Crack-Ed

Crack-Ed is an education business that trains people for jobs in banking, lending, insurance and retail, with the hiring employer involved from the start. We run its security and compliance readiness programme and release the updates to its live learning platform.

What was the problem?

Crack-Ed sells job-linked programmes. A learner applies, studies on the company's own online platform and is placed with a partner employer. Its public website lists the programmes by sector, carries a blog and a podcast, and has a separate path for employers. That means the business holds learner records and works with banks, and both expect proof that data is looked after and systems are run well.

Crack-Ed already had a large set of security and privacy policies. What it lacked was one plan that connected each policy to real work on the real servers, with an owner, an order and a status. The platform was also changing often, and each update carried risk for the people studying on it.

What did we do?

The work spans trust, security and compliance, digital infrastructure and technology consultancy. Where it touches certification or legal interpretation, we implement the controls, partner counsel advises, and accredited bodies certify.

• We built one plan. We read the policy set and the platform side by side and turned every requirement into a tracked task, grouped by phase and by owner, and marked done, in progress, waiting on a server, or not applicable. It covers the work behind ISO 27001 readiness and India's data protection law, the DPDP Act.
• We checked the plan against the servers. The original plan assumed a large cloud provider. When we looked, the platform turned out to run on a rented virtual private server, so we re-planned the affected tasks around what is really there.
• We release updates safely. A recent release added a database change, a new front end and Google sign-in. We backed up the database first, built the new front end in a separate folder, swapped it in only after checking it, and kept the previous version ready to roll back. Every step has a written change record.
• We report every week. A short status note with red, amber and green ratings, the blockers, the risks and the decisions that need an owner, so nobody has to chase us for an update.

What is it built on?

The learning platform is a Django application with background workers, a PostgreSQL database behind a connection pooler, and a React front end, all behind nginx. The public website is a React single-page site. Both are tracked in Google Analytics 4 and Microsoft Clarity.

What changed?

Crack-Ed now has one readiness plan with an owner for every task, and the security and privacy work is tied to the servers it actually runs on. The latest platform release is in production with Google sign-in set up, and it went out with a backup and a rollback ready. The readiness programme is still under way.

For a sense of scale, this is what the website's Google Analytics 4 property recorded in the 12 months to 29 October 2026:

• Sessions: 198,222
• Engaged sessions: 72,452
• Key events: 39,147
• Organic search key-event rate: 18.81%

That window starts before our programme began in October 2026, so read these as the size of what we look after, not as an effect of our work. What the programme itself has changed, in numbers: [RESULT TO CONFIRM].

If your business has to show customers, partners or investors that its systems are in order, tell us where you are starting from.