SkillSignature / Operational readiness

International standards

What we target, what needs evidence, and which standards inform our assessment process.

This is an owner-authored readiness statement, not a declaration of GDPR or WCAG compliance, an independent audit, or ISO certification or accreditation. Official public summaries inform these references; a licensed full-standard review and qualified legal advice are still required.

Privacy & GDPR applicability

Applicability and provider review outstanding

GDPR can apply to a non-EU organisation offering goods or services to people in the EU or monitoring their behaviour there. An international-looking website alone does not settle applicability. Review the actual audience, targeting, processing purposes and establishments; assess whether an EU representative or data protection officer is required.

Data-subject rights: Where GDPR applies: access, rectification, erasure, restriction, portability, objection, consent withdrawal and complaint to a supervisory authority, subject to their conditions. Requests ordinarily require a response within one month; a permitted extension of up to two further months requires notice and reasons within the first month. These are legal requirements, not measured response times.
Consent & automated decisions: Keep marketing consent optional and withdrawable; do not treat accepting service terms as marketing consent. Review non-essential cookies and analytics before relying on consent. Assess whether any solely automated decision has legal or similarly significant effects and which safeguards, explanation, human intervention and challenge rights apply.
Retention & deletion: The current policy is purpose-based. A category-level retention schedule, deletion workflow, backup handling and documented exceptions for payments, appeals and credential integrity still need review. No new retention periods or blanket immediate-deletion guarantee are invented here.
International transfers: Inventory provider, processing location, recipient, purpose and onward transfers. When Chapter V applies, verify the actual adequacy decision or other appropriate safeguard, such as applicable Standard Contractual Clauses, with transfer assessment and supplementary measures as necessary. Do not assume a provider is covered by a framework simply because that framework exists.
Enterprise documentation: Confirm the legal controller identity and contact details, processing inventory, lawful bases, processor agreements, subprocessor register, breach procedures and any required impact assessments. No completed legal applicability opinion or verified provider-by-provider transfer register is published.

Accessibility

WCAG 2.2 AA target — not certified

The target includes keyboard access, visible and unobscured focus, readable contrast, labelled forms, error announcements, screen-reader support and accessible authentication. Prerecorded speech needs captions; live audio needs an appropriate accessible alternative and, where required, live captions.

Complete manual assistive-technology testing across public and signed-in journeys, 200–400% zoom and reflow, and any live assessment media. A keyboard or automated check alone does not establish WCAG conformance. Discuss an assessment-accessibility need before booking; approval is not automatic.

Security

Internal checks — independent testing outstanding

Review authentication and session expiry, server-side role checks, cross-account data access, upload ownership and file validation, payment signatures and replay handling, and credential issuance, suspension and revocation. Row-level access restrictions are enabled on application tables; that does not prove each rule is correct.

Use a written test matrix for candidate, reviewer, employer, administrator and signed-out access. Include negative tests, direct requests, malicious uploads, duplicate payment events and status-change audit trails. No independent penetration-test report or security certification is published.

Performance & reliability

Local preview checks — field results outstanding

The homepage serves sized AVIF/WebP images with a priority hint for its main image. Enterprise readiness also requires real-device loading and reliability measurements from the countries actually served, including slower mobile connections.

Measure Core Web Vitals at the 75th percentile: LCP at most 2.5 seconds, INP at most 200 milliseconds and CLS at most 0.1. These are targets, not measured SkillSignature results. Record country, device, connection, sample size, date and failure rate; a desktop simulation is not a real-device or international reliability test.

Public discovery & credential indexing

Public metadata maintained — indexing not guaranteed

Public pages need distinct titles and descriptions, self-referencing canonical URLs, a sitemap and accurate structured data. Existing credential verification URLs remain stable. Missing credentials should not be indexed as valid records; private evidence must never be included in search metadata.

Check rendered public records and crawler access after publication. Include only public-safe, authorised records in any credential sitemap expansion. Search engines decide whether to index a page; neither a sitemap entry nor structured data guarantees inclusion.

Payment consistency

Non-monetary review — provider lifecycle testing outstanding

SS-Credit purchase quotes are computed on the server. Successful provider confirmations must match the stored amount and currency before credits are applied. Wallet changes use locked, idempotent operations. A return-page visit is not proof of payment.

Validate each enabled currency, rounding, failed and cancelled checkouts, duplicate confirmations, partial/full monetary refunds, reversals and receipts that reconcile the provider reference, amount, currency and credits. Monetary refunds differ from credits returned after a failed service action. No real-money test is run without the owner's permission.

Assessment quality & validation

The following is a validation protocol, not a report of completed research. No scoring-validity study, calibration result or demographic fairness result is published here.

Scoring validity: Map each task and competency to its intended work-related use. Version the rubric, document why the pass threshold is appropriate, and compare outcomes with an independently defined criterion. An AI confidence value or pass rate alone does not demonstrate validity.
Reviewer calibration: Before using a skill scheme at scale, have reviewers independently score the same consented evidence against the same rubric. Record disagreements, rationale, training actions and a second calibration round. Do not present unmeasured agreement as an achieved result.
Consistency: Track score differences and pass/fail agreement by skill, task, rubric version and reviewer cohort. Use suitable inter-rater measures with sample sizes and uncertainty; monitor drift before changing criteria. Preserve the standard recorded on existing credentials.
Bias testing & accommodations: Review tasks for irrelevant language, cultural and accessibility barriers. Where lawful and proportionate, test outcome differences using voluntary, minimised research data, with a documented basis and access controls. Investigate differences before inferring causes; no bias-free claim is justified by absent data.
AI oversight & appeals: Keep the scoring rationale, confidence, rubric version and human recommendations traceable. Candidates can challenge procedural error, overlooked evidence, rubric misapplication, bias or undeclared conflicts under the Appeals Policy. Independent reconsideration and actual outcomes need evidence, not only a policy.

Assessment methodology Pilot measurements Appeals Policy

Official standards as benchmarks

ISO/IEC 17024:2026: General requirements for bodies operating certification of persons. Use it to review impartiality, scheme governance, assessment and certification decisions. SkillSignature is not claiming that its credentials are accredited personnel certifications or that the platform conforms to this standard.
ISO 10667-1:2020: Assessment service delivery — procedures and methods to assess people in work and organisational settings. Part 1 addresses requirements for the client, including the employer's intended use and assessment arrangements. It is not a certification of this platform; service-provider responsibilities need separate review.

An official standard reference, purchased copy or internal checklist is not accreditation. Any future recognition must identify the issuing body, scheme, scope, dates and a verifiable record.

Primary references

Security & assessment governance