Every record.
Your server.
An auditor does not ask whether training was offered. The questions are who completed it, when, and how the result was assessed. Saga delivers the required training, grades it on submission, and issues certification automatically, and the employee records, assessment results, and certificates remain on infrastructure your organization controls.
- Accessible to WCAG 2.2 AA
- Aligned to KVKK and GDPR obligations
A training record is personnel data.
A completion record identifies a named employee, states what that employee was required to know, and records whether they demonstrated it. That is personnel data, and in most organizations it falls under the same handling rules as any other employee record.
Saga is deployed inside the organization, so records, results, and certificates are held on infrastructure the organization already owns, which keeps retention, access, and disclosure inside procedures that exist and have already been reviewed. Regulatory obligation is the most common reason organizations evaluate the platform. The deployment model carries a corresponding requirement: the application and its database run on a server the organization provides and maintains, and where that capability does not exist we say so during evaluation and recommend a hosted platform instead.
# complete the settings for your organization cp .env.example .env # provision the application and its database docker compose up -d
Every action has a name against it.
In most systems the answer to who changed this is a service account, which is not an answer an auditor accepts. Sign-ins, content changes, assessment submissions, certification, and outbound mail are each recorded against the named individual responsible, and the audit log is the record presented in a review.
None of this adds administrative work. Employees are created from the corporate directory, and access ends when the directory account is disabled. Programs are assigned to groups with a completion date, and employees who join a group afterward are enrolled automatically, which is what keeps a compliance population current between audits.
Access is separated by role: administrator, trainer, manager, and employee. The manager role has a reports view of its own, scoped to the groups that manager is accountable for and showing nothing further, which is what removes the standing request for a separate reporting system. Deactivation withdraws access and does not leave a session open.
What security review asks.
The same questions come up in every evaluation, and most platforms answer them with a policy document. In Saga each answer is a property of the build, which is a materially different kind of answer.
Records never leave the organization. The platform is deployed on infrastructure the customer controls, and no component of it calls out.
Multi-factor authentication cannot be disabled. Every sign-in requires a one-time code, issued by email, hashed, single use and time limited. No configuration setting turns it off for any account. Administrators have a documented break-glass path.
The ISO 27001 documentation set ships with the product. That includes a statement of applicability and a management system document set, so the security questionnaire is answered before it is sent.
KVKK and GDPR obligations are answered by screens. A consent gate, personal data export, anonymization, retention purge, and a data subject request channel are all reachable inside the application, under its compliance section.
WCAG 2.2 AA is verified on every release. An automated axe-core gate runs in continuous integration, so accessibility is a build result that a reviewer can check.
The platform and its supply chain are hardened. Per-request nonce CSP, AES-256-GCM encryption of stored SMTP and LDAP credentials, CSRF validation in middleware, per-IP and per-account rate limiting, immediate session revocation, a non-root container, dependency scanning, and a CycloneDX SBOM with each build.
Certification that cannot be issued by hand.
What a completion record is worth becomes clear the day somebody challenges it. Certification follows automatically: a PDF carrying an atomic number in the form SAGA-YYYY-NNNNN, issued in an unbroken sequence without administrative action and impossible to produce outside the process, which is what makes the record defensible under challenge.
Behind the certificate is a defined sequence of video, written material, and assessment. Employees progress in order and video cannot be advanced to the end, so a recorded completion reflects the whole program and not an attempt at the final assessment. Assessments are graded on submission, with feedback against each question.
Nothing new to run alongside it.
Saga attaches to the systems an organization already operates. Nothing else has to be procured, licensed, or run beside it.
Directory. Sign-in is through Active Directory or LDAP. A directory user signing in for the first time is created automatically with a configured default role, and access ends when that account is disabled.
Mail. One-time codes and notifications are sent through the organization's own SMTP server, and every message is logged with its recipient, subject, status, and the template that produced it.
Server. The application and its database deploy together, on hardware the organization owns or infrastructure it leases.
Nine languages. The interface is supplied in Turkish, English, German, French, Dutch, Italian, Polish, Macedonian, and Bulgarian, and selected per employee, so a workforce spread across several of them does not need a second deployment. Reports export to spreadsheet formats that open correctly, with Turkish characters preserved.
Review Saga with compliance, quality, and IT.
Tell us the size of your workforce and the obligations you are required to evidence. The demonstration will be structured around those requirements.
- A guided demonstration covering a complete program, assessment, and issued certificate
- Sign-in and multi-factor authentication tested against your own directory
- Licensing explained for an organization of your size