Records and access

Every file note carries a date, time and user stamp, whether a person wrote it or Workstride did. Notes cannot be edited or deleted in Workstride; corrections are saved as revisions beside the original (Part A 5.3.1), and the full history, what a note first said, who corrected it, when and why, stays on the record. A note can be marked confidential, tagged, and carry time spent or travel time, and attaches to fifteen kinds of record: participants and employers, claims, expenses, queries, complaints and exits among them.

At the moments that matter, Workstride writes its own stamped note: an attendance result, a support contact, a placement acceptance, a claim submission, a query answered, a complaint, an exit or an Ongoing Support Assessment, each carrying a named system actor in place of a person. A document only counts as evidence once it passes a malware scan, run by a scanner beside the application rather than an outside service; an infected file is quarantined and stays on the record with the attempt still visible. Workstride keeps a fingerprint of every file, a confidential document needs its own permission, and every download is logged. Ask a participant for a document through the portal and Workstride tracks the request until it arrives.

Staff sign in with the Microsoft 365 or Google Workspace account they already use, from an allow-listed directory, so your own multi-factor authentication and access policies apply. Nothing is granted by default, including a pre-grant set up by someone's work email before they arrive, and access reviews are recorded.

Your Security Contact decides who gets access and to which sites, from six standard roles or a role built from your own catalogue of plain-language permissions; a locked Security Contact permission cannot be removed, and a person only sees the actions they are allowed to take. No role activates until your Department privacy training is recorded for that person (Part A 6.13).

Suspending or removing someone's access takes effect on their next click, and removing access also deletes their API tokens. Nobody can change their own access, and the last Security Contact cannot be removed until another is nominated. Every access decision goes into a log that cannot be edited in Workstride; your Security Contact can filter it and export it to CSV for the annual self-audit. A training register lists courses by role, certificates and standings, with refresher reminders that escalate. Support access for our own staff needs your Security Contact's approval too: see Security.