Every record.
Your server.
An auditor does not ask whether training was offered. They ask who completed it, when, and how it was assessed. Saga delivers that training, grades it on submission, issues certification automatically, and keeps every record on infrastructure your organization controls.
- Accessible to WCAG 2.2 AA
- Aligned to KVKK and GDPR obligations
A training record is personnel data.
Completion records identify named employees, what they were required to know, and whether they demonstrated it. That is personnel data, and in most organizations it falls under the same handling rules as any other employee record.
Saga is deployed inside the organization. Records, results, and certificates are held on infrastructure the organization owns, which keeps retention, access, and disclosure within procedures that already exist and have already been reviewed. Regulatory obligation is the most common reason organizations evaluate the platform.
# complete the settings for your organization cp .env.example .env # provision the application and its database docker compose up -d
Every action has a name against it.
In most systems the answer to who changed this is a service account. An auditor does not accept that. Sign-ins, content changes, assessment submissions, certification, and outbound mail are each recorded against the named individual responsible, and the audit log is the record an auditor is shown.
None of that costs an administrator anything. Employees are created from the corporate directory rather than opened by hand, and access ends when the directory account is disabled. Programs are assigned to a group with a completion date, and anyone who joins that group afterward is enrolled without being noticed.
Access is separated by role: administrator, trainer, manager, employee. Line managers see the groups they are accountable for and nothing else, which is what removes the separate reporting request. Deactivation withdraws access rather than leaving a session open behind it.
What security review asks.
Four questions come up in every evaluation, and most platforms answer three of them with a policy document. These four are answered by the build. A setting that can be turned off is a promise, not a control.
Records never leave the organization. The platform is deployed on infrastructure the customer controls.
Multi-factor authentication cannot be disabled. Every sign-in requires a one-time code. There is no setting to switch it off for convenience.
The ISO 27001 documentation set ships with the product. That includes a statement of applicability and a management system document set, so the security questionnaire is answered before it is sent.
Accessibility and data protection are implemented, not promised. WCAG 2.2 AA is verified on each release, with consent, export, anonymization, and retention controls built in.
Completion reflects the program, not the exam.
A program is a defined sequence of video, written material, and assessment. Employees progress in order, and video cannot be advanced to the end, so a recorded completion reflects the whole program rather than an attempt at the final assessment.
Assessments are graded on submission, with feedback against each question. Certification follows automatically: a PDF, numbered in an unbroken sequence, issued without administrative action and impossible to produce outside the process. That last property is what makes the record defensible.
Nothing new to run alongside it.
Sign-in is Active Directory or LDAP, with provisioning that follows it. One-time codes and notifications leave through your own SMTP server. Application and database deploy together, on hardware you own or infrastructure you lease.
Reporting exports to spreadsheet formats that open correctly, with Turkish characters intact, which is not a given. The interface is supplied in nine languages and selected per employee, so a mixed workforce is not a second deployment.
Review Saga with compliance, quality, and IT.
Tell us the size of your workforce and the obligations you are required to evidence. The demonstration will be structured around those requirements.
- A guided demonstration covering a complete program, assessment, and issued certificate
- Sign-in and multi-factor authentication tested against your own directory
- Licensing explained for an organization of your size