FAQ

What This FAQ Is For

Quick answers to questions support and admins hear often. Each answer stays short and points to the how-to that owns the full detail—so product truth lives in one place.

Who This Is For

Administrators, managers, and authors troubleshooting access, publishing, results, roles, or sign-in. Learners can use the visibility answers when something is missing from Learn.

Skillhabit is a learning and certification platform for regulated and quality-driven organizations—agile learning with compliance-grade control. It includes full LMS capabilities (content, libraries, progress, groups, SSO), so if you searched for an LMS, you are in the right place. The product story centers on mandatory tracks, certification (including external audiences), renewal, and evidence of completion. Overview: What Is Skillhabit?.

Why can’t a user see a course they were enrolled in?

Usually visibility, not enrollment alone. In Create, confirm the person’s group or individual visibility. Learn only lists standalone items they are allowed to see. Content taken only inside a program may never appear as its own library row—they open it from the program. Certificate recertification can also unlock renewal content without a standalone Learn tile. Full rules: Visibility in Learn.

Someone sees Buy License—do they need a license, or visibility?

Buy License can mean more than one thing. If they lack visibility and the item is an Academy product, the dialog often still offers Buy License (opens the Academy product page). If they already have visibility but the paid product uses licenses, License required means they need a valid content license to start. Visibility and licenses answer different questions—you normally need both for license-gated paid products. See Visibility in Learn and Content Licenses.

How do I reset a user’s progress on a course?

Depends what you need to clear:

One person, completed result / certificate — On their profile in Users & Groups, delete the certificate for that course so they can take it again. See Users and Profiles.
One person, attempt limit exhausted — Reset attempts under Content Attempts on the same profile.
Everyone after a publish — When you publish updates, use Advanced options → Force reset all previously completed results (works for a patch or a new revision). See Publishing Updates.

Create & Publishing

What’s the difference between a patch and a new revision?

A patch keeps the same revision number and applies non-structural fixes in place—learners mid-course usually keep their place after refresh. A new revision increases the revision number (required when structure changed, or when you turn Increment revision number on). Force-reset of completed results is a separate advanced option either way. Details: Publishing Updates.

Analyze

Why aren’t my survey results showing in Analyze?

For anonymous surveys, Skillhabit hides results until at least three users have responded—so individuals can’t be identified. Named (non-anonymous) surveys show earlier. Browse survey text under Content statistics → Question statistics. See Content Statistics and Building Blocks (survey anonymity can’t be turned off once enabled).

Roles

What’s the difference between a Manager and a Collaborator?

Role	Scope	Typical work
Manager	One or more groups	See members in those groups; optionally manage manual membership, approve Academy requests, and view those users’ results in Analyze (with the right permissions)
Collaborator	A specific content item in Create	Edit and preview that course, program, meetup, or Imported Package; with Analyze access, follow results for content they collaborate on

Managers are set in Users & Groups; collaborators are added per item in Create. Guides: Managers · Collaborator Access.

Identity & Email

What’s the difference between SSO and user provisioning?

They solve different problems. Provisioning answers who exists in Skillhabit (create, update, archive—often with groups) from Entra, SCIM, or the External API. SSO / authentication answers how someone signs in (Login code, Magic Links, Microsoft, OpenID Connect, API login links). You often need both. Start here: External Identity Providers.

Can we offer Swedish BankID?

Yes. Connect a BankID-capable OpenID Connect broker (or your IdP that already fronts BankID). You own the BankID agreement with the broker; Skillhabit uses OpenID Connect and optional attribute mappings. The same setup can cover other eIDs that broker offers. Guide: Sign In With BankID via OpenID Connect.

How do I create a user who should not receive emails?

Give them a unique address on @noemail.skillhabit.com. Skillhabit never sends email to that domain. Use it for External API (or similar) accounts that sign in another way. Entra sync can assign this domain when the directory has no valid email. Those users cannot use Login code or Magic Links—plan Microsoft, OpenID Connect, or an API login link. See Bulk Actions and Email and SSO and Email Addresses.

What if SSO users have no mail attribute?

Skillhabit still needs an email-shaped identifier. Entra sync and Microsoft / OpenID Connect sign-in fall back through other fields (for example userPrincipalName, preferred_username, guest UPN conversion). OpenID Connect needs at least one of email, preferred_username, or upn. If nothing usable exists on sync, Skillhabit may store @noemail.skillhabit.com. Full order of resolution: SSO and Email Addresses.

Emails never arrive / land in spam—what should IT allowlist?

Default From is {workspace-id}@skillhabit.com (shown in email preview). Ask IT to allowlist that address or @skillhabit.com by domain—not by a fixed IP list. If you use a custom Email Domain, allowlist that too. If sign-in mail arrives several minutes late, greylisting may be holding the first attempt—see Greylisting and Delayed Delivery. Full IT checklist: Allowlist Skillhabit Email.

Trust & Security

Where is Skillhabit hosted, and are you GDPR / ISO ready?

Skillhabit is Europe first: owned entirely by EU entities, hosted in Sweden (region not selectable), and—where a service touches customer data—using EU-based services except optional AI authoring. TicTac Learn (Skillhabit’s group) holds ISO 27001:2022 and operates GDPR-aligned practices. Short overview: Trust & Security. Legal documents: TicTac Trust Centre. Live uptime: status.skillhabit.com.

How do you handle vulnerabilities and penetration testing?

We run continuous vulnerability management (CVSS triage, risk-based remediation) and yearly independent penetration testing; findings are tracked to fix or compensating control. Secure development includes review, dependency management, and security testing before release. Details: Trust & Security.

How are security incidents and personal data breaches handled?

Security-relevant events are logged and monitored. We follow a documented incident response process. Personal data breaches under the DPA are notified to the customer within 48 hours of becoming aware. Details: Trust & Security.

Why don’t you show a cookie consent banner?

Skillhabit is privacy-first: no advertising or profiling trackers, so learners and admins go straight into the product without a consent dialog. We only keep what the platform needs (sign-in session, preferences, aggregate usage to improve the product, and technical diagnostics). Details: Trust & Security. Legal wording: Privacy Policy.

How do you tell users what data they agree to store?

At signup, Academy sign-in, and checkout, users see that continuing means they agree to Skillhabit’s Terms of Use and Privacy Policy (with links). When signed in, the same links are in the Your Apps menu. Skillhabit does not control how a customer uses workspace data—for that workspace’s own policy, use its Academy terms & conditions. Full picture: Trust & Security.

Are you WCAG accessible?

Yes—we design and test for WCAG 2.1 Level AA, including automated accessibility scans and design review so the product works for everyone. See Accessibility.

Is AI Course Studio safe for confidential company material?

AI generation sends the prompts and files you submit to OpenAI for that job. The product discloses that those inputs may be logged for up to 30 days. Do not upload secrets or unnecessary personal data. Full picture: AI Creation & Data Privacy. Contracts and DPA: TicTac Trust Centre.