FAQ26 questions
Security, compliance and procurement
Security evidence
Where is MuchSkills data hosted?
MuchSkills stores customer data at rest in the EU, in Stockholm, Sweden, with Amazon Web Services (eu-north-1) for hosting and MongoDB for the database, which takes the data-transfer question out of most European security reviews before it starts. The sub-processor list in the MuchSkills Trust Center is the authoritative record of where data is held, and you get 30 days' notice before any change. If you have a specific hosting requirement, for example in the US or UK, raise it during evaluation rather than at contract stage.
How long does a MuchSkills security review take?
When you send MuchSkills a security questionnaire, we aim to return it within one week; after that, the timing depends on your own security team. Most of what reviewers ask for is already in the MuchSkills Trust Center: the security overview, policies, penetration test attestation, sub-processors and live control status, with a few documents behind a quick access request. Two things speed it up on your side: decide early who is the data controller for skills data, and send the questionnaire during evaluation rather than after the commercial agreement.
Does MuchSkills help with ISO 9001 competence requirements?
Yes. MuchSkills is built for ISO 9001 Clause 7.2, the competence clause. The clause asks you to determine the competence each role needs, make sure people have it, act where they do not and check that the action worked, and keep documented evidence. MuchSkills holds the requirement per role, each person's current level and certificates, the gap, the action taken such as a development goal or training, and a full change log of every certificate change, recording who changed what and when, with the complete history kept and nothing overwritten. That history is what auditors ask to see. More on MuchSkills for compliance.
Can MuchSkills produce evidence for an external audit?
Yes. MuchSkills Compliance Intelligence lets you select the people in scope, including former employees, and download every certificate and proof file for them, correctly named and ready for the auditor. Certificate status, expiry dates and the change log come with it: who added each certificate, when, who validated it, and every later change, with the full history kept. Reports by role, team or site show who meets each requirement, who is about to lapse and who has lapsed.
Does MuchSkills cover CSRD and workforce reporting?
Partly. MuchSkills holds training, competence and certification data in an exportable form that feeds ESRS S1 workforce disclosures, such as training and skills development metrics, where CSRD applies to you. It is not a sustainability reporting suite and does not produce your report. Treat it as one source your reporting team draws on, alongside payroll, health and safety and diversity systems.
What availability and backup commitments does MuchSkills make?
MuchSkills runs to a 99.5% monthly availability target, set out in the Service Description and Service Levels in the MuchSkills Trust Center. Backups run at least every six hours and are kept for up to 90 days, with a recovery point objective of 24 hours and a recovery time objective of 72 hours. Contractual service levels can be agreed on the Enterprise plan.
Is MuchSkills data encrypted?
Yes. MuchSkills encrypts customer data at rest with AES-256 at the database and storage layer, and in transit with TLS 1.2 or above, including between its own services. Access to keys is restricted to named administrators and logged, and multi-factor authentication is required on every MuchSkills administrative account. The details in force are kept current in the MuchSkills Trust Center FAQ.
Does MuchSkills support single sign-on and SCIM provisioning?
Yes. MuchSkills supports single sign-on through your own identity provider, including Okta, Google Workspace and Microsoft Entra ID (Azure Active Directory), on every plan, so a leaver you remove from your directory loses access through your own process. Automated provisioning and de-provisioning through SCIM is included on every plan too. Setup guides for each identity provider are on the MuchSkills integrations page.
What happens if MuchSkills has a personal data breach?
If MuchSkills becomes aware of a breach affecting your personal data, it notifies you without undue delay and in any event within 48 hours, describing what happened, the categories and approximate number of people and records affected, the likely consequences and the measures taken or proposed. MuchSkills then helps you meet your own obligations as controller; notifying the supervisory authority and affected individuals stays your decision. Security issues can be reported to security@muchskills.com.
Can we audit or test MuchSkills' security ourselves?
Yes. Security testing against your own MuchSkills account and data, in good faith and in line with the Vulnerability Disclosure Policy, is authorised; load or denial-of-service testing, or anything that touches another customer, needs written consent first. The independent penetration test report and letter of attestation are available in the MuchSkills Trust Center, and audit rights, including an on-site inspection once a year at your cost, are set out in the Data Processing Agreement.
Who are MuchSkills' sub-processors, and will we hear about changes?
MuchSkills publishes its sub-processors, with the purpose, location and transfer safeguard for each, in the MuchSkills Trust Center and the Data Processing Agreement. Customer data is stored at rest in the EU. Some processing reaches outside the EEA, such as the AI features, in-product support chat and part of billing, always under the Standard Contractual Clauses. You get at least 30 days' notice before a sub-processor is added or replaced, with the right to object, and you can subscribe to updates.
Does MuchSkills work for AS9100, IATF 16949 and other ISO 9001-based standards?
Yes. Quality standards built on ISO 9001, such as AS9100 in aerospace and IATF 16949 in automotive, keep ISO 9001's Clause 7.2 competence requirement and add sector rules on top, so the same MuchSkills evidence applies: the competence each role needs, each person's current level and certificates, the gaps, the actions taken and a full change history. The same holds for other ISO management system standards with a competence clause, such as ISO 14001, ISO 45001 and ISO 22000. Compliance Intelligence downloads every certificate and proof file for the people in scope, and on the Compliance plan auditors can have their own access at no extra cost.
Can we give external auditors access to MuchSkills?
Yes. The MuchSkills Compliance plan is an organisation licence that includes unlimited admins, viewers and auditors at no extra cost, so an external auditor can be given their own access to the evidence they need. Compliance Intelligence also lets you select the people in scope, including former employees, and download every certificate and proof file for them, correctly named and ready to hand over.
Does MuchSkills support DORA for banks and financial institutions?
Yes. For banks, insurers, payment firms and other financial entities covered by the EU Digital Operational Resilience Act, MuchSkills provides a DORA Addendum that sits alongside the Enterprise Terms and the Data Processing Agreement. Ask us for it during evaluation, since it is not on the public legal page. The MuchSkills Trust Center holds the security documentation your ICT third-party risk review will need.
Is MuchSkills validated for GxP or 21 CFR Part 11?
No. MuchSkills is not delivered as a validated GxP system, and it does not provide 21 CFR Part 11 electronic signatures or an IQ, OQ and PQ package. It can track training and certification status with a full change history for pharmaceutical, biotech and medtech teams, and where your quality system requires validation for a defined intended use, that validation is yours to perform. Tell us early what documentation you need.
Does MuchSkills check that a certificate is genuine?
MuchSkills records what was uploaded, by whom and when, and does not itself certify that a certificate is authentic. A manager or HR can validate each certificate against its proof file, licence number or credential link, which marks it as validated instead of claimed, and certificates synced from Credly arrive as the issuer's own digital badges. Every later change is logged with who made it and when.
Can MuchSkills evidence staff competence for our ISO 27001 or SOC 2 audit?
Yes. ISO 27001 asks you to determine and evidence the competence of people whose work affects information security, along with their awareness and training, and SOC 2 looks for a commitment to attract, develop and retain competent people. MuchSkills holds the security certifications, training badges and skills each role needs, alerts people before certificates expire, and keeps a full change history to show the auditor. This is separate from MuchSkills' own certification status, covered in our ISO 27001 answer.
Can we set required certifications for each role in MuchSkills?
Yes. You add the certificates each role requires to its role profile, alongside the skills and levels, and MuchSkills shows a live view of who meets the requirement, who does not and who is about to fall out of it as certificates near expiry. Employees see a missing or expired required certificate in red in their own gap view, and HR can give a certificate goal to everyone in a role at once.
Can MuchSkills track the certifications behind our Microsoft or AWS partner status?
Yes. Today, certification reports by vendor show who holds each AWS, Microsoft or other vendor certificate and when it expires, with alerts before it lapses. MuchSkills is also releasing partner level monitoring, which checks continuously whether you still hold enough certified people for each partner level as people join, leave and certificates expire, and warns you when you fall short.
Can MuchSkills track licences and internal authorisations, not only vendor certificates?
Yes. Besides the 9,700+ certifications in its database, MuchSkills lets your organisation add its own certificates, licences, memberships and internal authorisations, such as a forklift licence, a site access card or a sign-off to work on a specific system, each with an expiry date, proof file and the same alerts and change history.
Do we need to sign a separate DPA with MuchSkills?
No. The MuchSkills Data Processing Agreement is compliant with GDPR Article 28 and is incorporated into the agreement, so it takes effect without a separate signature. Procurement teams that need a signed copy can ask for one. It is not negotiated line by line; if you have a specific requirement, raise it with your order and it is handled there.
Does MuchSkills help with the EU Pay Transparency Directive?
Partly. The EU Pay Transparency Directive (2023/970) names skills among the criteria for comparing work of equal value, alongside effort, responsibility and working conditions. MuchSkills documents the skills criterion: which skills and levels each role requires and the evidence for each person. It is not a pay or job evaluation tool, so pay analysis and reporting stay in your HR and reward systems.
Can MuchSkills be used for ITAR or CMMC work?
MuchSkills hosts customer data only in the EU, so it is not suitable for ITAR-controlled technical data or for Controlled Unclassified Information. US defence and government contractors can use it to track their people's skills and certificates, including the security certifications their contracts require, for work that does not involve controlled data.