Governance
Security, privacy and responsible operations.
Enterprise platforms need governance. HMG v7 documents practical controls using free tools.
Access Control
Admin login through Supabase Auth. Recommended production policy: restrict writes to approved admin IDs.
Data Minimization
Do not store sensitive learner records in public CMS pages. Use backup keys carefully.
Audit Logs
Admin actions are logged locally and optionally to Supabase audit table.
Backups
CMS JSON export, local JSON export, Supabase backup and Git version control.
No Paid AI API
No student data is sent to paid AI APIs. Human educators control content and decisions.
Incident Response
Export data, rotate Supabase keys if needed, unpublish affected pages and redeploy static files.