Trainings

ISO 27001 and similar standards ask you to show that your people are trained and competent. In devguard, a training is material you already have: a video, a link to a course, or a PDF. You assign it to people or to roles, with a due date and an optional repeat schedule. devguard reminds each person, records each completion with its date, and shows you who is behind.

The tasks below follow the order of the work:

• Add a training
• Assign it
• Follow who has completed it
• Act on overdue people
• Check competence by role
• Record a completion from outside devguard
• Archive, restore or delete a training

Scripts and integrations: see API below.

Add a training

The owner of a training is a business role, not a person. So the training keeps an owner when staff change.

1. Open Trainings and choose Add training.
2. Enter a Title, such as "Clean desk and screen lock", and a short Description.
3. Choose the Training source: YouTube, Vimeo, Link or PDF.
4. For every source except PDF, paste the Source URL. A YouTube or Vimeo video plays inside devguard. A link opens in a new tab.
5. Choose the Owner role, such as Facilities Management. If you want, enter the Duration (minutes). The assigned person sees the duration before they start.
6. Choose Create.

For a PDF, the Edit training panel opens after you create the training. Drop the file on Training PDF, or click to choose it. Only PDF files are accepted, up to 50 MB.

Assign it

Each training has one assignment. You set it in the Assignment card, on the Detail tab or on the Assignment tab.

1. Open the training.
2. Under Roles, choose the roles whose members must complete it.
3. Under Members, add single people who are not in one of those roles.
4. Set the First due date.
5. Under Repeats on, choose a schedule, such as yearly. Leave it empty for a one-off training.
6. Choose Save assignment. The assignment starts at once, and each person in it gets a notice.

Watch out: if you later change First due date or Repeats on, the due dates move. People who had completed the old due date can show as Pending or Overdue again.

How assignments work

Who must complete it

The audience is every person you name, plus every person who is a member of a chosen role. When someone joins a role, the training is assigned to them. When they leave the role, it is not assigned to them anymore. So assign to roles where you can.

Due dates and cycles

A one-off training has one due date. A repeating training has a due date for each repeat of the schedule. Each due date is a cycle. A completion counts for the next due date after it, as the example shows.

For example, Clean desk and screen lock is due every year on 15 October, starting 15.10.2026.

• Jonas completed it on 20.10.2026. That counts for 15.10.2027, so he is done for the current cycle.
• Someone who completed it on 10.10.2026 met the due date of 15.10.2026. They now show as Pending, or Held in the matrix, until they complete it for 15.10.2027.
• A one-off training has only one due date, so any completion counts for it, even a late one.

Each person in the audience has one status:

What the assigned person does

People complete trainings in the employee portal, not in this section. There they open the material and tick I have completed this training, then choose Mark as completed. The checkbox unlocks only after they watch a video to the end, scroll to the end of a PDF, or open a link. This is self-attestation: the person confirms it themselves, and devguard records the date.

devguard reminds each person before the due date, and stops when they complete the cycle. The Reminders table says when.

Follow who has completed it

1. Open the training and choose the Assignment tab.
2. Read the counts above the Completion table: Completed, Pending and Overdue.
3. To see only the people who are behind, choose Status, then Overdue.
4. The Via column shows how each person is reached: Directly, or through a role.
5. To remove a person you named directly, open the row menu and choose Remove from assignment. A person reached through a role stays until they leave the role.

For all trainings at once, open Deadlines. Each open cycle is listed there with its due date and "x of y completed".

Act on overdue people

You cannot send a reminder again by hand. Choose what fits the person:

• If they did the training elsewhere, for example in a classroom, record the completion.
• If they still have to do it, open the training's Tasks tab, add a task, assign it to the person, and set a due date. People who use only the portal see the task there.
• If they work in the app, type @ and their name on the Comments tab. They get a notification.

devguard sends one reminder after each due date a person missed. See Reminders.

Check competence by role

The Competence matrix shows every business role with its members, and one column for each assigned training. Each cell shows Completed with the date, Held with the renewal date, Pending or Overdue. A dash means that the training is not assigned to that person.

1. Open Trainings → Competence matrix.
2. To see one role, choose it in the role list at the top.
3. Turn on Overdue only to keep only the people with at least one overdue training.
4. Click a cell to see the last completion: the date, the note, the evidence reference, and whether an admin recorded it or the person confirmed it in the portal.
5. Choose Export CSV for the auditor. The file has one row for each role, member and training, with the columns Role, Required competence, Member, Training, Status, Completed on, Note, Evidence reference, Source and Recorded on. A person in two roles appears twice, and a training that is not assigned to them reads Not assigned. The file uses the filters you set.

Under each role name, the matrix shows the role's Required competence. You write it on the role in People → Roles. Clause 7.2 of ISO 27001 and ISO 9001 asks for this record: what each role needs, and what each person has.

Record a completion from outside devguard

An owner or admin can record a training that a person completed elsewhere, such as a classroom session or a first-aid course.

1. In the competence matrix, click the person's cell and choose Record completion. On the training's Assignment tab, the row menu has the same action.
2. Set Completed on. The date cannot be in the future.
3. In Note, write how competence was confirmed, such as "Attended the on-site session".
4. If you want, enter an Evidence reference, such as "Training log". It says where the proof is kept.
5. Choose Record completion. The cell changes to Completed with the date.

Watch out: you cannot change or delete a recorded completion. Check the date and the note before you save. The other rules are in Recorded completions.

Archive, restore or delete a training

Archive a training that is no longer used but that an auditor may still ask about. Delete only a training that was created by mistake.

Archive

1. In the Trainings list, open the training's row menu and choose Archive.
2. Choose Archive again to confirm. The assignment ends and the reminders stop. The training and its completions stay.

To see archived trainings, turn on Archived above the list. To end only the assignment and keep the training active, choose Archive assignment at the bottom of the Assignment card.

Restore

1. Turn on Archived above the list.
2. Open the training's row menu and choose Restore.
3. Open the training. In the Assignment card, choose Save assignment to start the assignment again.

Delete

1. Open the training's row menu and choose Delete.
2. Choose Delete again to confirm. This also deletes the assignment, the completions and the PDF. You cannot undo it.

To delete several trainings, select their rows, choose Delete, then Delete selection.

Reference

Training fields

Assignment and completion fields

Recorded completions

• devguard saves who recorded the completion and when. In the portal, the person sees that their administrator recorded it, with the note.
• A person can have one completion per cycle. devguard refuses a second one.
• You cannot record a completion for yourself. Complete your own trainings in the portal.
• A date in an earlier cycle counts for that cycle. For Clean desk and screen lock, a date of 10.10.2026 counts for 15.10.2026, and the person must still complete it for 15.10.2027.
• Certificates are personal data, so they are not uploaded here. The evidence reference says where they are kept.

Reminders

Each person gets a notice when they join the audience, once per training. After that, devguard reminds them:

• a number of days before the due date, which depends on the length of one cycle (table below);
• one day before the due date;
• for a one-off training, once after the due date has passed without a completion. This reminder is sent only within 30 days of the due date.
• for a repeating training, once after each due date a person missed, unless they have already completed the next cycle. This reminder is also sent only within 30 days of the due date.

A person who has completed the current cycle gets no more reminders for it. No reminder is sent twice for the same cycle. Reminders that are due together arrive in one email. Training reminders do not depend on marketing email settings.

People who work in the app see reminders in their notification inbox. They get emails once they turn email on under Account → Notifications. People who use only the portal turn on Email notifications on their portal profile.

Who is in the audience

A person whose membership is deactivated leaves every audience. A person reached only through an archived role leaves it too. When you archive a role in People → Roles, the confirmation shows how many people and assignments it affects.

Permissions

Owners, admins and members can comment on a training. Auditors can read comments but not write them.

Limits

The Free plan allows 2 trainings. Archived trainings do not count. Restoring a training checks the limit again. The Business plan has no limit.

Where trainings appear

• Dashboard: the Policies card shows Trainings overdue, the number of trainings with at least one overdue person. It links to People, filtered to those people.
• Deadlines: each open cycle, tagged TRAINING, with "x of y completed".
• People: the Policies & Trainings tab of each person lists what is assigned to them and the status.
• Search: find trainings by title in the command palette.
• Portal: each assigned person sees their trainings and due dates.
• Tabs on the training: Evidence links evidence records, such as an attendance list, or creates one from a dropped file. Tasks holds follow-up work. Comments holds the discussion. History shows who changed what and when.

API

• Base URL: https://app.devguard.ch/api.
• Authentication: an API token, which acts with your own role, or an organization token. Send it as Authorization: Bearer <token>, and send JSON with Content-Type: application/json.
• Scope: the API covers trainings. Assignments, completions, the competence matrix and PDF upload are in the app only.

Calls with {id} need no organizationId. The list returns { "items": [...], "total": 4, "page": 1, "limit": 100 }. It returns active trainings unless you send filterByArchived=archived. limit is 5 to 100. PATCH needs title and source on every call, even if they do not change.

Create a link training:

curl -X POST https://app.devguard.ch/api/trainings/ \
  -H "Authorization: Bearer $DG_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "organizationId": "<org id>",
    "title": "Clean desk and screen lock",
    "source": "LINK",
    "sourceUrl": "https://learn.example.com/clean-desk",
    "durationMinutes": 15
  }'

The answer is the new training:

{
  "id": "36e219e5-0fa3-47fd-9fda-92aa3e01320b",
  "title": "Clean desk and screen lock",
  "slug": "clean-desk-and-screen-lock",
  "description": null,
  "source": "LINK",
  "sourceUrl": "https://learn.example.com/clean-desk",
  "durationMinutes": 15,
  "ownerId": null,
  "organizationId": "<org id>",
  "createdAt": "2026-10-30T09:12:44.120Z",
  "updatedAt": "2026-10-30T09:12:44.120Z",
  "archivedAt": null
}

The slug is made from the title. If another training, archived or not, already has that slug, devguard adds -2, -3 and so on.

Errors return { "message": ..., "code": ..., "status": ... }. A 400 for an invalid field also has issues, which lists the fields.