Privacy, Security & Data

Attestation Core holds sensitive staff information: scanned certificates, police checks, CVs, contact details and compliance history. This guide explains where that information is stored, how files are protected, what is logged, how to answer a staff member’s request to access or erase their data, and what happens when you uninstall.

It’s written for site administrators and privacy officers. Most of what’s described here works automatically. The sections below say what to check and when you need to act.

Overview

Topic	Free	Pro
Private file storage, protected downloads and the daily security self-test	✓	✓
Admin Action Log (deletions and resets)	✓	Pro deletions are logged too
File access log (every file download)	✓	✓
WordPress personal data export and erasure	✓	Adds Pro data groups
Suggested privacy-policy text	✓	Adds a Pro section
Google Shared Drive storage	—	✓

Private file storage and the security self-test

Where files are kept

Uploaded documents and evidence files are never stored in the normal WordPress Media Library. The plugin picks a private folder in this order:

1. One level above your WordPress folder (outside the web root). This is the default. No web address leads to this folder, so files there can’t be reached by URL on any web server.
2. If your host doesn’t allow that, wp-content/uploads/attestation-core-private/. The plugin places blocking files in this folder (.htaccess for Apache, web.config for IIS, and an index.php stub) and gives every file a long random name.

A site administrator who needs a specific location can set it with the ATTESTATION_CORE_PRIVATE_DIR constant in wp-config.php. When the plugin moves its storage from the uploads fallback to the outside-web-root location, existing files are moved across automatically.

The Settings → Storage tab describes the uploads folder as the file location. On most hosts, files actually go to the outside-web-root folder described above.

How files are delivered

Files are only ever served through the plugin’s own download links, which check who is asking before sending anything:

• Administrators need the Manage documents permission (for documents) or Validate evidence (for evidence files).
• Staff must be signed in, have an active linked profile, and own the file. A request for someone else’s file gets the same “not found” answer as a file that doesn’t exist, so file numbers can’t be guessed.
• Staff downloads are limited to 60 per hour per person.
• Files are sent as downloads with headers that stop browsers from guessing file types or passing the link on to other sites.

Uploads are accepted only as PDF, JPG, PNG, DOC or DOCX, up to 25 MB (or your server’s upload limit if that’s lower). The file’s actual contents are checked against its extension.

The security self-test

If your files end up in the uploads fallback folder and your web server ignores the blocking files (common on Nginx), the files could be downloaded by anyone who knows the address. The plugin checks for this automatically:

1. Shortly after installation (about 30 seconds after the first page load, using WordPress’s scheduled tasks), the plugin places a small test file named canary.txt in the private folder and tries to fetch it over the web.
2. The check then repeats about once a day.
3. If the private folder is outside the web root, it’s protected by design and no web fetch is needed.
4. If the test file can be read over the web, every user who can manage plugins sees a red notice in wp-admin: “Attestation Core: Private document storage is publicly accessible.”
   • On Nginx, the notice shows the exact rule to add to your server configuration:

     location ^~ /wp-content/uploads/attestation-core-private/ {
         deny all;
     }

   • On other servers, it asks you to check that Apache honours .htaccess (AllowOverride All) or that IIS loads web.config, or to ask your host to block web access to that folder.
5. Dismissing the notice (the × button) hides it for you until the next daily check. If the problem is still there, the notice comes back. Fixing the server rule is the only way to make it stay away.

If the test can’t run (for example, the folder isn’t writable or the site can’t reach itself over the web), no notice is shown and the plugin tries again on the next check. You’ll find the same explanation and the Nginx rule under Attestation Core → Settings → Storage → Security self-test.

🔒 Pro feature — requires the Pro plugin.

Pro can store files in a Google Shared Drive instead of on your server. Downloads still go through the same permission-checked links. If Google Drive is selected but not connected, uploads fall back to private local storage and an admin notice tells you. See Google Drive storage.

Admin Action Log

Attestation Core → Action Log (page title Admin Action Log) is an audit trail of destructive admin actions, newest first.

• Who can see it: only users with the WordPress manage_options permission, which in practice means Administrators. Other plugin roles don’t see this menu item.
• Columns: Date / Time (UTC), User, Action, Object, Details and IP address. Entries from automated processes show (system) as the user.
• Filter: choose an object type from Filter by object type and click Filter. There are 50 entries per page.
• Retention: entries older than 365 days are removed automatically by the daily scheduled task.

What’s recorded (free plugin):

• Deleting a document (single or bulk; bulk deletions are marked “bulk”)
• Deleting an evidence submission
• Deleting a credential record
• Deleting an evidence category or a custom workforce type
• Removing a document type in the setup wizard
• Resetting a notification template to its default
• Resetting your custom labels

🔒 Pro feature — requires the Pro plugin.

Pro also records deletions of annual plans (single and bulk), plan items, upskilling plans, departments, RTO milestones, validation panels, webhooks and scheduled reports.

Everyday actions such as saving settings, verifying documents, validating evidence and archiving profiles aren’t recorded in this log.

File access log

Every time a stored document or evidence file is downloaded, by an admin or by the staff member who owns it, the plugin records the date and time, the person who downloaded it, whether they were an admin or the owner, which file, the profile it belongs to, and the IP address. This log has no admin screen. It’s included in that person’s personal data export, deleted when their data is erased, and automatically removed after 365 days.

Personal data export and erasure

Attestation Core connects to WordPress’s built-in privacy tools, so you can respond to a staff member’s request to see or erase their data.

Exporting a person’s data

1. Go to Tools → Export Personal Data, enter the person’s email address and click Send Request. WordPress emails them a confirmation link.
2. Once they confirm, click Download personal data (or Send export link).

The plugin finds the person by the email on their compliance profile, or through the WordPress account linked to the profile. The export includes these groups:

Free plugin (“Dantian Attestation Core compliance record”):

• Compliance profile: name, email, phone, Credential Policy category, employment type, workforce categories, status, created date
• Unit assignments (Pro RTO data, if any)
• Credentials: name, issuing body, category, date attained, verified, working towards
• Documents on file: type, file name, issued and expiry dates, verified, status
• Annual plans and Plan items (Pro plan data, if any), including the IP address recorded when a plan was submitted
• Evidence and Evidence unit links: type, title, description, date, status, validated date, admin comment
• Currency Attestations
• Notifications sent
• File access log

The export lists the details of each uploaded document and evidence file, not the files themselves. If the person also needs copies of their files, download them from their profile and send them separately.

🔒 Pro feature — requires the Pro plugin.

Pro adds an “Attestation Core Pro data” exporter with these groups: Department assignments, Coordinator scope settings, Webhook delivery logs, Scheduled report recipients, Upskilling plans, Compliance event assignments and Validation panel participation.

Erasing a person’s data

Erasure runs when you process a request under Tools → Erase Personal Data. It also runs automatically when you delete a WordPress user who is linked to a compliance profile.

Some of what’s held about a person is a compliance record your organisation may be required to keep, such as evidence that was reviewed. So the plugin deletes some data outright and keeps other records with identifying details removed:

Deleted	Kept, with identifying details removed
Credential records	Profile: name, email, phone and workforce categories blanked; unlinked from the WordPress user; status set to Archived
Document records and their uploaded files	Evidence: description and admin comment blanked (title, date, status and any attached file are kept)
Signed currency attestations	Annual plans: submission IP address blanked
File access log entries	Plan items: descriptions blanked
Unit assignments	Notification log: recipient email and subject blanked

The WordPress erasure screen then reports messages such as “Profile anonymised and archived.” and “Validated evidence, submitted plans, and notification-log entries are retained as compliance audit records with identifying fields removed.”

Erasure can’t be undone. The anonymised profile stays in your records as an archived, unnamed profile so that the retained evidence still makes sense.

🔒 Pro feature — requires the Pro plugin.

When Pro is active, its eraser runs first. It:

• deletes the person’s documents stored in Google Drive
• removes their department assignments and webhook delivery log entries
• removes them as a recipient of scheduled reports
• removes any department-coordinator scope settings
• keeps upskilling plans, validation-panel records and compliance events, but unlinks the person and blanks their IP address and free-text fields

Suggested privacy-policy text

Both plugins add suggested wording to Settings → Privacy → Policy Guide, describing what’s collected and how erasure works. Review it and adapt it for your own privacy policy.

Uninstalling

Deactivating the plugin only stops its scheduled tasks. Nothing is deleted. Deleting (uninstalling) the plugin follows a two-part rule:

• Security-sensitive items are always removed.
• Your compliance data is kept unless you’ve chosen to erase it, so that an accidental delete-and-reinstall doesn’t wipe your audit history.

The keep-data setting

Go to Attestation Core → Settings → Advanced → Data removal on uninstall. The Erase all data on uninstall checkbox is unticked by default, which means data is kept. To erase everything when you delete the plugin, tick it and click Save advanced settings before uninstalling. The same setting controls both the free and Pro plugins.

Free plugin: what’s removed

Always removed, whatever the setting:

• The plugin’s signing secret for attestations, and Pro’s encryption key
• Google Drive connection details, SMS settings, and the Pro licence key and status
• The settings saved on Settings → General, including organisation name and code, admin contact email, annual plan due date, recency threshold and declaration text. Note these down if you plan to reinstall.
• The storage self-test result, notice dismissals and the setup-wizard redirect flag
• All of the plugin’s scheduled tasks

Removed only when “Erase all data on uninstall” is ticked:

• All uploaded files in the private folder, and the folder itself
• All of the free plugin’s database tables: profiles, credentials, workforce categories, documents and document types, evidence and evidence categories, units and unit assignments, attestations, the notification log, the Admin Action Log and the file access log
• The Trainer / Assessor role, and the plugin’s permissions on the Administrator role
• All remaining plugin settings, including document types, evidence categories, workforce types, labels, notification templates and portal-page mappings
• The link between WordPress users and their profiles

WordPress user accounts themselves are never deleted, and neither are the pages you created for the portal.

🔒 Pro feature — requires the Pro plugin.

Pro plugin: what’s removed

Always removed: the licence information, the encryption key, Google Drive connection details, SMS settings and Pro’s scheduled tasks. Because the encryption key is removed, anything Pro stored encrypted (such as webhook secrets) can’t be recovered after uninstall.

Removed only when “Erase all data on uninstall” is ticked: all Pro database tables (annual plans and plan items, departments, webhooks and their logs, scheduled reports, upskilling plans, validation panels and the other Pro records) and Pro’s own settings.

Files already stored in your Google Shared Drive are not deleted by uninstalling. Remove them in Google Drive if you no longer need them.

Uninstall Pro first, then the free plugin. Pro has to be deactivated before the free plugin anyway, because it depends on it. Order also matters for data removal: if the free plugin is uninstalled first with erase ticked, it removes the erase setting along with everything else, and Pro would then keep its tables when it’s uninstalled.

On a multisite network, uninstalling runs for every site in the network, and each site’s own Erase all data on uninstall setting decides what happens to that site’s data.

Troubleshooting

Problem	What to do
The red “publicly accessible” notice keeps coming back	The server is still serving the folder. Add the Nginx rule shown in the notice (or fix .htaccess/web.config handling), then wait for the next daily check.
I don’t see the Action Log menu item	It’s only shown to Administrators (manage_options).
A personal data export for a staff member is empty	Their compliance profile email doesn’t match the address entered and the profile isn’t linked to that WordPress user. Check the email on their profile.
I reinstalled and my organisation name and admin email are gone	The General settings are always removed on uninstall. Re-enter them under Settings → General. Your profiles and records are still there if erase was left unticked.

Worked example

Coastal Training Institute, an RTO running Free and Pro on an Nginx host, works through these tasks:

1. The day after installing, the administrator sees the red storage notice because the host put files in the uploads fallback folder. They send the Nginx rule from the notice to their host. After the next daily check, the notice doesn’t return.
2. A former trainer emails asking for a copy of their data. The compliance officer runs Tools → Export Personal Data, and the export includes the trainer’s profile, credentials, document details, evidence, attestations and Pro department assignments.
3. A month later the trainer asks for erasure. The officer runs Tools → Erase Personal Data. The trainer’s credentials, documents and files are deleted. Their validated vocational evidence stays on record as an archived, anonymised profile for the RTO’s record-keeping.
4. When the institute later moves to a new site, they leave Erase all data on uninstall unticked so that the old site’s records stay in its database backup.

Related

• Document management
• Compliance evidence
• Google Drive storage
• User roles and permissions