Education and training: the record someone else will rely on, built with AI and human sign-off

The operating job in one sentence

Everything a provider builds exists to make one artefact trustworthy: the record that says this person enrolled, did the work, was assessed and reached a stated standard. An employer, a regulator or another institution will read it years later, often after the system that produced it has been replaced.

Current pressures

What providers describe as pressure in 2026; each is a failure mode, not an argument for new software.

The workflows a project touches

A first project cuts into this sequence. Decide which steps it owns before choosing software.

1. Enquiry and application. An interest becomes a named applicant, with eligibility, prior learning and funding route recorded once.
2. Enrolment and payment. Acceptance, contract, payment or funding claim, and one answer to whether the learner is enrolled.
3. Delivery. Scheduling, materials, attendance and participation, online or in person.
4. Assessment. Submission, marking, moderation, resubmission and appeal, with who decided what recorded.
5. Progression and completion. One rule for what counts as complete, applied the same way by every report.
6. Credential issue and verification. The record leaves the organisation, and a third party must be able to check it independently later.
7. Learner support. Questions, deadlines and technical problems, routed to whoever is entitled to answer.
8. Reporting. Funders, regulators, employers and quality review, produced from recorded events, not reassembled by hand.

Steps 1, 2 and 8 are the matching mechanics of ERP and back-office operations, with enrolments in the place of orders. Step 7 is customer support automation. Where courses are sold direct, checkout works as on retail, commerce and marketplaces.

How does data sensitivity change the design?

This is where an education project differs from a commercial one: the data is sensitive, it frequently concerns minors, and that changes the architecture rather than the feature list.

• Lawful basis and consent are design inputs. Who may be contacted, for what, and who may consent on a learner's behalf are answered in writing first; guardian consent for minors changes the account model.
• Access is per role and per cohort. A tutor, an external assessor, an administrator and a funder each see a different slice, so role-based access control and multi-factor authentication on administrative screens are the baseline.
• Retention is long and uneven. The credential outlives the rest of the record, so deletion must be a specified feature.
• Safeguarding and accessibility notes need tighter handling than the rest of the record: who may read them, and what is logged when they do.

Netbase's published security practice is specific: secure code review and version control, role-based access control, multi-factor authentication on admin dashboards, contributors under non-disclosure agreement, and non-disclosure and data-processing agreements on request. Netbase JSC holds ISO 27001 certification for information security management and a SOC 2 Type II attestation; neither is an education accreditation, and no certificate number, date, auditor or audit scope is published. Its compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. Evidence of that practice is on data security and compliance in outsourcing.

Which published work sits closest to education

With a local Odoo implementation partner, Netbase has consulted on and customized Odoo in Vietnam for a university institute among other unnamed clients. The Odoo implementations record lists every kind of organisation it covers, and the fit with your enrolment, assessment and credential rules is tested in discovery against the questions set out on this page.

The relevant overlap is mechanical. Since 2020 Netbase has worked as offshore development and managing partner on a multi-tenant cloud ERP platform for a US client who is not named, covering customer records, messaging, HR, a knowledge base, custom fields and workflows, and API integrations; a retail phase was planned work when that profile was written and is not presented as delivered. Per-tenant segregation, shared-record writes and an event history are the mechanics of cohorts, assessment decisions and a credential checked years later, reused here alongside the retrieval and evaluation capability above. That record and its limits are on the multi-tenant cloud ERP platform page; all published records sit under work.

Demand evidence rather than a client list: a first milestone narrow enough to reverse, a discovery output another supplier could reuse, a named delivery lead, and written answers on consent, access and retention before any design is approved.