How the Plugin Works — Core Concepts

Understanding these five concepts will help you get the most from the plugin and configure it correctly for your organisation.

1. Documents are version-controlled

With versioning turned on (the default), every document has a version number, starting at 1.0.0. To record a new version, you add a changelog entry in the document’s Version & Changelog box — choose a Change Type, describe what changed, and save. The version number then increments automatically:

• Patch (e.g. 1.0.0 → 1.0.1) — Typos and minor fixes.
• Minor (e.g. 1.0.0 → 1.1.0) — Content updates.
• Major (e.g. 1.0.0 → 2.0.0) — Significant changes.

Which changes make staff re-acknowledge is a site-wide setting — Re-Acknowledgement Trigger Level under Settings → Acknowledgements & Notifications. The default is Major changes only (recommended); you can widen it to minor and major changes, or to all changes.

Version snapshots are kept as a permanent history. You can compare versions side by side and restore a previous version if needed.

Why this matters for auditing: When a staff member acknowledges a document, the record is tied to the exact version they read. If the document is updated later, their old acknowledgement does not disappear — it stays linked to the version that existed at that moment, along with a digital fingerprint of the content. You can prove what the document said when they signed off on it.

2. Acknowledgements are locked to versions

An acknowledgement is more than a checkbox. Each record stores:

• The staff member’s WordPress user account
• Their role at the moment of acknowledgement
• The document
• The exact version number acknowledged
• A SHA-256 hash (digital fingerprint) of the document content at that version
• The date and time, stored in UTC and shown to you in your site’s timezone
• When it expires
• How it was recorded — by the staff member themselves, by an administrator on their behalf (with a reason), by import, or through an owner’s review sign-off
• The IP address of the acknowledging device (on by default; you can turn it off under Settings → Acknowledgements & Notifications → Record IP Address with Acknowledgements)
• If a comprehension quiz was required: the questions shown, the answers given, and the score
• Optionally: the time spent reading and how far through the document the reader scrolled — captured only when Capture Read Time and Reading Reach is turned on (off by default)

The SHA-256 hash is the critical piece for audit evidence. If anyone ever questions whether the document has been altered since a staff member acknowledged it, you can compare the hash in the acknowledgement record against the hash of the version snapshot. If they match, the document is unchanged.

Expiry: Acknowledgements expire after a period you set globally (Default Acknowledgement Period, 365 days unless you change it) or per document — as a rolling number of days, a fixed annual date, or a named period schedule. After expiry, the staff member is asked to re-acknowledge. This enforces annual or periodic policy reviews without manual follow-up.

3. Role-based visibility is enforced at the database level

Documents are private by default. Two settings on each document decide who can see it:

• Confidentiality — only documents classified Public are open to logged-out visitors. Everything else (Internal Use, Confidential, Restricted, or unclassified) requires a login.
• Target Audience (Roles) — one or more WordPress roles. Only logged-in users with one of those roles can see, search, or open the document. If you leave the audience empty, any logged-in user can see it.

When a document requires acknowledgement, the roles you ask to acknowledge it are added to its audience automatically, so nobody is asked to acknowledge something they cannot open.

This is not implemented as hidden links. The query that fetches documents excludes any documents the current user is not authorised to see. A staff member who logs in with a Subscriber role cannot find, search, or access a document assigned only to Editors, even if they know the URL. Administrators can always see every document.

If you want to keep even Public documents out of anonymous browsing and search, turn on Hide Documents From Guests under Settings → Search.

Why this matters: In mixed environments — for instance, if you use the same WordPress site for public content and internal policies — you can serve both from the same hub without any risk of confidential policy content leaking to the public.

4. The knowledge base and governance layers work together

The plugin serves two functions at once:

Knowledge base — A searchable, browsable library of documents. Staff can find documents by type (Policy, Procedure, Guide), by category (HR, Health & Safety, Finance), by keyword search, and by browsing recently updated or popular documents. The Document Hub (

Governance — An acknowledgement system layered on top of the knowledge base. When staff open a document that requires acknowledgement, they see an Acknowledgement Required panel. Ticking the confirmation box and clicking Acknowledge records their sign-off. Administrators see live compliance rates on the Compliance Overview dashboard.

The two layers share the same content. You do not manage two separate content libraries. A document is a document — you decide whether it requires acknowledgement.

5. Compliance is visible at all times

Administrators see a Compliance Overview dashboard (Policy Management → Compliance Overview) showing:

• Overall compliance — how many required acknowledgements are recorded and currently valid
• Pending approvals — versions awaiting owner approval
• Documents past review cycle
• Expiring soon (30 days) and Already expired acknowledgements
• Compliance by risk tier and Compliance by role
• Campaign completion for each acknowledgement campaign

You can download the per-document figures with Export CSV.

Individual staff members can see their own status on a My Acknowledgements page (using the

Please log in to view your acknowledgements. Log in

Key terms at a glance