Nobody gets missed.
Everything is provable.
Moodle delivers the courses. OrbixShield decides who must take them, enrols them, chases the gaps, and hands you a named record with a verification code when an auditor asks you to prove it.
30 minutes, screen-shared, on the live system. No slide deck.
last 8 weeks · example 1 gap flagged
Two failures, and neither of them feels like a failure
Nothing crashes. No one refuses to do the training. The compliance officer only finds out during the audit — which is the one moment it cannot be fixed.
| Employee | Joined | Enrolment |
|---|---|---|
| Aisyah R. | 02 Jun | Enrolled |
| Daniel T. | 14 Jul | Enrolled |
| Wei Lun C. | 01 Aug | None |
| B — Name | C — PDPA done? | D — Evidence | |
|---|---|---|---|
| 12 | Aisyah R. | Yes | — |
| 13 | Daniel T. | Yes | — |
| 14 | Siti A. | Yes | — |
What you are actually buying is evidence: that a named employee completed a legally-required course, on a date, with a score, under a number you can quote.
Standing rules assign training. Not people.
You write the obligation once, as a rule about a department. Everyone in that department is enrolled — including the people who have not been hired yet. This is the mechanism the rest of the product is built on.
- When
- employee.department = "Finance"
- Then
- enrol in PDPA Awareness Training
- Cadence
- Annually, from the date of last completion
- Applies to
- Everyone in Finance today and every future hire into Finance
- Owner
- Compliance — notified on every enrolment the rule creates
| Employee | Department | Portal says | Training system says | Verdict | |
|---|---|---|---|---|---|
| Siti Aminah binti Hassan | Finance | Complete | Complete · 12 Mar 2026 | Matched | |
| Daniel Tan Wei Sheng | Finance | In progress | In progress · 60% | Matched | |
| Nurul Izzati binti Kamal | Sales & Distribution | Complete | No enrolment found | Unprovable |
The artefact at the end is a record, not a claim
When a learner passes, OrbixShield writes a certificate record: who, which course, when, what score, under a certificate number and a verification code that can be checked against the issuing record.
CERT-D1F6AE730A73
9958884C6547428DB9CC6C34488787CD
What this replaces
A signed attendance sheet proves someone was in a room. A spreadsheet cell proves someone had a keyboard. A certificate record with a number ties a named person to a named course, a date, and a score that a system produced rather than a colleague typed.
What you can hand over
Six published courses, each tied to an obligation
Written against Malaysian law — the Personal Data Protection Act 2010 as amended in 2024, and the Anti-Money Laundering Act 2001. Not European material with a mapping table bolted on the front.
| Course | Domain | The obligation it addresses |
|---|---|---|
| PDPA Awareness Training | Data protection | Staff handling of personal data under the PDPA 2010 (as amended 2024) — collection, disclosure, retention and security practice for everyone who touches customer or employee data. |
| Data Protection Officer (DPO) Foundations | Data protection | The data protection officer function introduced by the 2024 amendments — what the role is accountable for, and what it has to be able to show. |
| AML/CFT Staff Awareness Training | Financial crime | Staff awareness and internal reporting duties under the AMLA 2001 for reporting institutions and their service providers. |
| Phishing & Social Engineering Awareness Training | Security awareness | Recognising and reporting targeted attacks. Pairs with the phishing simulation so the training answers a real result rather than a hypothetical. |
| Phishing Awareness Fundamentals | Security | A short baseline for new hires and non-desk staff who need the essentials quickly, before the longer module. |
| Cyber Security Awareness Training — E-Learning Edition | Compliance | General information-security awareness of the kind requested in client and vendor due-diligence questionnaires. |
Bahasa Melayu, all the way down
Most vendors translate the interface and leave the assessment in English — so the staff who most need the training are graded in their second language. Below is the same question, both ways. Note that the answer choices are translated too, not only the stem.
Under the PDPA, personal data may be disclosed to a third party without the consent of the data subject when —
- Athe third party is another company in the same group
- Bthe disclosure is required or authorised by law, or by an order of a court
- Cthe data subject is no longer employed by the organisation
- Dthe request for the data is made in writing
Di bawah PDPA, data peribadi boleh didedahkan kepada pihak ketiga tanpa kebenaran subjek data apabila —
- Apihak ketiga itu ialah syarikat lain dalam kumpulan yang sama
- Bpendedahan itu dikehendaki atau dibenarkan oleh undang-undang, atau oleh perintah mahkamah
- Csubjek data itu tidak lagi bekerja dengan organisasi tersebut
- Dpermintaan untuk data itu dibuat secara bertulis
Course documents, quiz questions and every answer choice are translated. A learner can take the entire course in Bahasa Melayu and the certificate record is identical.
What works today, and what does not
You are going to find this out anyway, in week two, at the worst possible time. It is cheaper for both of us if you find it out now.
A university evaluator told us no vendor had ever volunteered a weakness before being asked. That reaction is the reason this section exists — and the reason it stays, even when the list gets shorter.
Book a walkthrough
Thirty minutes on the live system. Bring the course you are legally required to run and the department that keeps slipping, and we will build the standing rule for it while you watch.
What happens next
Already a learner?
If your employer has already enrolled you, sign in to the learner portal to continue your course. This page is for the person who has to prove the training happened.