Security, hosting and data retention

How your training, document and audit records are hosted, protected and kept.

Hosting

Application data is held in managed cloud data centres in the European Union, with the application served through a global network for speed.
Databases are backed up automatically every day, with point-in-time recovery available on request.
Infrastructure providers are listed on our Trust page as sub-processors.

All traffic is encrypted in transit with TLS 1.2 or higher.
Databases, backups and stored files are encrypted at rest with AES-256.
Kiosk PINs and passwords are stored only as salted one-way hashes and can never be read back.
Evidence files are private and opened only through short-lived signed links.

Every organisation's records carry its identifier, and row-level security in the database refuses any read or change across organisations.
Isolation is tested automatically against the live database: a user in one organisation receives no rows and a refusal when trying to reach another.
Site scoping applies inside each organisation, so a site manager sees only the sites assigned to them.

Platform admin: our support team, the only role able to set up or switch organisations.
Client admin: runs one organisation end to end.
Site manager: approves and publishes for assigned sites.
Supervisor: oversees their own team, observes competencies and signs off shifts.
Employee: completes their own training, forms, routines and document sign-offs.
Auditor: reads registers, evidence and the audit trail for one organisation, and cannot change anything.

Two-step sign-in with an authenticator app is available to everyone and can be made mandatory for supervisors, managers and administrators.
Single sign-on details for SAML 2.0 and OpenID Connect can be recorded per organisation and are connected with your IT team.
Each organisation chooses how long an idle session lasts before it signs out automatically, from 15 minutes to 8 hours.

Sign-ins, approvals, signatures, role changes and refused access attempts are written to an append-only log.
Each entry is chained to the one before with a SHA-256 fingerprint, so any alteration is detectable, and the database blocks edits and deletions.

Training, document and audit records are kept for seven years by default, configurable per organisation to suit your regulator.
Leavers are archived rather than deleted, so their training history remains available for audit.
On contract end you can export every record, after which data is deleted within 90 days and backups age out within a further 35 days.

Tete is not yet certified to ISO 27001 or Cyber Essentials. Certification status is kept up to date on the Trust page.