Security
You would be uploading controlled procedures — documents that describe how your plant actually works. This page says what protects them, and, just as importantly, what is not in place yet. Deciding whether that is enough is your call, and you cannot make it on a page that only lists good news.
Access
- Passwords are hashed with bcrypt. Nobody at QualiTrain can read them, and an administrator adding a user is encouraged to send a reset link rather than set a password they would then know.
- Sessions are signed tokens in an httpOnly cookie, so page scripts cannot read them. Changing a password or choosing “sign out everywhere” invalidates every existing session immediately.
- Repeated failed sign-ins lock the account temporarily. The lockout is stored in the database, so restarting the service does not clear it.
- Password reset links are single use, expire after an hour, and are stored only as a hash — a copy of the database does not yield a usable link.
Separation between organizations
- Every business record carries an organization id, and every query is filtered by the organization on the signed-in session rather than by anything supplied in a request.
- Roles limit what a person can reach: employees see their own training, supervisors sign off their own reports, quality managers manage content, administrators manage the organization. Provider cost and margin data is not visible to any customer role at all.
- Automated tests assert the separation, including that one organization's credit ledger and wallet cannot be touched from another.
- QualiTrain staff can enter your organization. A platform administrator can open any customer workspace to support it, which means they can see your documents, employees and records. Both entering and leaving are written to your audit trail with their name on it, and the product shows a permanent banner while they are in there. We would rather you read that here than discover it: it is a real capability, and the audit trail is what keeps us accountable for it.
Your documents
- Uploaded files are stored outside the web root, in a directory namespaced per organization. There is no public URL for a document, a video or an audio file.
- Files are served through authenticated routes that re-check both the session and that the file belongs to that organization before a single byte is returned.
- Uploads are validated by type and size before being written.
- Your procedures are used to generate your training and nothing else. They are not used to train models.
Evidence
- Document uploads, revisions, AI generation, approvals, assignments, assessment attempts, competency decisions and sign-offs are all recorded with who did it and when.
- Credit movements are an append-only ledger. Entries are never edited or deleted — a correction is a new entry, so the original and the correction both survive.
- Deleting an employee who holds training records is refused outright. Deactivating them keeps the evidence and removes them from the active matrix.
What is not in place yet
QualiTrain AI is early. These are real gaps, not roadmap marketing, and you should weigh them before uploading anything you would not want to lose or disclose.
- No third-party security certification. No SOC 2 report, no ISO 27001, no independent penetration test.
- No single sign-on or SCIM provisioning. Accounts are managed inside the product.
- No customer-managed encryption keys, and no contractual data residency commitment.
- No published backup and recovery guarantee. Ask us what the current arrangement is rather than assuming one.
- Two-factor authentication is not available yet.
If one of these is a blocker for your site, say so — it is more useful to know that than to have you find out later.
QualiTrain AI supports your training and competency process. It does not replace your quality management system, and no output of it constitutes regulatory approval.