We built an LMS to fix training. Then our own audit taught us where we failed.

Before any customer taught us this lesson, our own auditor did. HabileLabs has built cloud, data and AI platforms for banks, NBFCs, manufacturers and energy companies since 2016. The week we went through our own compliance audit, we discovered that the weakest thing in our own company was the one we had never thought about: compliance training audit evidence.

It started with our own compliance audit

A compliance audit does not only ask whether you have policies. Whether the framework is ISO 27001, POSH or a data-protection law, the auditor asks whether every employee has been trained on those policies, on a set frequency, and whether you can show it: ISO 27001 training evidence, POSH training records, security-awareness completions with dates. For us that meant a handful of mandatory courses every person had to complete: Prevention of Sexual Harassment, information security awareness, acceptable use, workplace safety, data handling. Some on joining, all of them refreshed every year.

We had done the training. Everyone remembered doing it. What we could not do was prove it. The evidence lived in a shared inbox, a spreadsheet with one tab per course, a folder of screenshots and a few WhatsApp reminders. Assembling it took two people the better part of a week, and even then the honest answer to “who is due for their annual refresher?” was a shrug. Completion we had. Validity, whether each person’s training was still within its cycle today, nobody was tracking.

The same compliance training audit gap, everywhere

Once you have felt that scramble you recognise it in every client. Safety procedures learned from a PDF on a shared phone on the shop floor. A compliance LMS at an NBFC that employees had stopped opening. A pharma plant where GMP refreshers were tracked on a whiteboard. And every audit, the same week-long assembly of attendance emails, scanned sign-in sheets and a spreadsheet someone updated by hand, to answer one question: are our people trained, and is that still true?

So we built Learnify. We built it as an LMS, because that is what the category is called, and for a while we competed the way the category competes: a better course builder, a nicer learner app, more features.

The week before the audit

What changed our mind was watching how customers actually used it.

Nobody called us the week a course launched. They called the week before an audit. And what they asked for was never an engagement feature. It was: who has expired? Who has not attested? Can I lock access when a certification lapses? Can I export exactly this for the auditor, today?

What we built instead: recertification, attestation and audit evidence

Compliance training recertification cycles anchored to each person’s own completion date, not a company-wide reset. A read-and-understood attestation for the policies where the law expects a signature, not a score. Access that re-locks when a certification lapses, and renewals that queue for approval. An audit log of every action. And an evidence pack (completions, scores, attestations, certificates, all timestamped) that exports in one click. The folder of screenshots became a button.

Then India’s Digital Personal Data Protection Act arrived, and our customers asked a new version of the same question: can you prove consent? Can you track a rights request? Can you show we trained everyone on this? We built that too, as regulatory profiles for DPDP and GDPR, so the same machinery serves GDPR for our European customers, and whatever comes next is a new profile rather than a new platform.

When we added AI, the first rule we wrote was about what it must never do. Our three agents, the L&D Copilot, the Compliance Watchdog and the Learner Tutor, draft courses, watch validity and answer learners’ questions. None of them approves a course, grants access or certifies a person. On a platform whose job is proof, an agent that decides would be an audit finding, not a feature.

Not a learning system. A proof system.

Somewhere in that work we understood what we had actually built. Not a learning system. A proof system. And once we said it out loud, a number of decisions became simple.

What it changed

• We collapsed our pricing into one plan with every feature in it, because gating the proof layer behind an upsell would undercut the only thing we are really selling.
• We published the prices, with a calculator, so you can work out your own number before you talk to anyone.
• We opened a free trial: twenty seats, thirty days, everything on.
• We went through our own website and removed every claim we could not point to in the product. A strange discipline for a marketing exercise to leave you with, but the right one for a company whose product is proof.
• And we run HabileLabs’ own mandatory training on Learnify. The next time an auditor asks, the answer is an export, not a week.

For the person who has to prove it

If you own compliance training, you know the shape of this job. Nobody notices when the audit goes well. Nobody thanks you for the reminder that got sent on time. The work is invisible right up until the one week a year when it is the only thing that matters, and that week arrives on somebody else’s calendar.

We built Learnify so that week becomes ordinary. So the answer to “show me” is already sitting there, current, before anyone asks. Not because the training got more engaging (although it can) but because the proof stopped being a project and became a property of the system.

An invitation

If you are the person who has to show an auditor, a client or a regulator that your people are trained, and still current, I would genuinely like to hear how you do it today. What is the slowest part? What breaks? Write to us, or find me on LinkedIn.

And if you would rather see it than read about it, Learnify is free to start. Upload your worst policy PDF and watch what happens.