What "audit-ready" should mean
Elumio is built for stronger evidence — without claiming we replace your legal counsel or a regulator's own registry.
- Exportable rows for the period asked — not only a dashboard screenshot.
- Server-side watch + gated exam behind the status — not "Completed" with no watch proof.
- Serial + QR → public valid / revoked / expired — not editable PDF certificates only.
- A pack you can regenerate with a checksum — not a ZIP assembled the night before.
What's in an audit pack
Depending on what you select (person or organisation), an audit pack typically includes a summary of training status, the underlying rows (who / course / dates / outcomes), and a checksum so recipients can tell if the file was altered after export. Use it when someone wants the whole picture — not only one QR on one PDF.
Included on Starter and above. Free includes them as a trial capability.
The completion behind the rows
Rows are only as strong as the completion rules. That's how "Passed" in a report means more than "opened the module."
- Watch credit calculated on the server from intervals actually reached.
- Strict mode when you need non-skippable mandatory lectures.
- Exams that unlock only after required video is genuinely finished.
- Certificates issued on pass — publicly re-checkable without an LMS login.
Coverage you can see before someone asks
Trainers and compliance leads need to know who's current before the email from the auditor: who has watched, who has passed, whose refresher or certificate is due.
Email reminders before a certificate expires when enabled for the course — so refreshers don't sneak up on you or your client.
Who this is for
Ops and compliance leads who get asked for training evidence on short notice; agencies and BPOs that must show clients roster-level proof; training organisations that need exportable records and certificates issued under your organisation's name.
What we don't claim
Elumio is not a substitute for legal or regulatory advice. An audit pack is evidence of what the platform recorded, not a guarantee of regulatory compliance. We don't claim SOC 2 / ISO today. We don't issue government credentials (e.g. DOLE BOSH) — if you are an accredited training center, certificates stay under your name. We limit claims to shipped evidence: coverage and checksummed audit packs — not client-room depth or unbuilt attestation.
How it fits the rest of Elumio
Run BYO courses on the platform. Trainees watch → exam → certificate (QR). When asked: export an audit pack and/or share public verify links. Optional: scoped client views for external stakeholders (Business and Scale only — not Starter, Pro, or Free).
Related questions
How do you know a trainee actually watched the video?
Watch credit is calculated on the server, from intervals actually reached — not from where the playhead sits. A dragged slider or an idle tab banks nothing.
Rewinding is always free; it is skipping ahead that is restricted. Strict mode is a per-course switch, so optional material can stay freely browsable while mandatory training is locked down. Watching faster than the permitted rate earns no extra credit.
How does certificate verification work?
Every pass issues a PDF containing the holder's name, the course, the dates, a serial number and a QR code.
Scanning the QR opens a public page that reports one of three states — valid, revoked, or expired — checked against the issuing organisation's records. No login and no Elumio relationship is required for whoever is checking.
Expired is deliberately not the same as fake: the page says the training happened and is due to be retaken.
On a custom training address the verification page may wear that organisation's theme, and it answers only for certificates that organisation issued. elumio.io/verify stays the global check, in Elumio's theme, for any certificate.
Can I hand an auditor everything at once, rather than certificate by certificate?
Yes. An audit pack covers one person or your whole organisation: a PDF summary with a CSV of the underlying rows, and a checksum that shows the file has not been altered since it was generated. The pack itself can be checked from the same public verification page a certificate uses.
It states its own method rather than leaving it to be assumed. It says what watch evidence does and does not prove, shows refused progress reports as anomalies instead of quietly dropping them, records which revision of the course each person actually did, and marks rows for courses that carry no assessment as completed with the attempt columns blank — because there was nothing to attempt, not because something is missing.
It reports what Elumio recorded. It does not assert that anyone is or is not compliant — that judgement belongs to the reader, and the pack says so in as many words.
Which plans include audit packs?
Included on Starter and above. Free includes them as a trial capability.
Can I show a client how their own staff are doing?
Yes, with a client view: a read-only page covering the trainees you choose, which you publish and can revoke at any time.
It is the one feature that discloses a named person outside your organisation, so it is deliberate at every step — you pick who is included rather than sharing a whole roster, and revoking kills the link for anyone holding it.
Client views are available on Business and Scale only.
Does anyone get warned before a certificate expires?
Yes, and both sides are told without anyone having to remember. The trainee is emailed before their own certificate lapses, and the trainer receives a digest of everyone across their courses who is coming due — so a refresher gets scheduled rather than discovered late.
How far ahead that email goes out is set per course, because a quarterly refresher and an annual one do not need the same notice. Seven days is the default.
The cohort screen flags anyone expiring within thirty days, separately from the emails. That is the planning view a trainer opens on purpose; the email is the nudge that arrives when the date is close enough to act on.
Is Elumio SOC 2 or ISO 27001 certified?
No. We hold no third-party security certifications at this time, and we would rather say so than imply otherwise.
What we can describe is what the platform actually does: encrypted transport, daily backups, authorisation re-derived on the server for every request, rate limiting on authentication, and an audit trail of trainer actions. If your procurement process requires a formal certification, we are not yet the right fit.