Product specifications

Everything Vekuri does.

Vekuri is a training and certification platform for frontline workforces: one system of record for who is trained, who is certified, what expires when, and the evidence behind every record. It ships as an employee app for iOS, Android and the web, and an admin console. This page is the specification: every capability and the surfaces they live on.

At a glance

Surfaces: Employee app (iOS, Android, web) and admin console (web).
Tenancy: Multi-organization; every record scoped and isolated per organization.
Learning modalities: Online, instructor-led (in person or virtual), blended.
Credentials: Certifications with typed requirements, automatic issuance, expiry and renewal.
Attendance capture: Rotating QR, short code, roll call, scanned sign-in sheets with OCR. No second app, no GPS.
Assessment: Voice practice exam with an AI examiner, formative only.
Audit: Append-only, hash-chained, exportable per employee, certification and organization.
Identity: Enterprise SSO (SAML/OIDC), passwordless sign-in, admin-provisioned credentials, MFA.
Integrations: HRIS sync (Lattice and other HRIS systems), CSV import, SCORM/xAPI, Zoom, LMS history migration, REST API and webhooks.

Two surfaces, one contract

An employee app and an admin console, both consuming the same versioned REST API.

Employee app
A native iOS and Android app built with React Native, and the same experience on the web. It is designed for a phone held in one hand.
- Reaches the next class, the course to resume or the check-in within three interactions after sign-in.
- Home shows assignments, certifications, the next session and expiring certificates.
- Course detail lists lessons, sessions and materials with one-tap enrollment.
- Personal certificates serve as proof of record, and renewal requests start from them.
- Study plans export to the phone's calendar.
- A class ledger and catalog search cover what was attended and what is open to enroll in.
- Push notifications and biometric unlock.
- Lessons and personal records are cached offline on mobile.
Admin console
Role-gated: Platform admin, Organization admin, Content manager and Supervisor. Facilitator is a per-session designation, not a role.
- A needs-action inbox behind a topbar counter collects expiring certificates, pending evidence, renewal requests, fraud signals, under-enrolled sessions and unschedulable mandatory courses, with a kanban view.
- Dashboard widgets: compliance matrix by department and certification, expiring and expired certificates, session fill, evidence queue, attendance health and fraud, virtual engagement gap, course and employee activity.
- A supervisor console scoped to the supervisor's departments.
- Platform-admin metrics across organizations without drill-down into people.
One API contract
Both surfaces call the same versioned REST API, described by an OpenAPI document that generates their typed clients.
- Integrations reach the same capabilities the console does, through the same contract.
- Mobile, web and console are released against the same contract version.

Organizations, people and targeting

Strict tenant isolation, a roster that comes from your systems of record, and targeting that reaches people by structure or by rule.

Every record is scoped to one organization; nothing crosses that boundary.
Organizations are created, configured and suspended; suspension blocks sign-in, keeps the data and keeps every clock running.
Departments, job positions, employment type, venues, shifts and managers describe the workforce.
The roster is loaded by CSV bulk import, which is the source of record.
Lattice and other HRIS systems sync read-only on a schedule; the sync never creates or deactivates a person.
People are deactivated and reactivated with their history intact.
The People screen filters thousands of employees by department, job position, compliance state, employment type and incomplete mandatory courses without opening a profile.
A 360-degree employee record shows a timeline and the job-position requirement gap by competency area.
Direct targeting reaches a department, a job position or one person; dynamic segments reach people by rule.
Organization vocabulary renames badges versus certifications, or team members versus employees, without touching permissions, data or audit.

Courses and content

Courses in three modalities, lessons made of content blocks, and content that arrives from your documents, your marketplace or your previous LMS.

Modalities are online, instructor-led and blended.
Certification is an optional attribute of a course, never a prerequisite for creating one.
Lessons are ordered content blocks: video, slides, documents, text, callouts, scenarios, and gate-free practice activities (sort, sequence, decision, flashcards).
Video streams as adaptive HLS for weak connections.
Checkpoint knowledge checks measure understanding and never gate progress.
Microlearning guidance keeps lessons at three minutes or less; compliance content is exempt.
Progress is tracked per lesson, and completion is modality-aware.
The library shows per-course metrics: enrolled, completion, in progress, abandonment, average completion time and an anonymous one-to-five rating.
Course detail in the console shows the course's shape, metrics, sessions, unbooked assignees and the assignments reaching it.
Course origin is recorded as internal, licensed or AI-drafted.
SCORM 1.2, SCORM 2004 and xAPI packages import.
Marketplace content (Go1, OpenSesame) keeps the original issuer on the certificate.
AI drafts a course from your documents, slides and recordings; a mandatory human review gate precedes publishing.
Training history migrates from an incumbent LMS (Docebo, for example) via CSV, tagged with its provenance.

Classes, sessions and attendance

Scheduled classes in person or virtual, and attendance captured without a second app, without GPS, and with every capture on the record.

Classes run in person or virtual; a virtual class carries a Zoom link and is never hosted or joined by a bot.
Sessions carry date and time, location or link, capacity and facilitator.
Rescheduling keeps the roster intact; cancellation cascades to enrollments and notifications.
Class materials attach to the class, and each employee has a class ledger.
Employees self-enroll within capacity, or an admin places them.
A rotating room QR (displayed for 20 seconds, valid for 60) mints a single-use, session-bound personal grant.
A facilitator short code covers the same capture, including virtual sessions.
Roll call is the offline backstop.
Paper sign-in sheets are scanned with OCR: upload a photo of the sheet and attendance for the whole session is recorded, with no manual data entry.
Codes are delivered by push, SMS or email when check-in opens.
A digital-signature sign-off sheet closes the session with facilitator confirmation.
The live roster updates within seconds.
Every capture and every rejected redemption is logged as a tamper-evident event feeding the fraud-signal widget.
Zoom join and leave events reconcile against the roster.
There is no GPS or geofencing, ever, and no second app to install.

Certifications, evidence and renewals

A certification is a set of typed requirements and an optional validity. Issuance is automatic, the lifecycle is explicit, and evidence is reviewed by a person.

A certification is requirements (complete a course, attend a class, present exam evidence) plus an optional validity period.
Issuance is automatic the moment the requirements are met.
The lifecycle is active, expiring (inside a 60-day threshold) and expired.
Every certificate carries trainer and evaluator identities and dates, as regulations such as 29 CFR 1910.178(l)(6) require.
Retention is configurable per certification, from one year to employment plus thirty years.
Event-triggered refreshers follow an incident, a near miss, a failed evaluation or a reassignment.
Requirement variants are scoped by jurisdiction or role, such as different cycles for California and New York.
The issuer is recorded on the certificate: the organization or the licensor.
Admins upload or record evidence; employees self-submit, and approval or rejection carries a mandatory reason.
Grading is pass or fail with a score, prefilled from a session's roster.
Evidence is served only through short-lived authorized links.
Renewal requests resolve automatically or are dismissed with a reason.
The certifications overview shows KPIs and the requirement map across positions and departments.

Assessment and AI

AI in three bounded roles: an examiner for practice, a companion for navigation, and an assistant that drafts for a human to approve. None of them touches a certificate.

A voice practice exam runs in the browser or the app with an AI examiner for the subject.
The examiner returns a score and criterion-by-criterion feedback pointing at the lessons to review.
Attempt history and transcripts are kept for the employee to read back.
Practice is strictly formative: an attempt never gates, grants or contributes to a certificate.
After an attempt, recommendations reach across the catalog the employee can see.
A readiness signal read from attempt history is advisory and labelled as such, never a grade.
An AI navigation companion answers read-only questions from the employee's own data.
The HR email assistant has a per-organization inbox and turns messages into typed, confidence-scored drafts.
A human approves every draft before anything executes.
The assistant can create assignments, enrollments and placements only; it never writes attendance, fulfilments or certificates.
Every write it originates is attributed to a distinct machine actor in the audit trail, beside the approving human.

Notifications and channels

A fixed set of notifications, configured per organization and delivered over the channels an employee has agreed to.

The set covers assignment, enrollment confirmation, class reminders at 24 hours and 1 hour, reschedule and cancellation, the certificate expiry ladder at 60, 30, 7 and 0 days, the daily admin digest, issuance, evidence recorded, approved or rejected, and the facilitator pre-class brief.
Rules are set per organization: enable, offsets and recipients.
Supervisors receive digests for their departments.
Channels are email, push on iOS and Android, SMS with explicit consent, and in-app.
Employees view and revoke their SMS consent themselves.
Delivery and bounces are monitored.

Audit, exports and records

An append-only history behind every certificate and every attendance capture, chained so that any retroactive edit is detectable, and exportable in the shape an auditor asks for.

Certificate and attendance events are append-only.
Each event carries a sequence number, the previous event's hash and its own hash; altering any past event breaks the chain.
Chain heads are anchored to write-once storage (S3 Object Lock, compliance mode), so not even the operator can rewrite them within the retention window.
Every event is attributed to a human, a system or an assistant actor.
Exports are produced per employee, per certification and per organization: who completed what, when, verified by whom.
Retention is enforced by scheduled jobs, and nothing is deleted below the floor.

Compliance and development, without blurring them

One engine, two registers. Compliance and certification is mandatory, expiring and audited, and speaks compliance language; development and growth is voluntary, cumulative and speaks progress tracking. Organization vocabulary keeps them apart in the interface without touching permissions, data or audit.

The same concept in the compliance register and the development register
Compliance view	Development view
Certifications	Badges
Courses	Development courses
Employees	Team members