Information security

This policy explains expectations for information handled through Vexido. It covers personal information, assessment records, submitted content, credentials and business information. Detailed defensive configurations and internal response procedures are not published here.

Information security is a shared responsibility: Vexido controls the platform functions it provides, service providers operate their services, and users must protect their accounts and disclose information only when authorised.

Administrative tools and learner records must be restricted according to role and purpose. Being a learner, mentor, employer or training provider does not automatically grant administration access or access to someone else’s private report.

Use the minimum information necessary for an activity. Keep proprietary process data, customer drawings, security keys, safety analyses and unpublished commercial information out of general learning forms. An ordinary account is not a secure client data room.

Use authentic records, identify material corrections and avoid presenting a partial or pending result as final. Protect your device and sign-in account. Keep your own authorised copies of important reports; uninterrupted availability or recovery of every browser-only draft is not guaranteed.

Security and dispute evidence may require retention under applicable obligations. Retention and deletion decisions must account for those obligations; a request to erase an account is not permission to falsify records.

Security assurance depends on the service and its scope. Contact Vexido if your organisation requires specific evidence before using a service or sharing information.

Report suspected information exposure promptly through Security reporting. Send the affected URL and a minimal description, not a bulk copy of other users’ information.