# CPDKeep Team Trust Pack

Updated: 7 July 2026

Sample-only: every organisation name, staff name, date, reminder state, export row, practitioner name, activity, and evidence reference in this pack is fake demonstration data. It does not include private staff activity titles, providers, notes, reflection text, evidence contents, original filenames, upload paths, email content, payment details, tokens, or private user records.

This pack is designed for Team plan buyer sharing. It summarizes current product behavior in plain language and links to sample-only outputs.

## Plain-language security overview

CPDKeep uses managed cloud providers, account access controls, and private-by-default product flows to operate CPD records, evidence, exports, team oversight, and autofill features.

The product intentionally does not publish low-level storage identifiers, temporary-access mechanics, provider secrets, or exact infrastructure topology in public buyer material.

CPDKeep is a CPD record-keeping tool. This pack supports buyer review, but it does not replace a buyer security review, procurement review, legal advice, AHPRA, a National Board, a regulator, a CPD home, or your own CPD obligation checks.

## Privacy boundaries

Individual CPD activity records and evidence files are private to the account holder unless they choose to export, download, or share them outside CPDKeep.

Team administrators can see summary oversight fields such as readiness labels, profession grouping, renewal timing, progress percentages, evidence completeness grades, missing evidence counts, missing reflection counts, and reminder status.

Team views and exports do not automatically expose private evidence files, activity titles, providers, notes, reflection text, document text, raw forwarded email content, payment details, tokens, or private storage paths to team administrators.

## Data handling summary

CPDKeep stores account and profile details needed to run the Service, including name, email address, profession, plan, and CPD cycle settings.

It stores CPD activity records that users create, such as dates, categories, hours or credits, notes, reflection fields, topics, and uploaded or imported evidence files. Evidence may include certificates, receipts, attendance records, and documents users choose to upload, forward, or import.

The web application deployment is configured for an Australian hosting region. Database, file storage, payment, email, analytics, and optional autofill features rely on managed cloud service providers, and those services can have separate processing and support arrangements. CPDKeep does not make a blanket data-residency guarantee.

## AI and autofill explanation

When document or email autofill is enabled and available on a plan, CPDKeep may use uploaded or forwarded evidence to suggest CPD fields such as title, date, provider, category, hours, and topics.

Autofill output is a draft. The user reviews and confirms suggestions before they become part of the CPD log.

This pack does not make provider-specific claims about model training, retention periods, regional AI processing, or AI provider infrastructure.

## Backup and recovery posture

CPDKeep relies on managed cloud providers and operational safeguards to operate the Service and recover from routine platform issues.

This pack does not promise specific recovery timing, data-loss commitments, special backup commitments, disaster recovery attestations, incident response service levels, or monitoring commitments.

## Data export and deletion process

Where a plan includes reports, individual users can export CPD audit materials from the product.

Team administrators can export summary-level team readiness material for internal practice operations where that feature is available.

Some account details can be updated in the account area. For help accessing, correcting, exporting, or deleting account data beyond self-serve controls, submit a support request through the signed-in Service.

## Incident contact process

Signed-in users and team administrators should submit security, privacy, account-access, or data-handling concerns through the in-app support request flow.

Include the affected account or team, relevant timeframe, a short description of what happened, and safe screenshots or log snippets if useful. Do not include patient information, private evidence contents, raw forwarded emails, credentials, tokens, or secrets in the initial message.

CPDKeep reviews incident reports through the support channel. This pack does not publish a fixed response-time commitment.

## Subprocessor list

Informational list based on current product behavior and the public Trust page posture.

| Provider | Purpose | Data context |
| --- | --- | --- |
| Vercel | Web application hosting, deployment, analytics, and speed insights | Public site and application request/usage telemetry handled by the hosting platform |
| Supabase | Authentication, database, and file storage | Account records, CPD records, team records, evidence metadata, and uploaded/imported evidence files |
| Stripe | Checkout, subscription billing, customer portal, invoices, and payment handling | Billing account and transaction data handled on Stripe-hosted surfaces and related webhook events |
| Resend | Transactional email and inbound evidence email handling | Email delivery metadata, support/status email delivery, and forwarded evidence email handling where enabled |
| OpenAI | Optional document and email autofill suggestions where enabled and available | Uploaded or forwarded evidence content used to produce review-before-save draft CPD fields |
| Google Analytics | Website and application analytics | Analytics events from public site and signed-in application routes where the Google tag is loaded from the root application layout |

## Sample Team export

The following sample is generated from fake Team summary data using the same summary-only export helper used by CPDKeep Team readiness exports.

| Staff | Profession | Readiness | Renewal window | Progress | Evidence grade | Missing evidence | Missing reflection | Reminder |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Demo Staff Avery | Nurse | Ready | More than 90 days | 100% | Excellent | 0 | 0 | Resolved |
| Demo Staff Blake | Physiotherapist | Needs attention | Due in 31-90 days | 40% | Fair | 0 | 1 | Opened |
| Demo Staff Casey | Psychologist | At risk | Due within 30 days | 0% | Excellent | 0 | 0 | Sent |

```csv
"CPDKeep team readiness summary"
"Organisation name","Demo Allied Health Clinic"
"Export date","2026-06-30"
"Generated at","2026-06-30T12:00:00.000Z"
"Disclaimer","This export is a manager summary of readiness and evidence-completeness signals for internal practice operations. It is not a certification, legal advice, or regulatory advice; managers and staff must review current requirements and records before relying on it."

"Staff summary"
"Metric","Value"
"Active staff","3"
"Former staff","0"
"Total staff rows","3"
"Ready staff","1"
"Needs attention staff","1"
"At risk staff","1"
"Active internal team policies","0"
"Staff with internal team policy prompts","0"
"Requirement changes since cycle","0"
"Requirement reviewed no-change notices","3"
"Exception rows","2"
"Reminder not sent","0"
"Reminder sent","1"
"Reminder opened","1"
"Reminder resolved","1"

"Staff readiness summary"
"Staff display name","Profession","Readiness label","Renewal window","Renewal timing","Progress percentage","Hours completed","Hours required","Evidence completeness grade","Evidence completeness","Missing evidence count","Missing reflection count","Last updated","Reminder state","Lifecycle state","Offboarded at"
"Demo Staff Avery","Nurse","Ready","More than 90 days","Due in 153 days","100","20","20","Excellent","2/2 activities evidence complete (Excellent)","0","0","2026-06-20","Resolved","Active staff",""
"Demo Staff Blake","Physiotherapist","Needs attention","Due in 31-90 days","Due in 46 days","40","8","20","Fair","1/1 activities evidence complete (Fair)","0","1","2026-06-18","Opened","Active staff",""
"Demo Staff Casey","Psychologist","At risk","Due within 30 days","Due in 15 days","0","0","30","Excellent","0/0 activities evidence complete (Excellent)","0","0","2026-06-01","Sent","Active staff",""

"Requirement change watch"
"Status","Profession","Staff count","Cycle start","Cycle end","Reviewed","Published","Source","Source URL","Changelog entry","Summary"
"Reviewed, no recorded change","Nurse","1","2026-01-01","2026-12-31","2026-07-03","2026-07-03","Nursing and Midwifery Board CPD registration standard","https://www.nursingmidwiferyboard.gov.au/registration-standards/continuing-professional-development.aspx","2026-07-03-profession-expansion-source-review","1 staff member with Nurse requirements: Nurse requirements were reviewed 2026-07-03; CPDKeep has no recorded requirement change for the cycle 2026-01-01 to 2026-12-31. Check the linked source for current guidance."
"Reviewed, no recorded change","Physiotherapist","1","2026-01-01","2026-12-31","2026-06-29","2026-06-30","Physiotherapy Board CPD registration standard","https://www.physiotherapyboard.gov.au/Codes-Guidelines/CPD-guidelines.aspx","2026-06-29-core-profession-source-review","1 staff member with Physiotherapist requirements: Physiotherapist requirements were reviewed 2026-06-29; CPDKeep has no recorded requirement change for the cycle 2026-01-01 to 2026-12-31. Check the linked source for current guidance."
"Reviewed, no recorded change","Psychologist","1","2026-01-01","2026-12-31","2026-06-29","2026-06-30","Psychology Board CPD registration standard","https://www.psychologyboard.gov.au/documents/default.aspx?chksum=YgBfRLolyJvwRt0cAHZaFA%3D%3D&dbid=AP&record=WD15%2F18517","2026-06-29-core-profession-source-review","1 staff member with Psychologist requirements: Psychologist requirements were reviewed 2026-06-29; CPDKeep has no recorded requirement change for the cycle 2026-01-01 to 2026-12-31. Check the linked source for current guidance."

"Profession grouping"
"Profession","Staff count","Ready","Needs attention","At risk"
"Nurse","1","1","0","0"
"Physiotherapist","1","0","1","0"
"Psychologist","1","0","0","1"

"Readiness labels"
"Label","Staff count"
"Ready","1"
"Needs attention","1"
"At risk","1"

"Evidence completeness grades"
"Label","Staff count"
"Excellent","2"
"Good","0"
"Fair","1"
"Weak","0"

"Renewal window"
"Label","Staff count"
"Overdue","0"
"Due within 30 days","1"
"Due in 31-90 days","1"
"More than 90 days","1"
"Date missing","0"

"Exceptions"
"Staff display name","Profession","Readiness label","Renewal window","Progress summary","Evidence summary","Exception status"
"Demo Staff Blake","Physiotherapist","Needs attention","Due in 31-90 days","8/20 hours (40%)","1/1 activities evidence complete (Fair)","Follow up: readiness follow-up; evidence follow-up"
"Demo Staff Casey","Psychologist","At risk","Due within 30 days","0/30 hours (0%)","0/0 activities evidence complete (Excellent)","Follow up: at-risk readiness; renewal due soon"

"Reminder history"
"Staff display name","Profession","Reminder state","Reminder reason","Last sent at","Opened at","Resolved at"
"Demo Staff Avery","Nurse","Resolved","Readiness confirmation requested","2026-06-15T09:00:00.000Z","2026-06-15T10:00:00.000Z","2026-06-16T11:00:00.000Z"
"Demo Staff Blake","Physiotherapist","Opened","Complete reflection","2026-06-20T09:00:00.000Z","2026-06-20T13:00:00.000Z",""
"Demo Staff Casey","Psychologist","Sent","Update CPD progress","2026-06-25T09:00:00.000Z","",""
```

## Sample audit pack

Public sample page: /sample-audit-pack

Public sample download: /sample-audit-pack/download

Demo sample only: every practitioner name, cycle date, activity, provider, evidence reference, and report context in this sample is fake demonstration data. Evidence content, original filenames, upload paths, email content, and private user records are not included.

- Demo practitioner: Demo Practitioner Alex Example
- Demo profession: Pharmacist
- Demo generated date: 30 June 2026
- Demo activity rows: 4
- Demo missing-evidence warnings: 1