Security & assessment governance

Security controls

The Privacy Policy describes encryption in transit, access controls, row-level data access restrictions and audit logging as technical and organisational measures. These are policy disclosures, not an independent assessment of their effectiveness.

Access and confidentiality

The published independence framework describes access by role and assignment: candidates' private data, assigned reviewer evidence and employer-authorised information are not intended to be interchangeable. The Reviewer Agreement prohibits copying, publishing or reusing candidate material.

Payments and investigations

The Privacy Policy describes retaining processor transaction identifiers and payment status rather than full card numbers. The governance framework describes audit records supporting integrity investigations; it does not constitute a published audit of log coverage or tamper resistance.

Reporting a concern

Use a signed-in support conversation for account or security concerns. Do not send passwords, payment-card details, identity documents or confidential assessment submissions. No penetration-test result, guaranteed breach prevention or incident-response service level is asserted here.

Data retention

The current Privacy Policy uses purpose-based retention, not a published fixed deletion schedule for every category. Account deletion does not necessarily remove records required for legal obligations, credential integrity or appeals.

Account and profile information

Retained until account deletion or for a legally required period, under the Privacy Policy. A blanket promise of immediate deletion would not reflect that policy.

Assessment evidence and verification history

Verification records may be retained longer to preserve credential integrity and support appeals. The policy does not specify a fixed duration for submissions, reviewer notes or integrity records.

Payment, communication and technical records

These fall under the policy's necessary-purpose retention principle; separate numeric periods for transaction records, messages, logs and backup deletion are not published.

Reviewers' local copies

The Reviewer Agreement requires deletion of local candidate-material copies after review and prohibits retaining or reusing them.

For access, correction, deletion or other data-rights requests, the Privacy Policy lists privacy@skillsignature.com and a response period of 30 days. These are existing policy commitments, not a confirmation of email delivery. You can also raise a request through signed-in support.

Reviewer qualification

The existing reviewer standard describes qualified practitioners approved for specific skills. The Reviewer Agreement requires use of the published rubric, structured reasons for scores and requests for further evidence rather than unsupported inference.

Reviewer obligations include confidentiality, independence and no solicitation of candidates for tuition, employment or consultancy arising from a review. The agreement states that reviewers are not paid on the basis of outcomes.

A detailed qualification checklist, minimum years of experience, external assessor certification and published calibration results are not provided here. Skill-specific approval must not be interpreted as professional accreditation.

Appeals

The Appeals Policy permits challenges based on procedural error, overlooked evidence, misapplication of the rubric, bias, undeclared conflicts or material new evidence that existed at submission. Disagreement with a correctly applied rubric alone is not a ground for appeal.

1. Submit the decision reference, grounds and supporting material to the policy's listed address, appeals@skillsignature.com, within 30 days of the decision. Signed-in support is also available to raise an appeal concern.
2. The policy calls for reviewers and staff who took no part in the original decision, acknowledgement within 5 business days and a decision within 20 business days. An extension requires notice where more evidence or an additional reviewer is needed.
3. Possible outcomes are upholding or substituting the decision, a fresh review at no cost, or reinstating a suspended credential. These are policy timelines and possible outcomes, not observed turnaround statistics or a promise of a successful appeal.

Conflicts of interest

Reviewers must decline assignments involving current or former colleagues, employees, employers, clients, relatives or close associates, and any case in which impartiality could reasonably be questioned. The published framework also identifies teaching, mentoring and commercial relationships.

Under the Reviewer Agreement, declared conflicts trigger reassignment. Candidates who suspect an undeclared relationship can raise it through support; bias or an undeclared conflict can also form grounds for an appeal. Declaring a concern is not itself proof of misconduct.

Assessment fairness

• Published skill criteria, evidence requirements, assessment methods and pass thresholds are the basis for assessment—not a payment or promise of employment.
• Reviewer scores require structured reasons. Candidates must describe their own contribution accurately; missing evidence should be requested, not invented.
• The Verification Terms disclose automated rubric-based scoring with a confidence measure and human referral for low-confidence or borderline results. Human reviewers make verification decisions.
• Credential records distinguish issuer-recorded assessment facts from self-reported profile information. Review dates are not automatic expiry dates.
• The Employer Agreement requires lawful, role-relevant hiring criteria and prohibits discriminatory use of platform information.

These safeguards do not establish that assessments are free from bias. No demographic fairness study, measured reviewer-agreement result, or audit against the WCAG 2.2 AA (October 2023) recommendation is published here. Raise an assessment-accessibility need or suspected scoring bias with support; an accommodation is not represented as automatically approved.

Credential revocation

The Revocation Policy covers fabricated, plagiarised or misattributed evidence, impersonation, assessment breaches, material misrepresentation and misuse of a credential. A report is an allegation—not an automatic finding or revocation.

1. Credible evidence can lead to suspension while an investigation proceeds. Suspension is distinct from a final revocation.
2. The policy requires notifying the holder, allowing a reasonable opportunity to respond and using staff and reviewers independent of the original decision. Investigations normally conclude within 30 days under that policy.
3. Outcomes include reinstatement, continued suspension or revocation. The policy provides for revoked records to remain publicly resolvable with their status, without publishing the reason. Revocation may be appealed.

Always check the live verification record before relying on a credential. A saved report or screenshot can become outdated. Company-issued credentials remain an employer's claims, not independent SkillSignature verification.

Evidence publication status

Independent assurance

No audit, penetration-test result or certification is claimed here. Policy documents and internal checks are not substitutes for independent assurance. Absence of a published report does not establish eligibility or the outcome of an audit.

Any future publication must be based on evidence actually obtained and approved for release: the assessor or issuing body, dates, scope, exclusions, findings and remediation context, and a report or verifiable reference where disclosure is permitted. Certification scope and validity must be stated rather than implied to cover the entire platform.