Government Portal Development: ESIA, WCAG, Security

Government Portal Development

Government agencies often face a problem: the website fails accessibility checks, citizen data is stored improperly, and searching for documents does not find the needed decrees. We specialize in such projects and know how to avoid these errors. Our experience spans over a decade and dozens of completed portals for government organizations in Russia and Belarus. We cover the regulatory framework, WCAG requirements, ESIA integration, and personal data protection.

Legislative Framework

In Belarus, requirements are defined by the Law 'On Electronic Document and Electronic Digital Signature' and decrees on state information resources. In Russia — Federal Law 149 'On Information', Federal Law 152 'On Personal Data', Regulation No. 477 (current version). The mandatory sections for official government websites include: information about the authority, regulatory documents, public services, inspection results, anti-corruption materials. We consider all norms at the design stage to avoid rework after an audit.

Why WCAG 2.1 AA Is Mandatory for Government Sites?

It is not a recommendation but a law. GOST R 52872 references WCAG 2.1. Testing is performed automatically (axe-core, Lighthouse) and manually. Typical problems include missing form labels and incorrect table structure. Example of a correct search form:

<!-- Incorrect: search form without label --> <input type="search" placeholder="Search site"> <!-- Correct --> <label for="site-search" class="sr-only">Search site</label> <input id="site-search" type="search" placeholder="Search site" role="searchbox" aria-label="Search site"> <!-- Correct table with headers --> <table> <caption>Management contacts</caption> <thead> <tr> <th scope="col">Full name</th> <th scope="col">Position</th> <th scope="col">Phone</th> </tr> </thead> <tbody> <tr> <td>Ivanov Ivan Ivanovich</td> <td>Department head</td> <td>+375 17 000-00-00</td> </tr> </tbody> </table> 

All PDF documents must be tagged PDFs with logical structure and alt texts. We check every element for WCAG compliance. Get a consultation on your project to avoid these errors.

How ESIA Integration Improves User Experience?

For citizen personal accounts, integration with the state identification system is mandatory. In Belarus — ESIA or ID-card, in Russia — Gosuslugi portal via SAML 2.0 or OpenID Connect. Example of ESIA connection via OAuth 2.0 (Laravel):

// Laravel: redirect to ESIA authorization public function redirectToEsia() { $params = [ 'client_id' => config('esia.client_id'), 'response_type' => 'code', 'scope' => 'openid fullname email mobile snils', 'redirect_uri' => route('esia.callback'), 'state' => csrf_token(), 'timestamp' => now()->format('Y.m.d H:i:s O'), 'access_type' => 'online', ]; // Request signature via PKCS#7 (mandatory for ESIA) $params['client_secret'] = $this->signRequest($params); return redirect(config('esia.auth_url') . '?' . http_build_query($params)); } 

Requests are signed with a qualified certificate — it must be obtained from a certification authority. Integration improves login security and allows data to be retrieved from government systems.

Personal Data Protection and Hosting Choice

Federal Law 152 requires storing citizens' personal data on servers in the Russian Federation. Similar laws apply in Belarus. We choose hosting only from local data centers. Mandatory security headers:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "SAMEORIGIN" always; add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-{NONCE}'; style-src 'self' 'unsafe-inline'" always; add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always; 

Additionally, we configure two-factor authentication for employees and encrypt data in the database. Our engineers hold information security certificates. We guarantee compliance with regulatory requirements.

Document Search: Elasticsearch vs PostgreSQL

Government agencies accumulate thousands of documents. Simple SQL search handles Russian morphology poorly. We use two approaches. For archives over 100k documents, Elasticsearch is 4 times faster in search speed than PostgreSQL.

Example of a full-text index in PostgreSQL:

CREATE INDEX docs_fts_idx ON documents USING GIN (to_tsvector('russian', title || ' ' || content)); SELECT id, title, ts_rank(to_tsvector('russian', title || ' ' || content), query) AS rank FROM documents, to_tsquery('russian', 'privatization & housing') query WHERE to_tsvector('russian', title || ' ' || content) @@ query ORDER BY rank DESC LIMIT 20; 

For archives over 100k documents, we use Elasticsearch with Russian morphology configuration. We use the analysis-morphology plugin and define an analyzer in the index settings.

Versioning and Archiving of Regulatory Documents

Documents must retain a history of revisions. The user sees the current version and can open previous ones. We implement via a revisions table:

CREATE TABLE document_revisions ( id BIGSERIAL PRIMARY KEY, document_id BIGINT REFERENCES documents(id), content TEXT NOT NULL, revision_note TEXT, created_by BIGINT REFERENCES users(id), created_at TIMESTAMPTZ DEFAULT NOW(), effective_from DATE, effective_to DATE ); 

Multilingualism and Performance

For agencies working with national minorities, the portal supports multiple languages. hreflang in head, separate URLs (/ru/, /be/, /en/), localStorage for language persistence. According to SLA, availability must be 99.5% or higher — we set up server redundancy and monitoring with alerting.

What Is Included in the Work?

• Requirements analysis and regulatory framework review
• Architecture design (database, infrastructure, integrations)
• Design and layout compliant with WCAG 2.1 AA (layout per GOST)
• Backend development on Laravel / Django
• Integration with ESIA / Gosuslugi
• Full-text search (Elasticsearch or PostgreSQL)
• Testing (a11y, load, security)
• Deployment on customer's servers
• Documentation and staff training
• 6-month warranty support

Timeline

Cost is calculated individually after requirements audit. Contact us — we will evaluate your project within 2 days. Our engineers hold information security certificates and have experience with government clients. Order turnkey portal development — get a reliable solution compliant with all laws.