Certificates and evidence

The output of training is not a score. It is proof that a named person read specific material and demonstrated they understood it, on a date you can produce later.

Passing

A participant passes by meeting the test's pass mark within the allowed attempts. Their best score is kept, along with how many attempts they used.

Best score rather than latest is deliberate: someone who passed on the second attempt has met the requirement, and a later practice run that went worse should not take that away.

Certificates

A certificate is generated automatically the first time someone passes. They can download it from their own link; you can see it against their assignment.

Each carries a unique certificate ID in the form CERT-XXXX-XXXX. Certificates are generated once — a participant who retakes the test later does not get a second one for the same task, so the ID stays a stable reference to that completion.

The evidence that actually matters

The certificate is what people ask for. The acknowledgement trail is what stands up.

For every document, the platform records that this participant confirmed reading it, when, and from what IP address. Combined with the test result, that is a defensible chain: the material existed in this form, this person confirmed reading it on this date, and then demonstrated understanding by passing.

"We emailed the policy to all staff" is not that. It is evidence of sending, not of reading, and it is the gap auditors ask about.

GOTCHA: replacing a document does not re-acknowledge it. Acknowledgements attach to the document that was there when they were given. If a policy changes materially, the honest response is a new task, so the trail shows who confirmed the new version rather than implying the old confirmations covered it.

Retention

Training records are your own employment records, and they are not covered by the candidate-retention sweep described in Account and security — that applies to hiring candidates.

This is usually what you want, because the retention period for compliance evidence is set by whatever regime requires the training, and it typically outlasts anything sensible for a job applicant. It does mean the decision is yours: nothing expires this data automatically, so if your obligation ends after a fixed number of years, apply that yourself.

Keep in mind these are records about identifiable employees. "We keep it forever because nothing deletes it" is not a retention policy, and under GDPR it is not a defensible one.

What to keep

Do not delete completed tasks or deactivated participants. Between them they hold the material, the acknowledgements, the results and the certificates — and the value of training evidence is almost entirely retrospective. You will want it on the day someone asks about a year you had stopped thinking about.