Document Management & Expiry Alerting

Attestation Core keeps a record of every compliance document each person must hold, such as a First Aid certificate, Working With Children Check, police check or current CV. You decide which document types apply to which kinds of worker. Staff upload their own copies through the portal (or you upload them for staff). Administrators verify each upload, and the plugin tracks every expiry date so you’re not relying on a spreadsheet.

Overview

• Who uses it: compliance managers and administrators (Manage documents permission, which Administrators have by default) and staff members, who upload through the portal.
• Where it lives:
  • Attestation Core → Documents: every document across all staff, with filters and bulk actions.
  • Attestation Core → Compliance Profiles → (person) → Documents tab: one person’s documents, admin upload and verification.
  • Attestation Core → Settings → Library → Document types: the list of document types.
  • The My Documents portal page (shortcode [attestation_core_my_documents]): staff self-service.
• Storage: files are held in a private folder and only ever served through a permission-checked download link. See Privacy, security and data.

Document types

A document type is something you require people to hold, such as “First Aid certificate”. Each type sets how expiry works and which workforce categories need it.

The seven default types

On activation the plugin creates these types. You can change who needs each one, deactivate any you don’t use, and add your own.

Type	Expiry type	Alerts (days)	Required for
Professional qualification	No expiry	—	Employee, Contractor, Casual, Volunteer
First Aid certificate	Fixed expiry date	90,60,30,7	All compliance profiles
Working With Children Check	Fixed expiry date	90,60,30,7	All compliance profiles
Industry qualification	No expiry	—	Employee, Contractor, Casual, Volunteer
Current CV	Rolling annual review	30,7	Employee, Contractor, Casual, Volunteer
National Police Check	Fixed expiry date	60,30	All compliance profiles
Continuing development evidence	Rolling annual review (31 December)	30	All compliance profiles

Adding or editing a type

1. Go to Attestation Core → Settings → Library → Document types. The Documents page also links here.
2. Scroll to Add or update document type and fill in:

Field	What it does	Rules
Slug	Internal identifier, for example first-aid.	Required and must be unique. Lower-case.
Name	What staff and admins see.	Required.
Description	Optional help text.	—
Required for	Tick All compliance profiles, or pick the workforce categories that must hold this document.	Default: All.
Expiry type	Fixed expiry date, Rolling annual review or No expiry.	Required.
Alert lead times	Comma-separated days before expiry, for example 90,60,30,7.	Optional. See the note below.
Sort order	Position in lists (lower numbers first).	Number.
Active	When ticked, the type appears in upload pickers.	Ticked.

1. Click Save document type. You’ll see “Document type added.”

Despite its heading, this form only adds types. If you enter a slug that’s already in use, you get “Another document type already uses that slug.” For an existing type, the table lets you change Required for and switch it on or off. To change an existing type’s name or expiry rules, deactivate it and add a replacement type with a new slug.

To change who needs an existing type, use the Required for checkboxes in that type’s row of the table and click Save requirements. To stop using a type without losing its history, click Deactivate. Deactivated types disappear from upload pickers, and existing documents of that type are kept. Activate brings the type back.

About Alert lead times: this value is stored with each type and shown in the Alerts (days) column. In this version it does not change when reminder emails are sent. Reminders follow the fixed schedule described in Expiry status and alerts.

How expiry types behave

• Fixed expiry date: the document has a hard expiry date, such as a First Aid certificate. Staff must enter the expiry date when they upload.
• Rolling annual review: the document has to be refreshed every year, such as a CV. Its status is based on the Issued date. It becomes Annual review due 12 months after that date, or once the type’s review date has passed (31 December for the default “Continuing development evidence” type). If no issued date is entered, it shows Annual review due straight away, so ask staff to fill in the issued date.
• No expiry: the document is held permanently, such as a qualification. It always shows No expiry.

Which types each person sees

A person is asked for a document type only if it is Active and is required for All compliance profiles or for at least one of their workforce categories. If a person sees “No document types are currently required for your compliance profile.”, check their workforce categories on their profile and the Required for setting on your types.

Uploading documents from the portal

Staff upload through the My Documents page, which is created by the portal pages setup or by adding the [attestation_core_my_documents] shortcode to a page.

1. The staff member signs in and opens My Documents.
2. Each required document type has its own card showing the current status, or Missing if nothing has been uploaded yet, and a table of their uploads with File, Issued, Expires, Status and Verification (Verified or Awaiting).
3. They open Upload type (or Upload new type for a renewal), choose the file, enter the Expiry date (required for fixed-expiry types) and optionally the Issued date, then click Upload.
4. They see “Document uploaded. Awaiting administrator verification.” The new upload appears at the top of that type’s list. Earlier uploads stay as history, and the newest upload sets the type’s current status.

Rules the portal enforces:

• Accepted file types: PDF, JPG/JPEG, PNG, DOC, DOCX. The file’s contents are checked as well as its extension.
• Maximum size: 25 MB, or your server’s upload limit if that is lower.
• The expiry date can’t be in the past.
• Only document types required for that person’s profile can be uploaded.
• Up to 10 uploads per minute per person.
• The page needs JavaScript in the browser.

Staff can’t delete or edit their uploads. If they upload the wrong file, an administrator can delete it.

Uploading on someone’s behalf (admin)

1. Open Attestation Core → Compliance Profiles, select the person and choose the Documents tab.
2. Click + Upload document, choose the Document type, the File, and the Issued date and Expiry date as needed. Leave the expiry blank for annual-review and no-expiry types.
3. Click Upload document. Admin uploads follow the same file type and size rules.

Verifying documents

Uploads start as unverified. Verifying records that someone has checked the document against the original.

One at a time (profile Documents tab):

1. Open the person’s profile and choose the Documents tab.
2. Download the file and check it (see Viewing and downloading files).
3. Optionally type a Verification note, for example “Sighted original 12 Jan 2026”.
4. Click Verify. The badge changes to Verified. Click Unverify to reverse it.

In bulk (Documents page):

1. Go to Attestation Core → Documents. Filter by Type or Status, or search.
2. Tick the documents, choose Verify selected or Unverify selected from Bulk actions, and click Apply.

Deleting: Delete on the profile tab, or Delete selected in bulk, permanently removes the document record and its stored file after you confirm. Every deletion is recorded in the Admin Action Log.

Verification doesn’t change the expiry status and doesn’t send the staff member an email.

Viewing and downloading files

Files are never available at a public web address. Every file is delivered through a download link that checks who is asking.

• Administrators: click Download on the Documents page, or the file name on a profile’s Documents tab. This needs the Manage documents permission.
• Staff: on My Documents, the file name is a link to download their own file. A staff member can only ever download their own documents. A link to anyone else’s file returns “Document not found.”
• Files always download rather than opening in a browser tab. Open the downloaded file to view it.
• Staff downloads (documents and evidence combined) are limited to 60 per hour per person. Past that, they see “Too many download requests. Please wait a few minutes and try again.”
• Every download, by an admin or by staff, is recorded in the file access log (see Privacy, security and data).

🔒 Pro feature — requires the Pro plugin.

With Pro you can store uploads in a Google Shared Drive instead of on your web server. Downloads still go through the same permission-checked links. See Google Drive storage. On the free plugin, Settings → Storage shows “Google Shared Drive storage is available in Attestation Core Pro.” and uses private local storage.

Expiry status and alerts

Each document’s status is worked out from its type and dates, and is recalculated every day by the plugin’s daily scheduled task:

Status	Meaning
Current	More than 90 days until expiry, or annual review not yet due
Expiring in ≤90 / ≤60 / ≤30 / ≤7 days	Approaching the expiry date
Expired	The expiry date has passed
Annual review due	A rolling-annual document needs refreshing
No expiry	A no-expiry type
Expiry not recorded	A fixed-expiry document with no expiry date (usually an admin upload where the date was left blank)

To see everything that needs action, go to Attestation Core → Documents and filter Status by Expired, Expiring in ≤30 days and so on.

Email reminders (free plugin): the staff member is emailed when a document enters the 30-day window, when it expires, and when an annual review is due. The Pro plugin adds reminders at 90, 60 and 7 days. Templates, on/off switches and the delivery log are covered in Automated email notifications.

Permissions

Who	Can
Manage documents (Administrators)	See the Documents page, upload for anyone, verify, delete, download any file, manage document types
Staff with an active, linked profile	Upload and download their own documents on My Documents
Signed-out visitors	See a “Sign in required” message on the portal page

🔒 Pro feature — requires the Pro plugin.

Department coordinators (Pro) see documents only for the people in their departments.

Data and uninstall

Each document record stores the type, original file name, file size, file type, issued and expiry dates, status, verification flag, verifier and verification note, and who uploaded it. The file itself is stored under a random name in the private folder. Erasing a person’s personal data deletes their document records and files. Uninstalling keeps documents unless you turn on data erasure. See Privacy, security and data.

Troubleshooting

Problem	What to do
“File type is not accepted. Allowed: PDF, JPG, PNG, DOC, DOCX.”	Convert the file, for example export a HEIC photo as JPG or a Pages file as PDF.
“File content does not match its extension.”	The file was renamed (for example a .png renamed to .pdf). Export it again in the right format.
“File is empty or exceeds the permitted size.”	Reduce the file size, or ask your host to raise the PHP upload limit (the plugin’s limit is 25 MB).
“That document type is not required for your compliance profile.”	Tick the person’s workforce category under that type’s Required for, or tick All compliance profiles.
“An expiry date is required for this document type.”	Fixed-expiry types need an expiry date. Enter the date shown on the certificate.
A CV shows Annual review due straight after upload	No Issued date was entered. Upload again with the issued date.

Worked example

Hillside Allied Health has 22 clinicians and 5 reception staff.

1. Under Settings → Library → Document types, the practice manager adds “AHPRA registration” (Fixed expiry date, required for Employee and Contractor). She then edits the Required for ticks on “Working With Children Check” so it applies only to the clinicians’ categories, and clicks Save requirements.
2. Clinicians open My Documents, upload their First Aid certificate (expiry 14/03/2027), WWCC and CV, entering the issued date for the CV.
3. Each Friday the manager filters Documents to unverified items, checks each file, and uses Verify selected.
4. In February a physiotherapist’s First Aid certificate drops into Expiring in ≤30 days. She gets the 30-day reminder email, uploads her renewed certificate, and the type shows Current again once the manager verifies it.

Related

• Staff profiles
• Automated email notifications
• Frontend staff portal
• Privacy, security and data