Security and compliance

Synthetic data only

No real merchant bank statement, application or merchant personal information enters this platform in any environment — including test fixtures and seed data. The platform does hold learners’ own account data, such as names, email addresses and sign-in IP addresses, as our privacy policy describes. Every document path is designed to validate synthetic provenance and reject anything else. Training files in this program are synthetic and created by us. Assessed labs, when they open, will use files with deliberately planted anomalies and a known correct answer.

We never hold real merchant records, so a breach of this platform should not be able to expose them.

Status

Accessibility

We build to WCAG 2.2 Level AA as a requirement rather than a remediation phase: full keyboard operation, visible focus, semantic structure, no meaning carried by colour alone, and timing accommodations will be designed into proctored assessments, not bolted on.

Records and audit

Sign-in, enrollment and assessment events are written to an append-only audit log: the database refuses edits and deletions. Each event is timestamped; actor and reason are not yet required on every event. Credential issuance and revocation will follow the same rule when credentials are issued. Deactivating a person is designed to retain their training record.