Customer Data and Storage

This policy explains where your organisation's data actually lives on Shog Corporate Training, how it is separated from every other customer's, what changes when you connect your own storage, and what you can take away. It is for customer organisations and their IT and compliance reviewers.

Three databases

The platform does not keep all customers in one table with a customer column. It uses three kinds of database.

The platform database. The account layer. Organisations, administrator accounts, subscriptions and the pointers that say where an organisation's own database lives. It holds no learner records.

One database per organisation. Your attendees, enrolments, progress, assessment records, certificate records, the index of your files and your audit log. This database belongs to your organisation alone.

The shared catalogue. Course content: modules, assessments, versions, and the Arabic and English authorings of each course. Course content is our intellectual property and is the same for every customer. It contains no personal data.

The consequence is the one that matters to a reviewer. Your learners' records are physically separated from every other organisation's. Separation is not enforced by a filter that a developer could forget to apply; the query runs against your database, and your database contains only your data.

Encryption

Learner names, email addresses and phone numbers are encrypted at rest with AES-256-GCM. Each organisation has its own data keys, so ciphertext written for one organisation cannot be read with another organisation's key. Key management uses OCI Vault in production.

Traffic to the service is encrypted in transit with TLS.

Where a field has to be searchable while encrypted, for example finding an attendee by email address, the lookup uses a keyed one-way digest rather than storing the value in the clear.

Where files live

Certificates, identity photographs and signed identity declarations are files. Where they are written depends on one choice you make.

If you connect your own storage. During setup, an administrator can connect the organisation's Microsoft SharePoint, Microsoft OneDrive or Google Drive. One provider per organisation. Once connected, certificate files, identity photographs and signed declarations are written into your storage and not to us. We do not keep a copy.

If you do not connect storage. You cannot enrol anyone. Connecting a storage provider is a precondition of the first enrolment, not an option offered afterwards, because an enrolment produces a certificate and identity evidence and there would be nowhere to put them. We do not hold those files as a fallback.

Either way, course content, marketing images and anything you send to support stays on our side. Course videos are ours and are served from our storage, so a module never fails to play because a customer's Drive is unavailable.

We hold the record, not the file

This is the single idea that makes the storage model work, and it is worth being precise about.

A certificate has two halves. The record is the data: certificate number, course title, the module set as it stood on the issue date, the language version taken, the score, the pass mark applied, the issue date, the expiry date and the status. The file is the document a person can open and read.

The record always stays in your organisation's database with us. The file goes wherever your storage choice sends it.

In practice:

• Public verification at the verification page reads the record. It never reads the file. A certificate stays verifiable even if the file has been moved, renamed or put out of our reach.
• You can rename our folder inside your Drive, move it, or revoke our access, and no certificate becomes invalid. A file we cannot currently reach is never mistaken for a certificate that was never earned.
• If your storage provider is down when a certificate would be written, the record is still created and the file is written when the provider is reachable again.
• Because we index each stored file by the provider's own file identifier rather than by its path, moving or renaming a folder on your side does not lose the link to the file.

The cost of this design is that we cannot show you a file we do not hold. If you have revoked our access to your Drive, the platform can tell you a certificate exists and everything it asserts, but it cannot open the document for you. Restore access, and it can.

Auditor preview access

You can grant a named auditor time-limited preview access to your training evidence. Access is scoped to your organisation, it expires, and you can revoke it. Every grant and every revocation is recorded in your audit log.

The audit log

Each organisation has its own event log covering the actions that matter for evidence: enrolments, completions, certificate issue and revocation, storage connection changes, auditor grants, administrator sign-ins and administrative changes. It lives in your database and it is included in your export.

Export

You can export your full data set at any time during your subscription, without asking us. The export covers attendees, enrolments, certificates, assessment records and the audit log.

Use it to satisfy an inspection, to feed your own HR or GRC system, or to take your data with you. There is no charge for it and no volume gate.

When your subscription ends you have 30 days to run a final export, after which your organisation's data is securely deleted. The Data Retention and Deletion policy sets out what goes and when.

Disconnecting or switching storage, and the limit we impose

Here is the honest limitation.

While evidence files exist in your connected storage, the platform refuses to disconnect that storage or to switch you to a different provider.

The reason is that a switch would leave your evidence split across two places with nothing tying the halves together, or would silently orphan files that an auditor will later ask you to produce. We would rather refuse the operation than leave you with a broken evidence trail and no way to tell.

What this means for you:

• Decide your storage provider before you begin issuing certificates. A connection made at setup is straightforward. A change made after two years of certificates is not.
• If you need to move providers, contact us at training@shogconsulting.com and plan it as a migration, not as a settings change. Any such move needs an agreed approach for the files already written.
• Connecting storage for the first time is not affected. If you started without a connector and connect one later, new files are written to your storage from that point.

We think that is the right trade, but you should know it before you buy rather than discover it on the day you decide to change tenant.

Access on our side

Our people access your workspace only where it is needed to run or support the service, and they are bound by confidentiality. Administrative access is limited to the personnel who need it. Administrative actions are recorded.

We do not use your data for our own purposes, we do not sell it, and we do not use it to train models.

Hosting

The service, your organisation's database and the key vault are hosted on Oracle Cloud Infrastructure in the Middle East region. Our object storage on the same infrastructure holds platform material such as course videos and article images, which are ours rather than yours. Where you connect your own SharePoint, OneDrive or Google Drive, the location of the files written there is determined by your own tenant configuration, not by us.

What we do not claim

We do not hold an independent security certification such as ISO 27001 or SOC 2, and nothing here should be read as claiming one. We do not publish an uptime figure or a recovery time objective. Where your own policy requires a commitment of that kind, raise it before purchase so it can be recorded on your order form.