Governance Centre — Dragonfly CPD

Six concise documents

Start with the question your review needs to answer.

These summaries are intentionally readable. Contractual schedules, organisation-specific responses and supporting evidence remain available through the procurement route.

Security overview

Protecting access and learning records.

A public summary of current controls—not a map of sensitive internal configuration.

Current controls

Encrypted HTTPS connections across the website and portal.
Supabase authentication for named user accounts.
Role-based access for learners, seniors, managers and administrators.
Organisation checks on manager-level server actions.
Server-side protection for privileged administration, registration and content-import routes.
Cloudflare environment secrets for sensitive service credentials.
Signed GoCardless webhook verification before paid licences are applied.

Operating responsibilities

Customers control who receives staff registration codes.
Users must keep credentials private and use their own named account.
Managers should remove access when staff leave or no longer require the service.
Suspected incidents should be reported promptly to Dragonfly.
Security controls are reviewed as the service and threat environment evolve.

Responsible disclosure: report a suspected vulnerability privately to [email protected]. Do not include service-user information or credentials.

Subprocessor register

Providers used to deliver Dragonfly.

This register covers the principal live service providers visible in the current platform architecture.

Provider	Purpose	Typical information	Safeguard / role
Supabase	Authentication, database and learning records	Account, organisation, assignment, progress and certificate data	Cloud service provider operating under contractual data terms
Cloudflare	Website hosting, server functions, delivery and security	Technical requests, IP/security logs and data processed by server functions	Hosting and network provider operating under contractual data terms
GoCardless	Secure payment and payment confirmation	Buyer and transaction information required to process an order	Independent payment provider; Dragonfly does not store bank credentials
Formspree	Public contact-form delivery	Information voluntarily entered into the contact form	Form-delivery provider; users are told not to submit sensitive service-user data

Change control: this register is reviewed when a material provider changes. Organisation-specific contractual information is available through procurement.

Accessibility roadmap

Accessible by design, improved through evidence.

Our direction of travel, expressed honestly rather than as unsupported certification.

Current

Established foundations

Responsive layouts, keyboard focus visibility, semantic headings, labelled controls, language metadata, readable contrast and English/Welsh routes.

In progress

Portal refinement

Continuing review of complex dashboard controls, status communication, generated evidence, focus behaviour and screen-reader clarity.

Planned

Stronger assurance

Structured assistive-technology testing, caption and transcript review, accessible document checks and documented remediation cycles.

Adjustments: contact us if you need content or evidence in an alternative format. Known limitations and the feedback route are maintained in the accessibility statement.

Implementation guide

From purchase to an organised rollout.

A manager-led route that minimises spreadsheet administration.

Confirm scope
Agree learner numbers, manager ownership, teams, audiences and priority pathways.
Set up the organisation
Allocate licences and confirm the manager account and organisation structure.
Create controlled routes
Generate separate registration codes for each role, team and learning pathway.
Brief staff
Explain how to register, what is mandatory, what is developmental and where support is available.
Monitor activation
Check licence use, team placement and whether new starters can access their assigned learning.
Use insight well
Treat statutory gaps as compliance priorities and developmental gaps as prompts for supportive supervision.
Evidence and renew
Download branded records and monitor annual renewal from successful completion.

Service description

What Dragonfly provides.

A clear service boundary for individuals and organisations.

Included

Named learner accounts and annual platform access.
Foundation, Applied Practice and Toolbox learning where available.
English and Welsh portal use against one learning record.
CPD tracking, assessment results and certificates.
Organisation manager dashboard, assignment and registration tools.
Compliance, renewal, supervision and branded evidence views.
Platform support through the help centre and contact route.

Important boundaries

CPD supports but does not replace organisational policy, supervision or statutory guidance.
Named annual licences cannot be shared between users.
Customers remain responsible for lawful staff enrolment and internal action.
Service availability can depend on third-party cloud providers and planned maintenance.
Content and features may improve during the licence period without reducing the core purchased service.

Data-processing summary

What information is used, and why.

A concise complement to the privacy notice and contractual data terms.

Information	Purpose	Typical access
Identity and contact	Create, authenticate and support named accounts	The user; authorised organisation roles; Dragonfly administrators where required
Organisation, team and role	Place learners in the correct management and access scope	Authorised managers and administrators
Assignments, progress and scores	Deliver learning, calculate completion and provide feedback	The learner and authorised organisation roles
CPD, certificates and renewal dates	Create professional records and compliance evidence	The learner and authorised organisation roles
Technical and security information	Operate, protect and troubleshoot the service	Relevant service providers and authorised technical administrators
Payment and order information	Process purchases and allocate confirmed licences	Payment provider and authorised commercial administrators

Roles

Dragonfly is normally controller for website enquiries and individual accounts. For organisation-managed staff learning records, the organisation is normally controller and Dragonfly acts as processor under its instructions.

Retention and rights

Records are retained to operate accounts, provide certificates and support reasonable audit evidence. Access, correction, deletion and restriction requests are handled in line with applicable UK data-protection duties and contractual responsibilities.

For fuller information, read the privacy notice and data-protection summary.