  • 319px served, 105px displayed — https://www.gravwell.io/hubfs/Gravwell_July2025/images/alertbar-icon.png
  • 179px served, 70px displayed — https://www.gravwell.io/hubfs/Gravwell_July2025/images/Cyber.png
  • 181px served, 70px displayed — https://www.gravwell.io/hubfs/Gravwell_July2025/images/IT.png
  • 180px served, 70px displayed — https://www.gravwell.io/hubfs/Gravwell_July2025/images/OT.png
  • 590px served, 125px displayed — https://www.gravwell.io/hubfs/Gravwell_July2025/images/Mission%20Support.png
  • 1081px served, 310px displayed — https://www.gravwell.io/hubfs/Gravwell_July2025/images/Clip%20path%20group%20(11).png
  • 652px served, 220px displayed — https://www.gravwell.io/hs-fs/hubfs/raw_assets/public/Gravwell_July2025/images/gravwell_logo_transparent.png?width=1500&height=472&name=grav
Why it matters

Heavy pages lose visitors before they render, and the loss is worst on the mobile connections most visitors use.

Fix
Compress and correctly size images, serve modern formats, and defer non-critical scripts.

Vague link text such as click here or read more

code · cta clarity
low observed quick win

2 link(s) use non-descriptive text.

Evidence
  • "learn more" → https://www.gravwell.io/product-overview
  • "learn more" → https://www.gravwell.io/ai-dna
Why it matters

Screen reader users navigate by pulling up a list of links. Out of context, these links say nothing.

Fix
Rewrite link text so it describes the destination when read on its own.
Visual and behavioral

9 issue(s) · scores 79/100

The visual language reads as a game, not as enterprise security

whole page, worst in the hero and the Logbot AI section · art direction
high observed large

Neon yellow on a purple and maroon gradient, a cartoon spy in a fedora standing in for the Cyber audience, and a large smiling robot mascot introducing the AI feature. The copy matches: Launch your next mission, hunting threats down, a never-ending game of Whack-a-Mole. The same page prices the product from 35,000 to 70,000 dollars and up and cites a Forrester study.

Evidence
  • Cyber audience represented by a cartoon spy in a fedora icon
  • "Introducing Logbot AI" with a large cartoon robot illustration
  • "Launch your next mission"
  • "Tired of playing a never-ending game of Whack-a-Mole with cyber threats?"
  • Pricing tiers on the same page: FREE, $35K+, $70K+, $70K+
Why it matters

The buyer is a security leader with a procurement process, and the visual register tells them how seriously to take the vendor before they read a word. A page that has to be apologised for when forwarded internally loses deals that the product would have won.

Fix
Retire the mascot and the fedora. Demote the yellow from dominant to accent. Put the product on screen instead: the pipeline query language mid-analysis, a real dashboard, a threat being traced. Let the Forrester number and the published pricing set the tone.

The headline is a category label rather than a claim

hero, desktop and mobile · headline effectiveness
high observed quick win

SECURITY DATA PLATFORM is set as the largest type on the page. It names the shelf the product sits on and asserts nothing about it. The subhead adds a list of three nouns. Neither line would look out of place on a competitor's site.

Evidence
  • Headline: "SECURITY DATA PLATFORM"
  • Subhead: "LOGS, METRICS, & SECURITY. ALL IN ONE PLACE."
  • Better line already on the page, section two: "You're Not Reacting To Threats. You're Proactively Hunting Them Down."
Why it matters

The headline is the most read element on any page. Spending it on a category label leaves the largest type on the site doing no competitive work.

Fix
Move the category to the eyebrow and give the headline a claim only Gravwell can make. The ingest-pricing or compute-efficiency angle is the strongest candidate.

No customer is named anywhere on the page

whole page · social proof density
high observed medium

There is no logo wall, no testimonial, no named deployment, and no usage figure. The resources menu lists Customer Stories, so the material exists, but none of it surfaces on the homepage. The only third-party validation is the Forrester study in the top bar.

Evidence
  • No customer logos or testimonials in the page copy
  • Resources menu contains a "CUSTOMER STORIES" section
  • Only external validation on the page is the Forrester bar
Why it matters

Security buyers ask who else runs this before they ask anything else. Having the case studies and not showing them on the homepage wastes the work already done.

Fix
Add a logo row directly under the hero buttons and pull one quote with a name and title from the existing customer stories.

Two identical buttons compete, and one of them sends people to documentation

hero, desktop and mobile · cta prominence
medium observed quick win

read the docs and TRY FOR FREE sit side by side in the same yellow fill, the same size, and the same weight. Nothing signals which one the page wants. One of the two sends a first-time visitor into technical documentation rather than into the product.

Evidence
  • "read the docs" and "TRY FOR FREE" both rendered in rgb(255, 208, 111)
  • Identical size and treatment, adjacent in the hero
  • Casing is inconsistent between the two labels
Why it matters

When two controls look equally primary neither reads as primary, and click-through on the intended path drops. Sending an unqualified visitor to docs first also loses the ones who would have signed up.

Fix
Keep TRY FOR FREE as the only filled button and demote read the docs to an outline or a text link. Match the casing.

Low contrast body copy across the dark sections

feature cards and pricing, desktop and mobile · visual hierarchy
medium observed quick win

Thirteen text elements fall below the WCAG AA threshold, the worst at 3.95 to 1 against a required 4.5 to 1. The affected copy is the explanatory text inside the feature cards and the pricing tiers, which is exactly the copy a serious buyer stops to read.

Evidence
  • 13 text elements measured below 4.5:1
  • Worst measured ratio 3.95:1
  • Affected copy includes the feature card descriptions and the pricing tier explanations
Why it matters

The lowest contrast text on the page is the text carrying the technical detail. It is hard to read on a laptop in a bright room, which is where a lot of this evaluation happens.

Fix
Lift the body text to at least 4.5:1 against the gradient. On a dark background this usually means moving from mid grey to near white.

Thirteen tap targets fall under the minimum on mobile

mobile, 390x844 · responsive integrity
medium observed quick win

Thirteen tappable elements measure under the 44 pixel minimum on a 390 pixel viewport, including navigation items and the small arrow controls used throughout the page.

Evidence
  • 13 tappable elements measured under 44px on a 390px viewport
  • Affected controls include navigation entries and the inline arrow buttons
Why it matters

Mis-taps read to the visitor as the site being broken, and that impression transfers to the product for a company selling reliability.

Fix
Give every tappable element a 44 by 44 pixel minimum hit area using padding rather than font size.

Touch targets under 44px on mobile

code · responsive integrity
medium observed quick win

13 tappable element(s) under the 44px minimum on a 390px viewport.

Evidence
  • "Accept" — 72x40px
  • "" — 200x18px
  • "COMPANY" — 350x18px
  • "About Gravwell" — 97x17px
  • "Careers" — 48x17px
  • "Newsroom" — 68x17px
  • "Partners" — 51x17px
  • "RESOURCES" — 350x18px
Why it matters

Targets under 44px cause mis-taps on mobile, which reads to the user as the site being broken.

Fix
Give every tappable element a minimum 44x44px hit area, using padding rather than font size.

The navigation offers seven top-level destinations before the page begins

navigation, desktop · decision overload
low observed medium

Product, Pricing, Resources, Company, Demo, Community Edition, and Docs, with three of those opening submenus totalling over a dozen further links. Combined with the promotional bar above it, a visitor is offered a large number of exits before reading a single line of the page.

Evidence
  • Seven top-level navigation items plus three dropdowns
  • Resources dropdown alone contains seven entries
  • A promotional bar with its own link sits above the navigation
Why it matters

Every additional exit above the fold reduces the share of visitors who reach the argument the page is making.

Fix
Collapse Community Edition and Demo into Product, and move Docs to a text link. Aim for four top-level items plus the primary action.

Heading structure broken or multiple H1

code · visual hierarchy
low observed quick win

Heading levels skip 3 time(s), breaking the outline.

Evidence
  • h1 to h5: "LOGS, METRICS, & SECURITY. ALL IN ONE PLACE."
  • h2 to h5: "You're Not Reacting To Threats. You're Proactively"
  • h2 to h4: "On-Prem, Cloud, or Hybrid Environments."
Why it matters

Assistive tech and search crawlers use headings as the page outline. A broken outline makes the page harder to scan and to index.

Fix
Use exactly one H1 for the page topic and step heading levels down in order without skipping.
Compliance and trust

10 issue(s) · scores 75/100

The cookie banner cites a privacy policy that does not exist

consent banner, all viewports · legal pages
critical observed medium

The consent banner reads: to find out more about the cookies we use, see our Privacy Policy. There is no privacy policy on this site. We checked twelve standard paths including /privacy, /privacy-policy, /legal, /privacy-notice and /gdpr, and every one returns 404. The 198 URL sitemap contains no legal page of any kind, and no legal link appears anywhere on the homepage.

Evidence
  • Banner copy: "To find out more about the cookies we use, see our Privacy Policy."
  • https://www.gravwell.io/privacy returns 404
  • https://www.gravwell.io/privacy-policy returns 404
  • https://www.gravwell.io/legal returns 404
  • No privacy, terms, or cookie link found in the page DOM
  • Sitemap contains 198 URLs, none of them legal pages
Why it matters

Pointing at a policy that does not exist is worse than having no banner at all, because it documents that the obligation was known and not met. For a company that holds customer log data, this is the first thing an enterprise security questionnaire asks for, and the first thing a regulator would look at.

Fix
Publish a privacy policy, terms of service, and cookie policy this week, link all three in the footer on every page, and point the banner's link at the real document.

The consent banner offers no way to decline

consent banner, all viewports · cookie consent
critical observed quick win

The banner has a single control: Accept. There is no reject option, no manage preferences, and no close. Five tracking and analytics domains are already loading. Under GDPR and the ePrivacy Directive, refusing consent has to be as easy as giving it, and non-essential cookies must not be set before consent is given.

Evidence
  • Only button in the banner: "Accept"
  • Banner element: #hs-eu-cookie-confirmation
  • 5 tracking or analytics domains loading, 19 third party script domains in total
  • Banner text acknowledges analytics and metrics about our visitors on this website and other media
Why it matters

Accept-only banners are the single most enforced pattern in EU cookie regulation, with fines issued to companies far smaller than this. The banner also proves the obligation was understood, which removes any argument that it was an oversight.

Fix
Add a Reject all button with the same visual weight as Accept, and a manage preferences option. Block non-essential scripts until consent is given rather than loading them first.

No privacy policy

code · legal pages
critical observed quick win

No privacy policy found. Not linked from the page and not at /privacy or /privacy-policy.

Evidence
  • https://www.gravwell.io/privacy
  • https://www.gravwell.io/privacy-policy
Why it matters

A privacy policy is a legal requirement almost everywhere the site is reachable, and its absence is the first thing a cautious buyer or a regulator checks.

Fix
Publish a privacy policy covering what you collect, why, the legal basis, retention, and how to exercise data rights. Link it in the footer on every page.

Text below WCAG AA contrast

code · accessibility risk
high observed quick win

13 text element(s) fail WCAG AA contrast. Worst is 3.95:1 against a required 4.5:1.

Evidence
  • 3.95:1 (needs 4.5:1) — "Community Edition that’s Perfect for small commercial projects." rgb(128, 128, 128) on rgb(255, 255, 255)
  • 3.95:1 (needs 4.5:1) — "Great for organizations with single business units that need to collec" rgb(128, 128, 128) on rgb(255, 255, 255)
  • 3.95:1 (needs 4.5:1) — "Optimized for Critical Environments and Enterprise SOCs." rgb(128, 128, 128) on rgb(255, 255, 255)
  • 3.95:1 (needs 4.5:1) — "Perfect for those looking to concentrate on data analysis by outsourci" rgb(128, 128, 128) on rgb(255, 255, 255)
  • 4.04:1 (needs 4.5:1) — "About Gravwell" rgb(128, 128, 128) on rgb(44, 25, 62)
  • 4.04:1 (needs 4.5:1) — "Careers" rgb(128, 128, 128) on rgb(44, 25, 62)
  • 4.04:1 (needs 4.5:1) — "Newsroom" rgb(128, 128, 128) on rgb(44, 25, 62)
  • 4.04:1 (needs 4.5:1) — "Partners" rgb(128, 128, 128) on rgb(44, 25, 62)
Why it matters

Low contrast text is unreadable in sunlight, on older screens, and for the roughly one in twelve people with colour vision deficiency. It is also the single most litigated WCAG failure.

Fix
Raise text and background contrast to at least 4.5:1 for body copy and 3:1 for text 24px and above.

No privacy policy or terms link

code · transparency
high observed quick win

No privacy policy, terms, or cookie link found anywhere on the page.

Why it matters

Missing legal and contact information is a trust signal problem and, in most jurisdictions, a compliance one.

Fix
Add privacy policy, terms, and contact links to the footer on every page.

Third party trackers loading before consent

code · weak disclosure
high observed quick win

5 tracking script(s) load with no privacy disclosure on the page.

Evidence
  • scripts.clarity.ms
  • www.clarity.ms
  • www.google-analytics.com
  • www.googletagmanager.com
  • js.hubspot.com
Why it matters

Loading trackers without disclosure creates regulatory exposure and erodes trust if discovered.

Fix
Gate non-essential trackers behind consent and link a clear privacy notice.

No terms of service

code · legal pages
medium observed quick win

No terms of service found. Not linked from the page and not at /terms or /terms-of-service.

Evidence
  • https://www.gravwell.io/terms
  • https://www.gravwell.io/terms-of-service
Why it matters

Without published terms there is no agreed basis for the relationship, no limitation of liability, and nothing to point to in a dispute.

Fix
Publish terms of service and link them in the footer alongside the privacy policy.

No cookie policy

code · legal pages
medium observed quick win

No cookie policy found. Not linked from the page and not at /cookies or /cookie-policy.

Evidence
  • https://www.gravwell.io/cookies
  • https://www.gravwell.io/cookie-policy
Why it matters

If the site sets non-essential cookies it has to say which, why, and for how long. A privacy policy alone does not cover it.

Fix
Publish a cookie policy listing each cookie, its purpose, and its lifetime, and link it from the consent banner.

Missing title, description, canonical, or Open Graph

code · transparency
low observed quick win

Incomplete Open Graph tags. Shared links will render without a preview card.

Why it matters

Missing metadata weakens search results and makes shared links render as bare URLs, costing click-through.

Fix
Add a unique title and meta description, a canonical link, and complete Open Graph tags including an image.

No accessibility statement

code · accessibility risk
low observed quick win

No accessibility statement linked. Required for public sector bodies in the UK and EU, and expected by enterprise procurement everywhere else.

Why it matters

An accessibility statement is required for public sector bodies in the UK and EU, and is a standard question in enterprise procurement.

Fix
Publish an accessibility statement covering your conformance target, known gaps, and a contact route for problems.
About these fixes

Every fix above is deliberately high level

Each one names what to change and why, which is enough to act on. What it leaves out is the reasoning underneath: which to do first given how people actually move through your funnel, what the replacement should say in your voice, and whether the change still holds once someone is inside the product rather than looking at the page.

Every recommendation we make is backed by a framework and a method, and tested against two things at once: whether it helps the person using the product, and whether it helps the business. A change that wins one and costs the other is not a fix, it is a trade nobody agreed to.

That is why we describe this as product design rather than visual work. If the thinking in this report is useful, the same thinking applied with your data in the room is where it compounds.

Talk through the fixes
Section 05

Code analysis

Measured directly from the rendered page. These are facts, not judgements.

MetricValueRead
HTTP status200OK
First contentful paint380 msWithin budget
DOM content loaded749 msWithin budget
Requests93Over budget
Transferred1.12 MBWithin budget
DOM nodes497Reasonable
Console errors0Clean
Third party script domains19High
Images / links / forms14 / 45 / 0Inventory
Legal and compliance

Checked directly, not inferred

CheckResultDetail
robots.txtPresentHTTP 200
SitemapPresent198 URLs at https://www.gravwell.io/sitemap.xml
Privacy policyMissingNot found
Terms of serviceMissingNot found
Cookie policyMissingNot found
Cookie consentPresent5 tracking domain(s) loading
HSTSEnabledStrict-Transport-Security header
Accessibility statementNot linkedExpected in public sector and enterprise procurement
Detected in code

14 signal(s)

SignalSeverityDetail
Heading structure broken or multiple H1lowHeading levels skip 3 time(s), breaking the outline.
Text below WCAG AA contrasthigh13 text element(s) fail WCAG AA contrast. Worst is 3.95:1 against a required 4.5:1.
Body text under 14pxmedium1 block(s) of body copy set below 14px.
Touch targets under 44px on mobilemedium13 tappable element(s) under the 44px minimum on a 390px viewport.
Vague link text such as click here or read morelow2 link(s) use non-descriptive text.
Page weight or request count above budgethigh93 requests, ~1.1 MB transferred (budget: 80 requests / 2.5 MB).
Page weight or request count above budgetmedium7 image(s) shipped far larger than displayed.
No privacy policy or terms linkhighNo privacy policy, terms, or cookie link found anywhere on the page.
Missing title, description, canonical, or Open GraphlowIncomplete Open Graph tags. Shared links will render without a preview card.
Third party trackers loading before consenthigh5 tracking script(s) load with no privacy disclosure on the page.
No privacy policycriticalNo privacy policy found. Not linked from the page and not at /privacy or /privacy-policy.
No terms of servicemediumNo terms of service found. Not linked from the page and not at /terms or /terms-of-service.
No cookie policymediumNo cookie policy found. Not linked from the page and not at /cookies or /cookie-policy.
No accessibility statementlowNo accessibility statement linked. Required for public sector bodies in the UK and EU, and expected by enterprise procurement everywhere else.
Section 06

What we looked at

Desktop, above the fold (1440x900)
Mobile, above the fold (390x844)
Desktop, scrolled section 2
Desktop, scrolled section 3
Desktop, scrolled section 4
Desktop, scrolled section 5
Desktop, scrolled section 6

Static capture only. Anything behind a click, a login, or a payment step was not exercised and is flagged as a risk rather than a confirmed fault. Findings marked "likely" or "possible" need a live walkthrough to confirm. Scores are the framework's weighting of severity and confidence, not an industry benchmark. Generated by UX Signal Studio using the UX Risk framework.

Section 07

Art direction

Design verdict

Working against the sale

Opinion, not measurement

The palette is neon yellow on a purple and maroon gradient. The Cyber audience is represented by a cartoon spy in a fedora. The AI feature is introduced by a large white cartoon robot with oversized eyes, named Logbot AI. The surrounding copy runs on Launch your next mission, hunting threats down, and a never-ending game of Whack-a-Mole.

This is a design judgement rather than a measurement, and it is the one we would raise first in a room. The page is dressed as a game universe and sold to a security operations leader with a 70,000 dollar budget and a procurement process. Every element is competently made, but together they read as playful rather than credible, and credibility is the entire purchase decision for a platform that will hold an organisation's log data. The tell is the mismatch: the copy claims 40 percent less compute than competitors and a Forrester-verified 264 percent ROI, and the illustration next to it is a smiling robot. A buyer forwarding this page to a CISO has to apologise for it.

What we would do instead
Keep the confidence and the distinctiveness, drop the cartoon. The yellow can stay as an accent rather than the dominant note. Replace the mascot and the fedora icon with the product: the pipeline query language mid-analysis, a real dashboard, a trace of a threat being hunted. Let the Forrester number and the pricing carry the tone. Distinctive and serious are not opposites, and this team has earned serious.

Everything else in this report is measured or quoted. This section is not. It is a design judgement, offered because the gap between the imagery and the product is the kind of thing a scan will never flag and a buyer will always feel.

Section 08

This is the surface

A scan reads one page the way a stranger does. It can tell you the category is missing from the hero and that the closing call to action contradicts its own copy.

What it cannot do is decide what the product should promise, or design the flow that keeps that promise once someone is inside it. Everything in this report is above the signup. The compounding return is below it.

What a scan reaches
  • One public page, as a first-time visitor sees it
  • Copy, hierarchy, and the first five seconds
  • Accessibility, performance, and consent in the markup
What it does not
  • Signup, checkout, and cancellation, end to end
  • The product itself, once someone is inside it
  • What to build next, and what to stop building
Ash · UX Signal Studio · uxsignalstudio.com