Security training your auditor actually accepts.
Launch a SOC 2, ISO 27001, GDPR or HIPAA awareness program in minutes. No seats for the people you're training. Every completion becomes tamper-evident evidence that exports straight into Vanta.
Auditors ask for this by name
Every framework you're chasing already requires training.
Security awareness training
Required for every SOC 2 report — evidenced per person, refreshed annually.
ISMS awareness
Documented awareness training for everyone under your ISMS — with records to prove it.
Staff data-protection training
Staff handling personal data must be trained, and your DPO must monitor it.
Workforce security awareness
A security awareness and training program for your entire workforce. Not optional.
How it works
Live in three steps.
Pick a deck
SOC 2, ISO 27001, GDPR or HIPAA. Fill in {{ company_name }}, your DPO and your policy links.
Invite everyone
Paste a roster. Staff and contractors get a magic link or Google sign-in — no accounts, no seats, your branding.
Export the evidence
The completion register fills in as people finish. Download the CSV, bulk-upload it to Vanta, done.
Inside the participant portal
No accounts. No shortcuts. Everything on the record.
Participants open a magic link on a portal branded as your company, in any of five languages — no account, no password. What they do there depends on the program you assigned.
Read the policy, then prove you understood it.
Slides and video that only count once watched, a quiz with a pass mark, and an attestation signed by name — then the certificate.
How a course runs
Every assigned course on one branded page, progress visible at a glance.
Slides and video that only count once the watch threshold is met.
A pass mark stands between the lesson and the certificate — answers on the record.
A named certificate, stamped with the exact deck version they completed.
Change the setting, then prove you changed it.
Instructions rewritten for macOS, Windows or Linux, a screenshot as the evidence, and a dated confirmation naming the machine. Your team accepts each one or sends it back for a fresh capture.
How a checklist runs
Every checkpoint on one page, with the steps rewritten for the operating system they picked.
A screenshot, the date it was taken and the machine it came from — attached before the checkpoint counts.
Everything an awareness program needs. Nothing it doesn't.
Framework decks built in
SOC 2, ISO 27001, GDPR and HIPAA, written and ready to assign.
Portal in five languages
Participants get the portal, emails and sign-off flow in English, German, French, Spanish or Polish.
No seats for participants
Magic link or Google sign-in on a portal branded as your company. Contractors included.
Provably watched video
Video slides gate on watch percentage. Skipping to the end doesn't count.
Attestation before completion
Nobody completes without signing first, and the record keeps that order.
Annual recertification
When a completion turns a year old, Kit re-enrolls and re-invites automatically, with a grace period.
PDF certificates
Per person, branded, stamped with the exact deck version they took.
Compliance command center
One dashboard of who's due, overdue and done — worst first.
Audit evidence, not just a course
The exact register Vanta expects, column for column.
Kit keeps a completion register with the seven columns Vanta's bulk upload expects — Employee Name, Employee ID, Department, Role, Training Module(s), Completion Date, Status — and exports it verbatim as CSV or a branded PDF. Every row is a frozen snapshot: the attestation was signed before the completion, the deck version was stamped at that moment, and rows can never be edited or deleted. When an auditor asks you to prove someone did GDPR training in March, you hand over the row, the signed attestation and the deck version they took.
- The seven Vanta columns, verbatim
- Append-only completion records
- Deck version stamped on every row
Every look, logged
Evidence that expires on schedule. A trail that doesn't.
Staff review each screenshot of an encrypted disk or patched laptop on one screen — approve, reject with a note, done. Every look is on the record: open a file or download a bundle and Kit logs who and when, in a trail that can't be edited or deleted. The files themselves purge automatically after a retention window you set per program — 395 days by default, one audit cycle with margin — so you hold personal evidence exactly as long as policy says, and not a day longer.
Claude · ChatGPT · Gemini
Tell an agent to build the program.
11 training tools over MCP
Connect Claude, ChatGPT or Gemini. The agent can create a program, seed a deck, write the quiz, invite a roster and pull completion status.
What you can ask
Included with Kit. No per-learner fees.
Awareness vendors bill per seat, per year. Training is part of Kit — unlimited staff and contractors, because the decks, the portal and the evidence pipeline are already built.
Evidence-grade, like the rest of Kit.
Completion records are append-only, participant details are encrypted at rest, and everything runs on EU-hosted infrastructure.
Read our trust pageBefore you invite the team.
We already run training in our HR tool. Why move it?
Because the output here is evidence, not a checkbox. Kit's register matches Vanta's bulk-upload columns exactly, and behind every completion is an append-only record with a signed attestation.
Do contractors need accounts?
No. Participants aren't users and don't take a seat. They get a magic link or sign in with Google, on a portal branded as your company.
Which frameworks are covered?
SOC 2, ISO 27001, GDPR and HIPAA decks are built in. Each uses variables — company name, DPO contact, policy links — so one template becomes your program.
How does the Vanta export work?
The register uses the seven column headers Vanta's bulk upload expects, in the same order and wording. Export the CSV, upload it, done. There's a branded PDF for auditors who want paper.
What about annual re-training?
Mark a program annual and Kit re-enrolls each person when their completion turns a year old, with a grace period before anyone lapses.
Can I prove someone actually watched the training?
Yes. Video slides only count once the watch threshold is met — skipping ahead doesn't. Completion also requires a passed knowledge check and a signed attestation, in that order, all on the record.
Where is the data hosted?
On EU infrastructure. Participant details in the evidence trail are encrypted at rest.
Can an AI assistant set this up for me?
Yes. Kit exposes 11 training tools over MCP. From Claude, ChatGPT or Gemini you can create programs, seed decks, write quizzes, invite people and check who's finished.
Turn training into evidence.
Pick a deck, invite the team, export the register. Free for 30 days, cancel anytime.
Free for 30 days · cancel anytime
Start free