www.skillproof.uk
Public marketing website, trial requests, demo requests, partner information and trust/legal pages.
IT and security review
What IT and procurement need to review SkillProof.
Use this page to review SkillProof domains, data categories, infrastructure providers, third-party services and security controls before approving access or starting a pilot.
Reviewed 12 August 2026. Use fake or test data first.
From authorised access to a reviewable record.
This is a simple product-level view for supplier review. Detailed contractual and privacy information remains in the linked DPA, privacy and sub-processor pages.
- 01
Authorised user
Owner, admin, manager or staff access.
Hannah MossInvited userManager - 02
SkillProof app
HTTPS access and role-based controls.
app.skillproof.ukHTTPS onlyTLS - 03
Organisation records
Training, evidence, dates and actions.
Oakview GroupOwn records onlySeparate - 04
Review output
Reports, exports and Audit Packs.
Audit PackPDF exportReady
Workforce training and compliance records, not patient records.
SkillProof is used to manage workforce training, evidence, registrations, renewals, reminders, reports and audit-ready compliance records. It is not a patient record system. Review teams should use fake/test data during supplier checks, pilots and workspace setup before adding real staff records.
skillproof.uk
Apex domain used for brand access and canonical redirect handling.
app.skillproof.uk
Customer application for login, workforce training records, development records, actions, evidence, reports and billing access.
Data handled
- Staff names and work contact details
- Job roles, sites, departments and manager relationships
- Training records, renewal dates and compliance statuses
- Appraisal records, CPD records and development action records
- Evidence and certificates uploaded by customer organisations
- Assessments, checklists, declarations and sign-offs
- Professional registrations, licences and role-specific checks
- Reports, exports and audit pack records
Security controls
- HTTPS/TLS for public website and app access
- Organisation-level data separation
- Role-based access controls
- Private evidence storage linked to workforce records
- Audit and activity logging where implemented
- Controlled user access and invite-based customer setup
- Secure Stripe billing with no card numbers stored by SkillProof
- Data export support for customer records
Established providers, honest certification wording.
SkillProof uses established infrastructure providers. Their security programmes support the SkillProof supply chain, but this does not mean SkillProof itself is independently certified.
SkillProof does not currently claim ISO 27001, SOC 2, Cyber Essentials or NHS accreditation unless separately confirmed.
| Provider | Purpose | Third-party domains |
|---|---|---|
| Vercel | Hosting, deployment and application delivery | |
| Cloudflare | DNS, SSL, routing and security layer | |
| Supabase | Database, authentication and file storage | |
| Stripe | Payments, subscriptions, invoices and billing portal | api.stripe.com, checkout.stripe.com, billing.stripe.com |
| Web3Forms | Public website form delivery | api.web3forms.com |
| Google Analytics | Consented, sanitised server-side events and public-site page measurement | www.googletagmanager.com, www.google-analytics.com |
| Google Ads | Optional conversion reporting from eligible, server-confirmed Analytics outcomes | www.googleadservices.com, googleads.g.doubleclick.net |
| Microsoft Clarity | Consented, masked public-site behaviour analytics | www.clarity.ms, *.clarity.ms, c.bing.com |
| Resend | Email delivery if enabled for application emails | api.resend.com |
External services used by SkillProof. These domains may appear in website form delivery, analytics, billing or application email flows. They should be reviewed alongside the primary SkillProof domains where local filtering tools require supplier details: 12 domains in total.
Network and IT allowlisting
Domains for review.
Organisations may need their IT or security team to review or allowlist these domains if local web filtering blocks new or uncategorised SaaS domains.
https://www.skillproof.uk
Public website, legal pages, trust information, trial requests and demo requests.
https://skillproof.uk
Apex brand domain that redirects to the canonical public website.
https://app.skillproof.uk
Customer application for authorised users managing workforce records and reports.
Review notes
SkillProof is a staff training and compliance platform.
SkillProof is not a patient record system.
Supplier review and onboarding testing should use fake/test data first.
On approved public-site pages, the Google tag may load in denied Consent Mode before a visitor chooses. Optional analytics and advertising storage remain denied until the relevant consent is accepted. The tag does not receive form contents or customer workspace data; ad personalisation and remarketing are not enabled. Completed outcomes are confirmed by the server and joined to the consented browser session; the thank-you page does not fire a second advertising conversion.
Microsoft Clarity loads only after analytics consent on approved public-site pages. The public page body is masked for recordings, and the integration is stopped outside the approved marketing routes.
Security contact: Contact SkillProof support. Privacy and supplier review questions can also be sent to Contact the privacy team.
Ready to test SkillProofwith safe data?
Start a trial with test data first, or book a demo to walk through access, data handling and controls before adding real staff records.
14-day free trial. No card required.