The one where I cut certificate audit verification from 4 days to 3 hours.
Clients couldn't prove certificates were real, so audits took days.
If you're in a rush, here's a summary 👇
Mobiliza is a Brazilian company that makes training software for businesses. Its LMS issues a certificate when an employee finishes a training, and for enterprise clients that certificate is the official proof in audits and compliance reviews. But no one could prove a certificate was real. Auditors, regulators and HR checked them by hand, through paper or spreadsheets, so audits took days and fraud was possible. I put a QR code on every certificate. Scanning it opens an online validator that checks the record on Mobiliza's server, so a certificate can't be faked offline. In the 6 client companies we interviewed, audit verification went from 4 days to 2 hours.
My role
Product designer at Mobiliza. I found the compliance gap in client interviews and designed the validator end to end. Worked with a PM, over a three-week timeline.
Problem
Enterprise clients had no reliable way to prove a certificate was genuine. Auditors, regulators, and HR teams were stuck verifying training records manually through paper or spreadsheets, which was slow, error-prone, and opened the door to fraud. For enterprise clients, the certificate is the official proof of training. If it can't be checked quickly, audits stall. If it can be forged, it proves nothing.
The challenge
How might we let anyone holding a certificate confirm it's real, in seconds, without exposing personal data?
Research
Six clients named the same proof I interviewed 6 enterprise clients. They confirmed they needed a faster, automated way to verify certificates, and showed me what each stakeholder needed to trust one: student name, CPF, dates, hours, program content and date validity.
One scan, three layers of proof
A QR code on every certificate. Scanning it opens the validator, with three sections: Mobiliza's company data, the issuing client's data, and the student and course record.
The validator screen
The validator itself follows the three layers: Mobiliza's data on the left; student, course and company data on the right. The CPF is masked, and an expired certificate is flagged in red.
Validation
The validator went to beta with 6 enterprise clients and their audit teams, the people who rely on it in a real compliance review. What we saw was that auditors trusted the QR code right away, but hesitated on the masked CPF. On its own, it wasn't enough to confirm a person's identity. The masking that keeps a public certificate safe also hid the one field auditors rely on. One view couldn't serve both the public and the audit.
Privacy vs proof
Authorized auditors get a full-CPF lookup, while the public view stays masked. The validator stays trustworthy for auditors, safe for everyone else, and in line with LGPD.
In the 6 client companies we interviewed, audit verification went from 4 days to 3 hours.
Several hundred certificates have been verified through it in the first quarter, with zero confirmed forgery attempts. It's now the default proof of completion enterprise clients point to during an audit, covering every certificate Mobiliza's LMS issues.