ZelSafe Private Dashboard

/ 01

What is ZPD

ZelSafe Private Dashboard is Rocheston's private, employer-side compliance-evidence portal for RCCS cybersecurity awareness training — one local place to receive, verify, store, search, review, and export employee training evidence generated by the ZelSafe app.

Not a vendor cloud

ZPD is a self-hosted PHP/SQLite application packaged as a Docker image. Your organization runs it on its own server, workstation, private VPC, intranet, lab network, or secure environment — you own the deployment end to end.

One design principle

Training happens on the employee device. Evidence uploads directly to the employer. Rocheston does not collect the employee training data. Everything else in ZPD follows from that.

/ 02

How the program works

Five steps, one direction of travel: from the employee's device straight to your private server.

01

Employee completes ZelSafe training

The employee uses the ZelSafe iOS and Apple Watch experience to complete the required RCCS learning, audio lessons, checks, and certification workflow. Training metrics remain on the employee device until the employee exports evidence.

02

ZelSafe generates a signed audit JSON

After completion, the app generates an audit JSON containing completion evidence, certificate metadata, engagement metrics, timestamps, and cryptographic verification data — sealed with a digital signature so the dashboard can detect tampering.

03

Employee uploads directly to ZPD

The employee uploads the audit JSON to your organization's ZPD upload page. The upload goes to the customer's server — never to Rocheston's infrastructure.

04

ZPD verifies and stores evidence locally

ZPD validates the JSON structure, checks the cryptographic evidence, stores the original file in the private storage volume, updates the local SQLite database, and makes the record available in dashboards and reports.

05

Administrators export audit evidence

Authorized administrators generate dashboards, reports, employee rosters, JSON evidence views, PDF reports, ZIP evidence packages, and compliance summaries for auditors and internal reviewers.

/ 03

The zero-data privacy model

Privacy as a property of the architecture, not a promise in a policy document.

📱Employee DeviceTraining + signed evidence export

→SIGNED JSON

🖥️Your ZPD ServerVerification · storage · dashboards · reports

⃠NO SYNC

☁️Rocheston CloudReceives nothing — no rosters, scores, certificates, or activity

What never leaves your network

No Rocheston cloud sync — employee rosters, emails, certificates, scores, upload activity, and training records are never sent to Rocheston.
No vendor analytics — no external analytics, telemetry scripts, tracking pixels, or CDN-hosted runtime dependencies required.
Customer-controlled storage — the SQLite database and evidence JSON files live in your storage volume, commonly /var/lib/zpd/storage.
Air-gap friendly — runs where outbound network access is restricted or unavailable; evidence uploads through the private dashboard URL.

Employee steps

✓Complete the assigned RCCS training in the ZelSafe app.
✓Export the audit JSON after the app confirms completion.
✓Open the employer upload page provided by the organization.
✓Upload the JSON file directly to the private ZPD instance.
✓Receive confirmation after ZPD validates the evidence.

Employer result

A locally stored, signed evidence record reviewable in the ZPD dashboard. The employee never creates a third-party vendor account or sends private training data to Rocheston.

ZPD builds the workforce view from uploaded evidence records — ideal for organizations that do not want to synchronize HR systems, Azure AD, Okta, or other identity stores with an external vendor.

/ 04

Core features

ZelSafe Private Dashboard employee records screen showing search, filters, completion status, module progress, ZelCards count, readiness, training time, expiration, upload date, and evidence actions. — ZPD employee records dashboard with private roster search, completion status, readiness, training evidence, expiry tracking, and export actions.

Workforce Evidence Dashboard

Visual KPIs for employees, verified completions, workforce coverage, readiness, evidence freshness, expired records, and records needing attention.

Cryptographic Verification

Verifies uploaded audit JSON files with ECDSA P-256 and preserves the original evidence package for later inspection and audit review.

Reports & Exports

PDF reports, CSV rosters, JSON evidence views, certificate details, and one-click auditor evidence ZIP packages.

Private Management Console

Authenticated admin area for settings, CORS controls, upload PIN configuration, sample data, reset controls, and maintenance.

Local SQLite Database

Simple embedded storage with no external database server — suitable for small teams, labs, pilots, and secure internal deployments.

SBOM & Supply-Chain Evidence

Public SBOM package supports software inventory, vulnerability review, license review, and procurement documentation.

/ 05

Download & deploy

The official Docker image is published as rocheston/zpd. It exposes the web application on container port 8080 and stores persistent data in /var/lib/zpd/storage. Pull, run, open — that's the entire install.

Task	Command / URL	Purpose
Docker Hub	`https://hub.docker.com/r/rocheston/zpd`	Official Rocheston ZPD container page.
Pull image	`docker pull rocheston/zpd:latest`	Downloads the latest ZPD release.
Run container	`docker run -d --name zpd -p 8888:8080 -v zpd-storage:/var/lib/zpd/storage rocheston/zpd:latest`	Starts ZPD with persistent local volume storage.
Upload page	`http://localhost:8888`	Employee-facing upload page for signed ZelSafe audit JSON files.
Admin console	`http://localhost:8888/admin`	Employer dashboard, reports, settings, and management.
First login	`admin / admin` Change required	First login requires setting a private administrator password.
Storage	`/var/lib/zpd/storage`	SQLite database and original uploaded evidence files.

/ 06

Security controls

Forced password change

The built-in first login is admin / admin. Before using the dashboard, the administrator must set a private password.

Strong password hashing

Administrator passwords are stored with Argon2id when supported by the PHP runtime, falling back to the strongest supported algorithm.

Login throttling

The login flow throttles repeated failed attempts to reduce brute-force risk; PIN-protected uploads lock out after repeated wrong tries.

Secure sessions

HTTP-only cookies, CSRF protection on every state-changing action, and POST-based logout.

Private storage

The database sits outside the public web root in the configured storage directory and should be mounted as a private Docker volume.

CORS controls

Allow browser-based remote upload clients from all origins, or restrict them to selected trusted origins only.

/ 07

Reports & evidence

Evidence that security leaders, auditors, compliance teams, and government reviewers can inspect — without needing access to any Rocheston system.

Evidence	What It Shows	Use Case
Dashboard KPIs	Workforce completion, readiness, exceptions, expiring evidence, and attention items.	Operational compliance management.
Employee roster	Uploaded evidence status per employee.	Manager review and follow-up.
Certificate view	RCCS certificate details and validation hash.	Individual proof of completion.
Auditor package	Original JSON evidence, SHA-256 manifest, and supporting reports in one ZIP.	SOC 2, ISO 27001, HIPAA, NIS2, internal audits.
SBOM package	Software components, vulnerability scan evidence, licenses, provenance, and checksums.	Supply-chain and procurement review.

Training evidence that lives on your server. Not ours.