Trust
Written for someone who will be asked how they knew.
A registrar can be asked, in a legal proceeding, how she knew a person was competent. We wrote every answer on this page so that she could repeat it under that pressure without adding anything.
The floor procurement checks first.
- SOC 2 Type II certified, independently audited annually
- Canadian data residency. Learner and credential data stays in Canada
- PIPEDA and FOIP-aligned handling. Biometric data is never sold or shared
- Encryption in transit and at rest, with keys managed separately from data
- Role-based access, least privilege, and mandatory MFA for administrators
- Annual third-party penetration testing, reports on request
- Documented retention, secure destruction, and a 72-hour incident notification commitment
Canadian owned and operated. Learner and credential data stays in Canada.
Answers on the record
The questions we get asked, answered the same way every time.
Who owns the signing keys?
You do. They sit in escrow on your behalf, and you leave with them.
Who pays to verify?
Nobody. Basic verification is free, and the issuer pays for issuance.
Do you accredit issuers?
No. Our gate is technical conformance only, which means W3C conformant, identity-bound and supervised. That is not accreditation and we will not describe it as one.
Whose standard is it?
Yours. Your standard and your brand stay yours. We are the rails underneath.
What happens if we leave?
You take the keys and the data, and everything you have issued stays verifiable, because it never depended on us to begin with.
What happens if you are not here in ten years?
The same answer. Your credentials are signed by your key on an open standard, so anyone with a conformant verifier can check them. Continuity is a property of the standard, not a promise from us.
How does this sit with ISO/IEC 17024?
17024 requires a certification body to keep the certification decision independent of the training. That is the shape a conformant supplier has to take.
Audit trail
The audit trail is the deliverable.
Immutable event logs from first login through to issuance, exportable on request. When a regulator asks what happened, you hand them a file rather than reconstructing an answer.
What the evidence package holds- 09:02:14Account created
- 09:04:41Identity verified against government document
- 09:31:07Session started, presence confirmed
- 11:48:52Assessment submitted
- 11:49:03Credential issued and signed
- 11:49:03Log sealed