Built for organisations that get audited.

WorkReady runs on managed, enterprise-grade cloud infrastructure. There are no self-managed servers and no data on employee machines.

• Application delivered from a globally distributed edge platform, so pages and video load fast wherever your teams work.
• PostgreSQL database, authentication and object storage provided by a managed cloud backend hosted in the UK/EEA.
• Course and site induction video is stored in redundant object storage and streamed over signed, expiring URLs.
• Infrastructure is patched and maintained by the platform provider; we hold no unmanaged operating systems.

• In transit: TLS 1.2+ on every connection, with HTTPS enforced and HSTS enabled.
• At rest: AES-256 encryption of the database, backups and stored media.
• Passwords are never stored in readable form — they are salted and hashed by the authentication service.
• Session tokens are short-lived, signed, and refreshed automatically.

This is the control enterprise buyers ask about most. Separation between organisations is enforced in the database, not in the user interface — so it holds even if an application bug or a crafted request tries to reach past it.

• Every people, progress, certificate, site and report row is tagged with its organisation.
• Row-level security policies restrict every read and write to the signed-in user's own organisation.
• Courses and site walkthroughs are shared to named organisations explicitly; removing access immediately removes it for that organisation's managers and learners.
• Learners can only ever read their own assignments, results and certificates.
• Privileged operations run through tightly scoped, audited server functions rather than broad database access.

• Three roles only: team member, organisation manager, and Fundisa system administrator — least privilege by design.
• Organisation managers are appointed by Fundisa under licence, not self-assigned, so an organisation cannot escalate its own permissions.
• Internal Fundisa access is limited to named staff who need it for support, with individual accounts and no shared credentials.
• Administrative actions are written to a company-scoped audit log visible to the relevant organisation.
• Accounts are created by invitation; the invited person sets their own password via a single-use, expiring link.

• Automated daily backups of the full database, encrypted at rest and retained on a rolling schedule.
• Point-in-time recovery, allowing the database to be restored to a chosen moment rather than only to the last nightly snapshot.
• Object storage for video and documents is replicated across availability zones.
• Recovery objectives: RPO of 24 hours or better, RTO of 24 hours, for a full-platform restore.
• Restores are exercised as part of change management rather than assumed to work.

Backups exist to recover from failure, not to retain data you have asked us to delete — deleted records age out of the backup cycle automatically.

• All input validated on the server; database access uses parameterised queries, so injection is not possible through the application layer.
• Uploads are restricted by type and size, stored outside the application, and served from a separate origin.
• Automated dependency scanning, with security patches applied promptly.
• Secrets are held in managed secret storage and are never committed to source control or exposed to the browser.
• Security reviews accompany every significant change to permissions or data access.

• Monitoring and error tracking flag anomalies in authentication, access and availability.
• On detection we contain first, then assess scope, then remediate — with a written timeline kept throughout.
• Where a personal data breach affects your organisation, we notify your nominated contact without undue delay and within 72 hours of becoming aware, with the facts you need for your own regulatory reporting.
• Post-incident review with corrective actions is shared with affected customers.

We keep the supply chain deliberately short. Each supplier is contracted under a data processing agreement, and we give notice before adding a new one that handles personal data.

• Keep your organisation manager list current and remove leavers promptly.
• Use unique, strong passwords and never share accounts between people — shared accounts break the audit trail and invalidate compliance evidence.
• Only upload content you have the right to distribute, and keep personal data out of free-text course fields.
• Tell us immediately if you suspect an account has been compromised.

Your data stays yours. At any point you can export people, progress and compliance reports as CSV or branded PDF. When a contract ends we provide a final export on request and then delete or irreversibly anonymise your organisation's data within 90 days. Questions, security questionnaires or a copy of our DPA: info@fundisa.co.uk.