AVG / GDPR
Art. 5, 25, 30, 32, 33, 35. Retention: 3 years. DPO contact surfaced on every learner's My Data page.
Compliance
The regulators show up. Hall is ready.
Built-in support for the frameworks employers face every day, across EU, UK, US, and the most common national regulators. Hall is the system of record for your compliance, not a spreadsheet you export at audit time.
Frameworks pre-configured
Every article carries its catalog reference, retention period, and mapping to the underlying regulation. You pick a framework; Hall creates the requirements.
NIS2 / Cyberbeveiligingswet
Art. 20, 21(2)(a-j). Management-body training + cybersecurity hygiene tracking. Retention: 3 years.
ISO/IEC 27001:2022
Annex A controls mapped. A.6.3 training, A.6.8 incident reporting, A.8.2/15/16 access + logging. Retention: 3 years.
HACCP / ISO 22000
Principles 1, 2, 5, 7. Critical Control Points, corrective actions, record-keeping. Retention: 5 years by default, matches EU 852/2004, US FDA, and most national food-safety regulators.
DORA (finance)
Art. 13, 17. ICT risk training, incident management. Retention: 7 years, aligns with MiFID.
Arbowet (NL)
Art. 3, 8. Workplace safety instruction, RI&E. Retention: 5 years. BHV + VCA pre-configured out of the box.
EAA 2025 (accessibility)
Annex I. WCAG 2.1 AA coverage for public-facing surfaces. Hall's own UI conforms, we live the spec.
Evidence
What auditors ask for, and where it lives
Hall's 'proof vault' is the single source of truth. Eight evidence types, every one hash-stamped, every action recorded with an actor + timestamp.
Policy acknowledgments
Every signed policy stored with the learner's name + timestamp + SHA-256 of the signature. Non-repudiable; survives a version bump of the underlying policy.
Attestation campaigns
Time-boxed sweeps where a specific audience signs a specific document. Full audit of who, what, when, and how.
External certificates
Fire warden, VCA, safety passport, upload the PDF, Hall stores it with validity dates + SHA-256. Renewal reminders fire automatically.
Waivers + decisions
Every manager-filed waiver with reason + category. Every admin decision with notes. Expiry dates trigger re-review. Rejected waivers preserve learner's obligation.
Hash-chained audit log + xAPI stream
Every compliance event, waiver decisions, campaign starts, evidence uploads, settings changes, on an append-only chain. Any tampering breaks a downstream hash. Parallel xAPI statement stream makes the same record queryable in any compliant LRS.
Versioned policy library
Policy v3 retires when v4 ships. Acknowledgments against v3 stay valid for their holders; new hires sign v4. Full history preserved.
The weekly rhythm
Digest email to every admin, every Monday
Your organisation admin doesn't need to remember to open the dashboard. The weekly digest summarises: overall completion rate, what changed this week, pending waivers, mandatory overdue, and evidence expiring in the next 60 days. Takes 30 seconds to read. Deep-links into the right page for each action.
Due diligence
The non-negotiables
EU data residency
Frankfurt, not the UK. Not the US. Supabase EU region, Vercel EU, Hetzner Cloud, end-to-end EU. Schrems-II-compliant by architecture, not policy.
PII never hits AI
When Hall calls Claude for gap analysis or course generation, the payload is always anonymised. Role hashes, aggregated scores, never names or emails. Documented + audited.
Data Processing Agreement
Every tenant signs a DPA before first login. Template + negotiation process transparent. Amendments tracked.
Works Council templates
Orgs with 50+ employees in NL must notify their Ondernemingsraad (Art. 27 Wet op de Ondernemingsraden). Hall provides the template letter and tracks acknowledgment.
Ready to get audit-ready?
Our compliance team will walk you through your current framework coverage and gap map, free, no commitment.
Request a demo