Security overview - Scrum Academy

Security at a glance


Phase gating	Locked content never reaches the AI
Permissions	Two-layer roles — global and per cohort
Data & auth	Supabase (Postgres, Auth, Storage)
Languages	English & German, built with data protection in mind

Phase gating is a security boundary

Phases decide when lesson content becomes available — and that gate is treated like an auth check, not a UX hint. Locked lessons never reach Henrik or the AI layer, so a learner cannot ask Henrik to summarise exam material before it unlocks.

Permissions

Access is two-layered — global roles plus per-cohort roles — so the same person can hold different roles in different cohorts. See Permissions & roles.

Credentials & state

Anything involving credits, tokens, or credentials is recorded as immutable events and derived from them, so every change is traceable — no silent math on balances.