Secure Files and Records Archive
27 — Secure Files and Records Archive
🔒 Pro feature — requires Dantian Training Hub Pro.
Students at health-education colleges upload sensitive material: assignment submissions with case notes, medical certificates attached to extension requests, evidence for action plans. Trainers attach feedback files to those submissions. By default WordPress stores uploads in a public folder, where anyone who learns or guesses a file’s web address can download it without logging in.
Dantian Training Hub Pro moves these confidential files into a secure store that cannot be reached by a web address. Files are then handed out only through a download link that checks, every time, who is asking. Pro also gives you two optional copies held in your own Google Drive:
- an Encrypted backup: a disaster-recovery copy that Google cannot read, and
- a Student records archive: a readable, organised filing cabinet of student records that your institution keeps.
This guide is for site administrators. Trainers and students do not configure anything here, but the Protected downloads section explains what they experience.
Where to find it
| What | Where |
|---|---|
| Storage settings: Google Drive connection, assignment-file securing, video storage, encrypted backup, records archive | Training Hub → Settings → Files & Storage tab |
| Storage operations: queue status, securing or restoring existing files, backup coverage, archive exports and removals, activity log | Training Hub → File Operations |
| One student’s archive | Training Hub → Student Report → (choose a student) → Drive Archive tab |
| Audit records (declarations, attendance changes, email log and so on) | Training Hub → Audits |
Who can see these screens: the Files & Storage tab, File Operations page and Drive Archive tab are administrators only (the manage_options capability). The Audits page is open to anyone with the dthub_view_reports capability, but some of its tabs are admin-only (see The Audits page).
The File Operations page is always available while Pro is active, even if your licence has lapsed or every securing feature is switched off. This is deliberate: it lets you move files back out of secure storage before you leave Pro (see Leaving Pro or uninstalling).
What gets secured
Four kinds of confidential file go into the secure store:
| File type | Label on File Operations | When it is secured |
|---|---|---|
| Tutor LMS assignment submission files | Assignment submissions | New uploads, while Secure assignment files is on (the default) and the Rubric Grading module is licensed |
| Trainer feedback files attached to a submission | Reviewer feedback files | New uploads |
| Action-plan evidence attachments | Action-plan evidence | New uploads |
| Supporting documents attached to an extension request | Extension-request documents | New uploads |
Files that were uploaded before securing was in place stay at their old public address until you secure them (see Securing files that are already public).
Accepted file types: PDF, Word (.doc, .docx), Excel (.xls, .xlsx), PowerPoint (.ppt, .pptx), JPG/JPEG, PNG, GIF, TXT, CSV and ZIP. The file’s contents must match its extension; a renamed file is rejected with “File type not allowed.”
Size limit: 25 MB per file, or your server’s own upload limit if that is lower.
How the secure store works
You do not need to set anything up. When Pro first needs the store, it picks the safest location your hosting allows:
- Above the web root (preferred). A folder named
dthub-secure-uploadsis created one level above your WordPress folder. No web address points there, so files cannot be fetched directly on any server. File Operations shows a green notice: “Secure storage is located above the web root — files are unreachable by direct URL on every server.” - A hardened folder inside uploads (fallback). If your host does not allow writing above the web root, the store is created inside
wp-content/uploads/dthub-secure-uploads/, protected by deny rules and unguessable file names. File Operations shows a blue notice explaining this. On nginx servers the deny rules are ignored, so you or your host must add a server rule. Pro checks this for you daily (see The daily protection check).
Your developer can also point the store at a known non-public folder with the DTHUB_SECURE_PRIVATE_DIR constant in wp-config.php.
Each stored file gets a random name. The original file name is kept in the database and used again when someone downloads the file.
Protected downloads — who can download what
Every secured file is served through a download link that checks permissions on each click. The link can be bookmarked or shared, but it only works for someone who is logged in and allowed to see that particular file. Everyone else gets “You are not allowed to access this file.”
| File | Who can download it |
|---|---|
| Assignment submission file | The student who submitted it · the instructor of that submission’s course · administrators |
| Trainer feedback file | The same people as the submission it belongs to |
| Extension-request supporting document | The student who made the request · administrators · trainers allocated to the request’s assignment · the instructor of the request’s course |
| Action-plan evidence | The student the plan belongs to · administrators · users given action-plan access in the Action Plans settings |
Access is cohort-scoped. Holding a Training Hub capability such as dthub_manage_tutorials is not enough on its own. An instructor at a multi-campus college can open submissions for the courses they teach, but not for a colleague’s course.
Students and trainers do not need to do anything differently. Download links appear where they always have, for example in Tutor LMS assignment pages, the grading screens and the extension-request review screens.
First-time setup
- Go to Training Hub → File Operations and read the storage notice at the top (green = above the web root; blue = inside uploads).
- If the notice is blue and your site runs on nginx, ask your host to add the location-deny rule. Pro’s protection-check notice shows the exact rule once the daily check has run.
- Go to Training Hub → Settings → Files & Storage. Under Assignment file security & video storage, confirm Secure assignment files is ticked. It is on by default. This section only appears while the Rubric Grading module is enabled.
- Back on File Operations, look at the Secure existing files table. If it lists files, follow Securing files that are already public.
- Optional: connect Google Drive and turn on the Encrypted backup and/or the Student records archive.
Securing files that are already public
The Secure existing files section of File Operations lists, by surface, how many records, files and megabytes are still at a public address. Pressing the button moves them into the secure store. Each file is:
- copied into the secure store,
- checked byte-for-byte against the original,
- re-pointed in the database to the secure copy, and only then
- deleted from its public location.
If anything fails part-way, the file stays readable from its original location and the next run tries again. The run happens in small batches of 10 records, so a large library will not time out. It is safe to re-run and to resume if you close the page.
Because the public originals are deleted, take a full site backup first. The button stays disabled until you:
- tick I have taken a current, restorable backup of this site., and
- type
SECUREin the confirmation box.
Then press Secure existing files. A progress line shows how many files were secured and how many were skipped (skipped means the source was already missing or already secured). If the run fails, you will see “The operation failed. Check the browser console and try again.”
Every run is recorded under Recent activity at the bottom of the page, with the time, the administrator, the action (Secured / Restored to public), the surface and the number of files.
Storage status panel
The Storage status panel at the top of File Operations shows the health of the background upload queues:
- Google Drive: connected, or not connected — backup and archive uploads are paused until you connect.
- One line per subsystem, for example Encrypted backup: 3 pending · 0 failed and Records archive: 0 pending · 1 failed. A red note appears beside a subsystem if its sharing check has flagged a problem.
- A freshness line: Queue last processed 5 minutes ago. If work is pending but the queue has not run recently, an amber warning says WP-Cron may not be firing on your site.
The panel refreshes itself every few seconds while work is pending. Two buttons let you take action:
- Run queue now: processes a batch immediately from your browser. Use it when WP-Cron is unreliable. Large backlogs keep draining in the background afterwards.
- Retry failed (N): puts items that gave up after repeated failures back in the queue. The encrypted backup gives up after 5 attempts.
Connecting Google Drive
One Google Drive connection is shared by the encrypted backup, the student records archive and (optionally) rubric feedback-video storage. Files live in the connected account’s Drive, so connect a dedicated role account (for example a records-office account), not a staff member’s personal account.
- In Google Cloud, create an OAuth web-application credential. Publish its consent screen to Production (or Internal for Google Workspace) so the connection does not expire.
- Go to Training Hub → Settings → Files & Storage → Connections.
- Enter the Google OAuth client ID and Google OAuth client secret, then press Save credentials. A saved secret is never shown again; the field reads “configured ✓ (leave blank to keep)”.
- Press Connect with Google and approve access as the role account. You return to the tab with “Google Drive connected.”
To disconnect, press Disconnect. Backups already in Drive stay in that account. If any backup deletions are still owed to Drive, a warning explains that they cannot run until an account is connected again (or until you delete those copies in Drive yourself).
Encrypted backup
The encrypted backup is a redundant copy of every secured file. Each file is encrypted before it leaves your server, so Google only ever holds unreadable data. Drive is never used to serve files to users. This is a safety net for your secure store, not a records archive.
Settings (Files & Storage → Encrypted backup)
| Setting | What it does | Default |
|---|---|---|
| Enable backup | “Push every newly secured file to the connected Drive.” | Off |
| When a file is deleted | Trash the backup copy (recoverable for N days), or Delete the backup copy immediately (no recovery window) | Trash |
| Trash window (days) | How long a trashed backup copy is kept before it is permanently purged | 30 (allowed 1–365) |
Press Save backup settings.
Personal-data erasure always wins. When you fulfil an erasure request through Tools → Erase Personal Data, any backup copy of that student’s secured files is deleted permanently, whatever the trash setting. If Drive is unreachable at that moment, the deletion is queued and retried automatically, and the erasure report says so.
Backing up files that were secured earlier
The backup only pushes files secured after it was switched on. To cover older files, go to File Operations → Encrypted backup — coverage. It shows “N backed up · N pending · N failed · N in trash window”. Press Back up existing files to queue every secured file that has no backup yet. The button is disabled while Drive is not connected or the backup is switched off, and the page tells you which.
Daily backup maintenance
While the backup is enabled, or while any deletions are still owed to Drive, a daily job:
- permanently purges trashed copies whose trash window has passed,
- retries any failed deletions, and
- runs a sharing check on recent backup files.
If a backup file in Drive has been shared with “anyone with the link” or with your whole domain, every administrator sees a red notice on every admin screen: “Secure Files backup: a Drive backup file has been shared beyond the connected account.” The contents are still unreadable, but remove the share in Google Drive. The notice clears on the next daily check after the share is removed.
Student records archive
The records archive is the opposite of the backup. It is a readable, plaintext, organised copy of student progress records, filed in your Drive like a filing cabinet:
Student Files/
(2024-0142) - Jane Doe/
Action Plans/
_Unfiled/
Clinical Assessment 2/
Case Study 1/Records archived:
- submitted assignment work
- rubric feedback (as PDF)
- action plans (as PDF)
- action-plan evidence files
The archive persists through personal-data erasure requests. Erasing a student on the site does not remove their archived copies. The erasure confirmation discloses that archived copies remain. Your institution, as data controller, is responsible for having a lawful basis to keep them, and for removing a student’s archive when no basis applies.
The archive is available only while the Rubric Grading module is licensed and enabled.
Turning the archive on (Files & Storage → Student records archive)
- Connect Google Drive (see above).
- Tick the Institutional affirmation: “We confirm our institution has a retention obligation or lawful basis to retain these records beyond individual erasure requests, and accept responsibility as data controller…” The plugin records who confirmed it and when. Once confirmed, the row shows that record instead of the checkbox.
- Tick Enable archive: “Allow exports of student records to the connected Drive.”
- Optionally tick Scheduled sweep and choose Weekly or Daily.
- Press Save archive settings.
If you try to enable the archive without the affirmation you will see “The archive cannot be enabled until the institutional retention affirmation is confirmed.”
| Setting | Default |
|---|---|
| Enable archive | Off |
| Scheduled sweep | Off |
| Sweep frequency | Weekly |
How records get into the archive
- Scheduled sweep (if on): on the chosen schedule, finds new and changed records and queues them. Unchanged records are skipped. A changed record is archived as a new version; earlier versions are never overwritten. The sweep works through students in small slices so it never overloads your server.
- Export a course / cohort (File Operations): pick a Course and press Export course records to Drive. This queues the course’s submitted work and rubric feedback for every student with records in it, plus those students’ action plans. Records already archived at their current content are skipped.
- Export one student (Student Report → Drive Archive tab): press Export student records to Drive.
Uploads happen in the background. Watch progress in the Storage status panel.
Archive operations on File Operations
The Student records archive — exports section also contains:
- Export history: queued time (UTC), student, record (Submission / Rubric feedback / Action plan / Plan evidence), version, trigger and status.
- Recent archive activity: settings changes, exports started and finished, removals, and folder events. For example, if someone deleted a mapped folder in Drive, Pro re-adopts or re-creates it and logs that here. If a student’s name or number changes, the folder is deliberately not renamed and the change is logged.
- Re-verify Drive copies: if someone deleted or trashed archive files directly in Drive, press Re-verify Drive copies & re-queue missing. A plain re-export would skip them because they are still marked as archived.
- Retention summary: the on-site retention holds that apply to archived record types (from the extended-retention settings; see 28 — Permissions, Privacy and Maintenance).
- Remove a student’s archive: choose the Student, type
REMOVE, and press Delete archive from Drive. This permanently deletes the student’s folder tree from Drive and the export log. It is the only way to extend an erasure to the archive, and it never happens automatically.
Daily archive sharing check
While the archive is enabled, a daily job checks recent archive files and folders in Drive for sharing beyond your own users. Because these are readable named student records, the notice is stronger than the backup one:
- Red (error): records shared with anyone who has the link (readable on the public internet). Set their sharing back to Restricted in Google Drive.
- Amber (warning): records readable by everyone in your Google Workspace organisation, students included.
The notice appears on the Dashboard and the Training Hub screens for administrators. It has Re-check now, which clears it as soon as the share is removed, and Dismiss. A dismissed notice comes back if the exposure changes.
The daily protection check
If your secure store had to fall back to the uploads folder, Pro tests it once a day. It places a small test file in the store and tries to fetch it over the web. Administrators then see:
- Red: “Dantian Training Hub: confidential file storage is publicly accessible.” The test file was readable, so confidential files can be downloaded without logging in until you fix it. The notice includes the server rule to add (nginx block, or Apache/IIS guidance).
- Amber: “…could not confirm confidential file storage is protected.” The check timed out or got an unclear answer. Verify manually or wait for the next check.
Press Dismiss until tomorrow to hide it; it returns after the next daily check if the problem remains. When the store is above the web root there is no public address to test, so the check simply reports it as protected.
Video storage
The Assignment file security & video storage section of Files & Storage also chooses where rubric feedback videos are stored:
| Option | Notes |
|---|---|
| Local secure storage (on this server) | Private, needs no setup |
| Bunny.net | Off-server; needs Storage Zone, Access Key, CDN Hostname, Storage Hostname and Token Secret (these can be set as wp-config.php constants instead, in which case the fields are locked) |
| Google Drive | Off-server; uses the shared Drive connection. If Drive is not connected, new videos fall back to local storage |
Other settings in this section: Video Retention (days) (default 180, range 1–3650) and After migrating to local (Keep the remote copy (recommended) or delete it once the local copy is verified). Two tools move existing videos between providers: Migrate to local storage and Move to off-server storage. Each needs you to type a confirmation phrase. Press Save storage settings to save this section. Rubric video features are covered in the rubric marking guides.
The Audits page
Training Hub → Audits gathers the plugin’s audit records in one place, as tabs:
| Tab | Shown when | Who can open it |
|---|---|---|
| Declaration Records | Rubric marking is available and your LMS supports assignments | dthub_view_reports |
| Attendance Audit Trail | Always (Pro) | dthub_view_reports. See 17 — Attendance Audit Trail |
| Email Log | Always | Administrators only. See 10 — Email Notifications |
| Clinic Cancellations | Always | Administrators only |
| Video Management | Rubric marking is available and your LMS supports assignments | dthub_view_reports |
The secure-file migration log is on File Operations under Recent activity, not on the Audits page.
Turning securing off, licence lapses
- Unticking Secure assignment files, or the Rubric Grading licence lapsing past its grace period, means new assignment submissions go back to Tutor LMS’s default public upload folder. Files already secured stay private and downloadable.
- Administrators then see the notice “Tutor assignment files are no longer being secured.” with a link to turn securing back on. Review your privacy policy if confidential submissions will be stored publicly again.
Leaving Pro or uninstalling
Secured files can only be downloaded through Pro’s download handler. If you delete Pro without preparing, the files are kept on disk but nobody can reach them from the site.
Before you uninstall Pro or let it lapse for good:
- Go to Training Hub → File Operations → Restore files to public. The table shows what is currently secured.
- Type
RESTOREand press Restore files to public. Files are copied back to the public uploads area and the records are re-pointed. This direction needs no licence and works even while securing is switched off. - Then deactivate and delete Pro.
Restored files become downloadable at a public web address again, so only do this when you intend the files to leave secure storage. While secured files exist and a securing module is lapsing, administrators see a reminder to do this first.
What Pro’s uninstall does with storage:
- The Google Drive connection is revoked and its stored credentials are always deleted.
- Backup files and the records archive in Drive are not touched. They remain in the role account.
- The secure store folder and its files are never deleted, even if you chose to remove all Pro data. The plugin also remembers where the store is, so reinstalling Pro finds the files again.
See 01 — Installation for full uninstall steps.
Worked example
Southbank College of Natural Therapies runs Tutor LMS with Pro on an nginx host.
- The coordinator opens File Operations and sees the green “above the web root” notice, so no server rule is needed.
- Secure existing files lists 1,240 assignment submissions (3.1 GB) from before Pro. IT confirms last night’s full backup restores, so the coordinator ticks the backup box, types
SECUREand runs it. Over about twenty minutes the progress line climbs to “1,240 secured · 6 skipped”. The six were files already missing from disk. - The records officer connects the college’s
records@Google Workspace account, enables the Encrypted backup with the default 30-day trash window, and presses Back up existing files. The Storage status panel drains overnight. - Because the college must keep assessment evidence for seven years, the principal confirms the Institutional affirmation. The coordinator enables the archive with a Weekly sweep, then exports the “Clinical Assessment 2” course once by hand.
- A month later, a staff member shares a student folder with the whole Workspace domain. The next day an amber sharing-check notice appears. The records officer restricts the folder and presses Re-check now, and the notice clears.
Troubleshooting
“You are not allowed to access this file.” when a trainer opens a submission. The trainer must be an instructor of that submission’s course in Tutor LMS (or, for extension documents, the allocated trainer). Add them as a course instructor. Giving them more Training Hub capabilities will not help.
The Secure existing files button stays greyed out.
Tick the backup confirmation and type SECURE exactly, in capitals. If the server rejects the request you will see “Backup confirmation is required before securing files.”
The Storage status panel shows pending items that never go down.
WP-Cron is probably not running (common on low-traffic sites or hosts that disable it). Press Run queue now, and ask your host to set up a real server cron for wp-cron.php. If items show as failed, check the Drive connection and press Retry failed.
“The archive is not active (enable it and connect Google Drive first).” All three are needed: Drive connected, the institutional affirmation confirmed, and Enable archive saved. The Rubric Grading module must also be licensed and enabled.
A red “confidential file storage is publicly accessible” notice.
Your store is in the uploads fallback and the server is serving it. Add the rule shown in the notice (nginx) or confirm .htaccess is honoured (Apache). Then wait for the next daily check, or ask your developer to clear the cached result.