Security & governance
Access control, data isolation and auditability
The value of a qualification record depends entirely on whether it can be quietly altered. These are the controls that make the record worth relying on.
Deny by default
Permissions are granted explicitly through roles. Nothing is readable or writable because a screen happens to request it.
Roles held separately
Role assignments live in their own store, separate from user profiles, and are evaluated server-side — a profile cannot promote itself.
Tenant-scoped data
Records are scoped to the owning organisation and enforced in the database layer, not only in the interface.
Employee data isolation
Employees see their own training, qualifications and work. Broader visibility requires an explicit management role.
Server-side scoring and sessions
Assessment scoring, allocation and work-session timing are computed on the server. The browser reports intent, not outcomes.
Append-only history
Acknowledgements, sign-offs, session events and manager interventions are added, never rewritten in place.
Private document storage
Training documents sit in private storage with direct browser access blocked; access is issued server-side and time-limited.
Fail-closed gates
Missing evidence, stale attendance or an unresolvable competency stop the work. There is no path where absent documentation grants access.
What we do not claim
Review the controls against your own requirements
We can walk your security or operations lead through the permission model, the isolation rules and the audit history the platform keeps.