Governance, data and the honest limits

Everything stays where you put it

elmo installs onto a Kubernetes cluster you already operate — in your own data centre, or in your own cloud subscription. The database is a pod beside it, on storage you provisioned. The courses are applications in the same cluster. There is no tenant of ours holding your records, no analytics pipeline pointed at someone else’s warehouse, and nothing about running it requires an outbound connection to us.

That is not a privacy feature bolted on afterwards. It is why the hardest question a training platform normally raises — where does this data go, and under whose law — mostly stops being a question. A transfer you never make needs no legal basis.

Sign-in is your own directory or an address and a password. When it is your directory, the tokens are verified once and discarded; nothing from the identity provider is stored or set as a cookie, and one person is one record whichever door they came through.

What counts as personal data here

More than a name and an address. A training platform records what someone read, when they read it, how long they spent, and how they scored — and the last three are monitoring data about an employee, not administrative trivia. We would rather say that plainly than let it arrive as a surprise during a works-council conversation.

So the design assumes it will be argued about:

• The measurement is bounded and stated. Time accrues only while a page is visible, focused and being used; a single visit contributes at most half an hour; and every figure is re-derived on the server rather than believed from the browser.
• Reporting flags, it never gates. No completion is withheld and nobody is failed by a number. A verdict sits beside the percentage for a human to look at, and where there is not enough data to judge, the report says so instead of guessing.
• The learner sees their own record. Every page, every attempt, their own engaged time. What they are not shown is the judgement about that time — a flag with an honest explanation is useful to a supervisor and becomes an accusation when handed to its subject.
• Ending access does not delete the record. A class ending stops the courses opening and leaves the transcript intact, which is the only arrangement under which “we can show the training happened” and “their access ended on Friday” are both true.

Who can see whose record

A supervisor sees exactly the people assigned to them and nobody else. Asked about anyone outside that list, the platform answers as though the person does not exist rather than as though the answer is forbidden — the difference matters, because a refusal confirms that the record is there and lets a list be walked one address at a time.

Roles are not job titles with privileges attached. An administrator composes a role out of named actions and hands out as many as fit how your organisation is actually shaped. Nothing in the code asks whether somebody is “an HR user”; it asks whether they hold the action in front of it, which is why a role you invent works everywhere immediately and why nobody can quietly accumulate authority through a job-title change.

What we will not claim

• Compliant with anything, and no certification. We hold none. What we can do is show you where each record lives, who can read it, and what every figure in a report means — and let your own reviewer decide.
• That a course cannot be copied. Anything a browser renders can be taken. elmo refuses the cheap bulk paths, throttles them, and records who asked for what; it does not make courseware uncopyable, and a vendor who tells you otherwise is selling you a feeling.
• That engaged time measures reading. It measures that a page was open, in front, and being used. Nothing can honestly claim more, and a number that implied it would be worse than no number.
• Any uptime, throughput or service-level guarantee, and no customer logo, named or anonymised.

The limits, in writing, before you commit

Every platform has a list of things it does not yet do and things it does not do well. Ours is written down, and you get it during a pilot rather than discovering it in production — including the cluster-side settings that are yours to make rather than ours to ship, and which we would rather you checked before a class of strangers than after.