> ## Documentation Index
> Fetch the complete documentation index at: https://campus.agile-academy.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security overview

> How Campus protects content and learner data.

## Security at a glance

|                  |                                                      |
| ---------------- | ---------------------------------------------------- |
| **Phase gating** | Locked content never reaches the AI                  |
| **Permissions**  | Two-layer roles — global and per cohort              |
| **Data & auth**  | Supabase (Postgres, Auth, Storage)                   |
| **Languages**    | English & German, built with data protection in mind |

## Phase gating is a security boundary

Phases decide when lesson content becomes available — and that gate is treated like an **auth check**, not a UX hint. Locked lessons never reach Henrik or the AI layer, so a learner cannot ask Henrik to summarise exam material before it unlocks.

## Permissions

Access is two-layered — global roles plus per-cohort roles — so the same person can hold different roles in different cohorts. See [Permissions & roles](/docs/en/security/permissions).

## Credentials & state

Anything involving credits, tokens, or credentials is recorded as immutable events and derived from them, so every change is traceable — no silent math on balances.