Open a word processor, drop in a logo, type a name and a date, export to PDF. Five minutes, and you have a “Certificate of Completion” that looks exactly like a real one. The format is the problem: a PDF is a picture of a claim, not the claim itself. It carries no proof of when it was made, by whom, or whether the issuer ever stood behind it. A certificate is only worth something if a third party — an auditor, a regulator, a prospective employer — can verify it without trusting the person holding it.
That is the test every certificate in Lattice Learn is built to pass. The document you can print is the least interesting part. What matters is what sits behind it.
A certificate is a ledger entry, not a file
When a learner finishes a course in Lattice Learn, the platform does not “generate a PDF” as its first act. It writes a record to an append-only certificate ledger. The ledger only accepts forward writes — you cannot reach back and insert an issuance dated last March, and you cannot quietly edit one that already exists. The issue date means what it says because the storage layer will not physically permit it to mean anything else.
The PDF is then rendered from that ledger entry, not the other way around. So the document and the record can never drift apart, and the record is the source of truth. If someone hands you a beautiful PDF that has no matching ledger entry, it is, definitionally, a forgery — and the next section is how a stranger discovers that in about three seconds.
Verification by public QR — no login, no trust required
Every certificate carries a QR code that resolves to a public verification page. Anyone can scan it. There is no account to create, no login wall, no “request access” form. The page reads directly from the ledger and shows the things that actually matter:
- the certificate kind, stated plainly;
- whether its cryptographic signature is valid and the record is unrevoked;
- and — where it applies — an explicit, unmissable non-accredited label.
Putting this behind a public URL removes the holder from the chain of trust entirely. You are not taking the candidate’s word, and you are not taking a PDF’s word — you are reading the issuer’s own ledger, live, at the moment you look. A revoked or superseded certificate says so on the page; a backdated one cannot exist to be scanned in the first place.
That is a deliberately different angle from how we treat the evidence behind a completion. The story of how we prove a learner genuinely watched the video and passed an assessment that never shipped the answer key to their browser lives in Proving Someone Actually Did the Training. This post is about the credential that completion produces — and making it impossible to fake after the fact.
Honest labelling: accredited is not a font choice
There is a line in Australian training that we will not blur, because blurring it is a strict-liability problem for whoever we’d be handing it to. A nationally recognised qualification — a Statement of Attainment — is a regulated act. It can only be issued by a Registered Training Organisation, and the NRT logo is a legal claim about who the issuer is, not a decorative flourish.
So Lattice Learn draws the line in the data, not in the UI:
- Accredited certificates (Statements of Attainment) are issued only for RTO tenants. A tenant without RTO status cannot mint one at all.
- Everything else is clearly marked non-accredited — on the certificate and on its public verification page — and we never let that label go soft.
To be precise about our own position: Lattice is not an RTO and does not issue accredited qualifications in its own name. The platform is RTO-capable. When an RTO tenant issues a Statement of Attainment, it is the RTO making the accredited claim, with the USI handling, AVETMISS / NCVER export and tax invoicing that obligation requires. For everyone else — councils, peak bodies, enterprise — the certificate is honestly badged for what it is: proof of completion of internal training, not a nationally recognised credential. An auditor reading either one should never have to guess which is which.
Both kinds are rendered as tagged, accessible PDFs — structurally readable documents, not flattened images of a document — so they meet WCAG 2.2 AA expectations as well as scrutiny.
Why a fake certificate would corrupt more than a file
In most systems a forged certificate is a tidy, contained lie — one bad row in one table. In Lattice Learn it would not stay contained, and that is precisely why the controls above are not optional.
The LMS lives in the same schema as compliance, so a genuine completion is a compliance input, not an export. One real completion sets off five consequences at once: the live compliance score recalculates on its own; a skills record materialises for the required-versus-held gap view; mandatory-rule auto-enrolment cascades by position; a high-risk-work licence minted from verified competency is enforced at the PPE pre-start gate, so an uncertified operator is physically blocked from the task; and the controlled document the course references stays bound to it so neither can quietly drift.
Read that list as an attacker and the stakes are obvious. A fakeable certificate would not just decorate a profile — it would silently lift a compliance score, close a skills gap that is still open, and, worst of all, hand someone a licence that unlocks a high-risk task at the gate. The certificate is the keystone that turns “watched a video” into “allowed on site”, and a keystone you can forge in a word processor is no keystone at all. So the ledger is append-only, the signature is verifiable by a stranger, and the accredited line is enforced underneath the buttons rather than printed on top of them.
Where this fits
Tamper-resistant certificates are one facet of treating training as evidence rather than decoration. They sit alongside records you can defend — retention schedules and signed, append-only disposal — and the same tamper-evident posture described on our security page. The throughline is consistent: every output has to survive a hostile reading, and the holder’s say-so is never part of the proof.
A certificate you can fake is a liability dressed up as an asset. A certificate that writes to a ledger you cannot rewrite, verifies by a QR code anyone can scan, and labels accredited versus non-accredited without flinching is the opposite — a claim that defends itself.