Built for the rules a city actually answers to.
Training in a city isn't just delivered — it's regulated, disclosed, and audited. Civis is built around three of those obligations from the start: accessibility under the ADA, public records under Florida's Sunshine Law, and keeping each city's data its own. Not features bolted on for a security questionnaire — how the system is put together.
Two rules a municipal LMS can't treat as optional.
Most learning platforms treat accessibility and records as add-ons. For a city, they're the reason the system exists — and the two places a vendor most often falls short.
Accessible content, and an accessible app.
Under the 2024 U.S. DOJ ADA Title II rule, public entities with 50,000+ residents must meet WCAG 2.1 AA — and the obligation reaches content the city provides through third parties, too. So accessibility can't be frontend polish; it's a gate on publishing and a requirement of the app itself.
Every record ready to disclose.
Training records a city holds are public records — discoverable, and often requested on a deadline. Civis writes every completion and every change to one append-only, timestamped store, so answering a request is a query, not an archaeology project.
Each city is a closed world.
Cities share the platform, never the data. Isolation is enforced twice — once by the database, once in every query — so one city can never see another's rows.
Row-level security
Every table is keyed to a tenant, and PostgreSQL row-level security is the backstop that catches any query that forgets the filter. It's the database, not the app, enforcing the boundary.
Defense in depth
The tenant is resolved from the auth token on every request, then applied a second time inside every stored function. Two independent filters have to agree before a row is returned.
No enumerable IDs
Records are addressed by opaque GUIDs on the wire; the internal integer IDs never leave the backend, so there's nothing to guess or increment from a URL or an API response.
Records are added, never quietly rewritten.
The things a city has to stand behind — who completed what, the attestation they signed, the quiz they passed, and every state change along the way — are written to append-only ledgers. A correction is a new entry, not a silent overwrite, so the history always holds.
Bloodborne Pathogens · Module 2
US-hosted, and honest about what it's for.
Civis runs on US infrastructure with TLS on every connection. It's built for training and compliance records — and we'd rather tell you where the line is than let a questionnaire assume it.
Scope, stated plainly. Civis holds training and compliance records — completions, attestations, competencies, and the audit trail. It is not a system of record for CJIS-regulated criminal-justice data, which is out of scope. Hosting is self-managed today, with a path to a city's preferred cloud if procurement requires it.
The questions Risk, IT, and Procurement bring — answered.
Where is our data hosted?
Can another city see our data?
Can we answer a public-records request quickly?
Is the platform itself accessible?
Do you ever edit or delete a record?
What about CJIS or other regulated data?
Bring your security questionnaire.
We'd rather answer the hard questions early. Send your accessibility, records, and data-handling requirements, and we'll walk your team through exactly how Civis meets them.