Technical Whitepaper

Training Matrix Editor

Maps every position in an organisation to every required training course. A typical council matrix spans 200+ positions against 90+ courses, producing approximately 19,000 individual compliance decisions visible, filterable, and editable in a single interface. Impact Analysis shows the downstream effect of any matrix change before it is committed.

Automated Expiry Monitoring

Background workers continuously monitor certification expiry dates. Configurable alert windows at 90, 60, 30, and 14 days trigger notifications to relevant managers. Lapsed certifications are flagged immediately.

Compliance Scoring

Real-time percentage-based scoring cascading from individual employees through departments to organisation-wide aggregates. Configurable thresholds (default: ≥85% green, 70–84% amber, <70% red). Mandatory Licence Unit (MLU) courses force red status regardless of overall percentage, reflecting their legal weight.

Document Control

ISO 9001/45001-compliant document lifecycle management. Full version control with SHA-256 integrity verification. Configurable approval chains, review scheduling, and escalation workflows. Document state machine supporting DRAFT, IN REVIEW, PUBLISHED, CHANGE REQUEST, and OBSOLETE states. Review sheets with objection blocking. Branded PDF transmittals. Business-day-aware reminder scheduling.

Employee Inductions

Four induction pathways: employees, contractors, volunteers, and councillors. Configurable templates with checklists, document acknowledgements, and competency sign-offs. Integration with document control for version-pinned policy acknowledgement. Canvas signature capture. Certificate generation. Intelligence dashboard with Ward Board vital signs, Sankey bottleneck analysis, and gap detection.

Psychosocial Health

Purpose-built for the OHS (Psychological Health) Regulations 2025, effective December 2025 across all Victorian employers. Covers all 19 prescribed psychosocial hazard types. Anonymous survey engine with configurable question banks. CAPA (Corrective and Preventive Action) workflow. Five-tab intelligence dashboard with weather system (real-time organisational health at a glance), neural risk map (hazard propagation visualisation), heatmap, trends, and radar analysis. Regulation-to-training-course mapping with alignment scoring.

Kiosk and Site Register

On-site sign-in terminal supporting three person types: employee, contractor, and visitor. Pre-start certification gate (blocks sign-in for workers with expired mandatory certifications). Host notification for visitors. Badge printing. Emergency roll call from live site register. Edge gateway (Go binary) for on-premises printer bridging without firewall configuration changes. Offline-capable with encrypted local storage and automatic cloud synchronisation.

Additional Modules

Training scheduling with session management, provider integration, and calendar views. Self-service portal for employee certificate uploads and training requests. Cross-organisation benchmarking with opt-in anonymised compliance comparisons. Training gap analysis. RTO and provider directory with performance tracking. Cross-organisation working groups with discussion forums, resource sharing, and playbook management. Compliance passport with verifiable QR-coded credentials.

Immutable Audit Trail

Tamper-evident, cryptographically verifiable audit trail. Every action in the system (creation, edit, deletion, login, export, workflow transition, kiosk sign-in) is timestamped, attributed to a specific user, and written to an append-only log. Records are sealed into an Ed25519-signed Merkle tree (RFC 6962-style Signed Tree Heads) and continuously re-verified, so any alteration, deletion, or reordering is cryptographically detectable. Signed roots are anchored to independent, off-database storage and can be delivered to the customer for independent verification. Retained per ISO 9001:2015 records management and aligned to ISO/IEC 27001 A.8.15 logging controls, with a minimum 7-year retention for compliance records.

Intelligence Dashboards

Every module includes a purpose-built intelligence dashboard designed to surface actionable insights without manual analysis. Dashboards include: Gap Analysis terrain map, Training Horizon coastline, Benchmarking constellation, Provider supply/demand radar, Working Groups knowledge network, Compliance Passport heartbeat, Document Control Lifecycle Gantt with stuck detection, and Induction Ward Board with Sankey bottleneck mapping.

Audit-Ready Reporting

Compliance reports generated in seconds, not days. Exportable in PDF, CSV, and XLSX for regulatory audits, insurance renewals, board meetings, and regulatory submissions. Compliance snapshots capture the full state — every employee, every course, every gap, every score — frozen at a specific moment. Snapshots are immutable once generated.

Super-Tenant Model

The platform implements a two-tier tenant hierarchy. At the top level, each customer organisation (council group, enterprise, commercial operator) is a super-tenant with its own subdomain, branding, feature gates, and data containment boundary. Within each super-tenant, individual organisational units (councils, branches, sites) are tenants with their own data isolation.

For Victorian councils, the super-tenant is the Victorian council group. Each of the 79 councils is a tenant within that super-tenant. For an enterprise customer, the super-tenant is the organisation. Each branch or site is a tenant within that super-tenant.

This model ensures that an enterprise branch administrator can see all branches within their organisation but can never access a council’s data, and vice versa. Data isolation operates at two independent levels, both enforced by the database engine.

Tenant Isolation Model

Each authenticated request carries a verified tenant identifier, super-tenant identifier, and user role. These are set as session-level parameters before any database query executes. Row-Level Security (RLS) policies enforce that every query — read, write, update, delete — returns only data belonging to the requesting tenant within the requesting super-tenant. This isolation operates at the database engine level, not the application layer. A complete application-layer compromise cannot access cross-tenant data because the database itself enforces the boundary.

Department-level scoping further restricts access within a tenant. A department manager sees only their department’s employees. An organisation administrator sees all departments within their tenant. A super-tenant administrator sees all tenants within their organisation.

Tenant Configuration

Each super-tenant carries a configuration object that controls: platform name and branding (logo, colour scheme, terminology); organisational hierarchy (council/department/position/employee vs organisation/branch/department/worker); landing page (Victorian council map vs branch map vs site map); regulatory framework alignment (OHS Act, ISO 9001, ISO 45001, EPA, or custom); enabled modules (feature flags per tenant type); and compliance unit definition (employee, worker, site, or custom).

Role Hierarchy

Platform Administrator: full platform management across all super-tenants. Auditor: read-only cross-organisation compliance review. Super-Tenant Administrator: full management across all tenants within their organisation. Organisation Administrator: full management within their tenant boundary. Department Manager: employees and compliance within assigned departments. Viewer: read-only access to assigned data. Gateway: scoped device authentication for kiosk and edge gateway endpoints.

Every role boundary is enforced by database-level security policies, not application logic alone.

Subdomain Routing

Each super-tenant is accessible via a dedicated subdomain (e.g., vic.latticelook.au for Victorian councils, or a customer-specific subdomain for enterprise clients). Wildcard TLS certificates ensure all subdomains are served over encrypted connections. The application resolves the super-tenant from the HTTP Host header and scopes all subsequent operations accordingly. Unknown subdomains are redirected to the main marketing site.

Authentication

Industry-standard memory-hard password hashing (Argon2id) resistant to GPU and ASIC attacks. Mandatory multi-factor authentication (TOTP) for all administrative roles, enforced at first login. WebAuthn passkey authentication for passwordless access, with device-bound credentials. OIDC-based Single Sign-On supporting any compliant identity provider (Azure AD, Okta, Google Workspace, and others), configurable per super-tenant. Short-lived access tokens with automatic rotation and separate refresh token lifecycle. Password policy: minimum 12 characters, complexity requirements enforced, password reuse prevention enforced, periodic password rotation enforced. Rate-limited login with automatic account lockout after repeated failures. Absolute and idle session timeouts enforced.

Encryption

All data encrypted in transit (TLS 1.2+ on all connections, including internal service-to-service). All data encrypted at rest on storage volumes. File attachments individually encrypted using AES-256-GCM with per-file encryption keys. Database replication streams encrypted between geographic nodes. Separate encryption keys for data-at-rest, JWT signing, session tokens, TOTP secrets, and field-level sensitive data encryption. Key inventory maintained per ISO 27002 control 8.24.

Access Logging and Monitoring

Every API request logged with user identity, tenant context, super-tenant context, endpoint, response code, and duration. All data modifications recorded with before/after state in append-only change logs. Security events (failed logins, privilege escalation attempts, rate limit breaches, bulk export activity, cross-tenant access attempts) flagged and tracked through a full incident lifecycle: detection, triage, investigation, containment, resolution, post-incident review. Audit logs with automated retention management. Privileged actions require dual-approval workflow.

Data Classification and Protection

Personally identifiable information (PII) is classified and tagged at the field level. Data masking functions applied automatically based on classification when accessed by roles without PII clearance. Data export logging tracks what was exported, by whom, and whether PII was included. Data deletion follows a formal request, review, and execution workflow with complete audit trail.

Data Sovereignty

All customer data is stored exclusively on Australian-owned infrastructure located within Australia. There is no dependency on any third-party hyperscale cloud provider. No data is stored, processed, or transited through infrastructure subject to foreign data access regimes (including the US CLOUD Act, UK Investigatory Powers Act, or equivalent legislation).

The platform operates across two geographically separated Australian nodes approximately 700 kilometres apart, on different power grids, different internet service providers, and in different states. This provides resilience against localised disasters, ISP outages, and power grid failures.

High Availability and Failover

Lattice Look implements fully automated geographic failover across all layers. Database failover uses automated leader election with real-time streaming replication and distributed consensus-based promotion, ensuring no split-brain scenarios. Recovery time is under 10 seconds. Application failover uses active-passive HTTP routing with continuous health checks and automatic traffic rerouting on failure detection. Recovery time is under 6 seconds. End-to-end recovery (combined database promotion and HTTP rerouting) completes in under 16 seconds worst case with no manual intervention.

Recovery Point Objective (RPO): Near-zero. All database transactions are streamed to the standby in real time. Recovery Time Objective (RTO): Under 16 seconds for full read-write recovery on the standby node.

Backup Strategy

Automated daily database backups with point-in-time recovery capability. Backups stored in a geographically separate location from both production nodes. Independent backup schedule on the standby node (protects against corruption propagation through replication). Backup verification logged per ISO 27002 control 8.13. Minimum 30-day backup retention.

Live Monitoring

Infrastructure health is monitored continuously through a dedicated observability stack. Real-time health probes against all application endpoints from an independent monitoring node. Database replication lag monitoring with alerting. Cluster consensus status tracking. HTTP routing and backend health visualisation. Automated alerting on any degradation: node failure, replication lag exceeding thresholds, quorum loss, health check failures.

A live infrastructure dashboard is available at grafana.latticelook.au, providing real-time visibility into cluster status, node roles (primary/replica), backend health, and failover history. Customer IT teams are welcome to inspect this dashboard at any time.

Automated Penetration Testing

Lattice Look undergoes automated white-box security auditing against the full production codebase every week. This is not an annual assessment — it runs every Saturday against the live system.

The audit scope includes application security (injection, authentication bypass, authorisation flaws, session management), dependency vulnerability scanning, and configuration review. Findings are remediated before the following business week. Current status: zero known vulnerabilities.

Automated Test Suite

The platform maintains 2,400+ automated tests across three layers. Backend unit and integration tests cover API endpoint validation, business logic, security controls, RLS enforcement, and super-tenant isolation. Frontend component and integration tests cover UI rendering, state management, and user interaction flows. End-to-end tests cover full user journeys from login through to report generation, executed against a live test environment.

All tests run on every code change. Zero failures is the deployment gate — no code reaches production with a failing test.

The Training Matrix

The training matrix is the core differentiator. It maps every position in an organisation’s workforce to every required training course, with five requirement types. C (Core/Compulsory): counted in compliance percentage. M (Mandatory, site-specific): counted in compliance percentage. MLU (Mandatory Licence Unit): legal requirement — forces red status if missing regardless of overall score. O (Optional): not counted in base compliance (manager discretion). NR (Not Required): excluded from compliance calculation.

Matrix changes trigger automated impact analysis (“this change affects 47 employees; 12 will become non-compliant”) and require confirmation before saving. Every matrix version is snapshotted for historical audit — compliance reports reference the matrix version in effect at the time of the report, not the current version.

Expiry Monitoring Workflow

Background workers run continuously, evaluating every certification record against its expiry date. Alert windows are configurable per organisation: 90 days (early warning notification to department manager), 60 days (reminder notification to department manager and employee), 30 days (escalation notification including organisation administrator), 14 days (critical alert), 0 days/expiry (compliance status updated to lapsed, reflected immediately in all dashboards and reports).

Notifications are delivered via in-platform alerts and configurable email. Rate-limited to prevent notification fatigue.

Compliance Snapshots

Organisations can generate point-in-time compliance snapshots for regulatory submissions, insurance renewals, or internal governance reporting. Snapshots capture the full compliance state — every employee, every course, every gap, every score — frozen at a specific moment. Snapshots are immutable once generated.