Security at Zentrum24 Academy

Zentrum24 Academy is a multi-tenant SaaS learning management system (LMS) built for compliance and GxP training in regulated pharmaceutical and life-sciences organizations. It manages role-based training assignments, SCORM courses, quizzes, 21 CFR Part 11 electronic signatures, PDF/A completion certificates, and a tamper-evident audit trail. Because our customers operate under regulatory scrutiny, security and data integrity are treated as first-class product requirements rather than afterthoughts.

This document describes how Zentrum24 Academy protects customer and end-user data: where it runs, how tenants are isolated, how data is encrypted, how access is controlled, and how we maintain the audit integrity that regulated training records demand. It also states our compliance posture honestly — including which independent attestations are on our roadmap rather than already held.

Document owner: Zentrum24 LLC Security. Last reviewed: 8 September 2026. Version: 1.0.

Infrastructure & hosting

Zentrum24 Academy is hosted on Vercel (application hosting), with Supabase providing the managed PostgreSQL database and object storage, and Stripe providing payment processing. Primary hosting region: AWS us-east-1 (Northern Virginia, United States). Regional data-residency options are not currently offered.

• Compute. The application runs on Vercel's managed serverless platform behind its global edge network. There are no customer-accessible host servers to patch or manage; underlying host maintenance is handled by the platform provider.
• Database. Application data is stored in a managed PostgreSQL database provided by Supabase, encrypted at rest.
• Object storage. Uploaded files and generated artifacts (for example course packages and certificates) are stored in private object-storage buckets (Supabase Storage) with server-side encryption enabled and public access blocked.
• Rate limiting. Rate-limiting state is maintained in the application's PostgreSQL database in production deployments.
• Transactional email. Notifications and system email are delivered through Resend (Resend, Inc.), with a direct SMTP transport available as a fallback.

Network isolation. The Zentrum24 Academy application (Vercel) and its managed database (Supabase) run on managed cloud platforms. The database is not exposed for general public use; access is mediated through the application tier using scoped credentials that follow least-privilege principles.

Tenant isolation

Zentrum24 Academy is multi-tenant: multiple customer organizations share the same application and database while their data remains logically separated. We enforce that separation at the database layer, not merely in application code.

• PostgreSQL row-level security (RLS). Tenant-scoped tables carry RLS policies that filter every query by the active tenant identifier. Even if an application-layer check were missed, the database itself will not return another tenant's rows.
• Non-superuser application role. The application connects using a dedicated, non-superuser PostgreSQL role that is subject to RLS. Privileged operations (migrations and seeding) use a separate administrative role that the running application does not use. This means a bug in application logic cannot escalate to bypass tenant isolation.
• Per-request tenant context. The tenant identifier is derived from the authenticated session and applied to the database session for the duration of the request, so RLS policies evaluate against the correct tenant on every read and write.

Defense in depth here means tenant isolation is enforced in two independent layers — application authorization and database RLS — so a single mistake does not become a cross-tenant data exposure.

Encryption

In transit

All connections to Zentrum24 Academy are protected with TLS. Traffic is served over HTTPS at the platform edge, and internal service-to-database communication is likewise encrypted. Session cookies are marked httpOnly and Secure so they are not exposed to client-side scripts and are only transmitted over encrypted connections.

At rest

Data at rest is encrypted across the stack: the managed PostgreSQL database, object storage (server-side encryption), and supporting backups and snapshots are all encrypted. Application-level secrets that are especially sensitive receive an additional layer of protection described under Application Security below.

Authentication & access control

• Multi-factor authentication (MFA). Users can enroll TOTP-based MFA (compatible with standard authenticator apps) together with single-use backup codes for account recovery. Backup codes can be regenerated by the user after re-verifying their password and a current TOTP code.
• Single sign-on (SSO). Enterprise SSO via SAML, with SCIM provisioning, is available on the Pro tier and configured per tenant. When SSO is enabled, users authenticate through the customer's identity provider, and matching users can be just-in-time provisioned as learners.
• Role-based access control (RBAC). Access is governed by clearly separated roles — tenant administrator, author, manager, and learner — plus a manager hierarchy for team-scoped visibility. Users see and can act only within the scope their role grants.
• Session handling. Sessions use stateless, signed JWTs stored in httpOnly cookies. Sessions enforce an idle timeout; after the configured period of inactivity a user is signed out and must re-authenticate. Active sessions are re-issued on activity without excessive cookie churn.
• Password policy. Passwords are hashed with bcrypt. Administrators can configure complexity requirements, password history (to prevent reuse), and a password-expiry interval that prompts a mandatory change at next login.
• Rate limiting & account lockout. Sensitive endpoints (such as login, SSO initiation, and evidence export) are rate-limited on a per-tenant and per-user basis. Repeated failed login attempts within a short window trigger a temporary account lockout; administrators can unlock accounts and review the associated audit events.

Application security

• Input validation. Requests are validated against strict schemas at the server boundary before any business logic runs, reducing the risk of malformed or malicious input reaching data or downstream systems.
• Least-privilege access. Cloud-platform access follows least-privilege principles: application components hold only the permissions they require, and administrative capabilities are separated from the runtime application role. Database roles are similarly scoped (see Tenant Isolation).
• Secrets management & envelope encryption. Highly sensitive stored secrets — including per-user MFA secrets and per-tenant SSO client secrets — are protected with envelope encryption (AES-256-GCM) using a master key held outside the primary datastore. Encrypted values are stored in a versioned, self-describing format so that keys and formats can be rotated over time.
• Two-person controls. For controlled content workflows, the author or submitter of a course cannot also approve it; publishing requires a separate reviewer's electronic signature. This separation of duties is enforced by the application, not left to policy alone.

Audit & data integrity

Regulated training records are only as trustworthy as the evidence behind them. Zentrum24 Academy is built to make that evidence tamper-evident and defensible.

• Hash-chained audit trail. Security- and record-relevant events are written to an append-only audit log in which each entry is cryptographically linked to the previous one. Any attempt to alter, delete, or reorder historical entries breaks the chain and is detectable by verification. Timestamps used in the hash are pinned to the recorded values so verification is deterministic.
• 21 CFR Part 11 electronic signatures. Electronic signatures bind the signer's identity, the meaning of the signature, and the specific record and timestamp being signed. Signing requires re-authentication (password re-prompt), and signatures are linked to their records so they cannot be transplanted or repudiated.
• Evidence packages. Administrators can export a signed evidence package (training records and audit log with a signed manifest) to support inspections and internal audits, with the manifest bound by a cryptographic hash.

Availability & resilience

• Managed database resilience. The production PostgreSQL database is provided as a managed service (Supabase), with provider-managed availability and failover.
• Autoscaling compute. The serverless application tier (Vercel) scales automatically to absorb changes in demand, and unhealthy instances are automatically replaced.
• Backups & point-in-time recovery. The managed PostgreSQL database (Supabase) supports automated encrypted backups and point-in-time recovery (PITR), allowing restoration to a chosen moment within the configured retention window. Restore procedures should be periodically tested; recovery objectives (RTO/RPO) are defined operationally —.
• Health checks. Liveness and readiness endpoints allow the platform to detect and route around unhealthy instances.

Data lifecycle: export & deletion

• Data export. Customers retain ownership of their data. Administrators can export training records, audit logs, and completion certificates, and programmatic access is available through the versioned REST API using scoped, per-tenant API tokens.
• Deletion & offboarding. On contract termination or upon a documented request, customer data is deleted or returned according to the terms of the applicable agreement and Data Processing Agreement. Note that certain regulated records (for example signed training completions and audit entries) may be subject to retention requirements; deletion practices should reconcile customer privacy requests with those regulatory-retention obligations.
• Privacy requests. We support customers in meeting data-subject requests under GDPR / UK-GDPR where applicable. Direct privacy inquiries to contact@zentrum24.com.

Vulnerability management & responsible disclosure

• Dependency and platform hygiene. We monitor dependencies and platform components for known vulnerabilities and apply updates on a risk-prioritized basis. Managed platform services (Vercel, Supabase) receive underlying host and infrastructure patching from their providers.
• Change controls. Changes flow through version control and continuous-integration checks (including build and type-safety gates) before release.
• Responsible disclosure. We welcome reports from security researchers. Please report suspected vulnerabilities to contact@zentrum24.com. Give us reasonable time to investigate and remediate before public disclosure, and do not access, modify, or exfiltrate data belonging to other customers while testing. We will acknowledge legitimate reports and keep reporters informed of remediation status.

Compliance posture

Zentrum24 Academy is engineered to help customers meet their obligations under the standards that govern regulated training records. We describe our posture precisely, and we distinguish product capabilities we have built from independent attestations we have not yet obtained.

Standards our platform is designed to support

• 21 CFR Part 11 — electronic records and electronic signatures: identity-bound e-signatures, re-authentication at signing, and a tamper-evident audit trail.
• EU Annex 11 — computerised systems: access controls, audit trails, data integrity, and availability practices aligned to the annex's expectations.
• ICH Q9 — a quality-risk-management mindset applied to how training and controlled-content workflows are designed and enforced.
• GAMP 5 — a risk-based, lifecycle approach to computerized-system validation; Zentrum24 Academy is built to be validatable by customers within their own quality systems.
• SCORM 1.2 / 2004 — standards-based course interoperability.
• GDPR / UK-GDPR — privacy-by-design practices for personal data handling, supported by a Data Processing Agreement.

Being "designed to support" these standards means Zentrum24 Academy provides the technical controls a customer needs; it does not, by itself, validate the customer's specific implementation. Formal computerized-system validation for an intended use remains a shared responsibility between Zentrum24 Academy and the customer.

Independent attestations — roadmap (not yet achieved)

• SOC 2. A SOC 2 examination is on our roadmap and is in progress / planned. Zentrum24 Academy does not currently hold a SOC 2 report, and no statement in this document should be read as a claim that one exists. We will make a report available under NDA once the examination is complete.
• Independent penetration testing. Third-party penetration testing is planned as part of our ongoing security program. Where a completed test exists, a summary or letter of attestation can be shared under NDA; until then, we do not represent that an independent penetration test has been performed.

We will update this section as attestations are completed. We do not claim certifications, audits, or test results we do not hold.

Subprocessors

Zentrum24 Academy uses a small set of subprocessors to deliver the service. An up-to-date list is maintained for customers, and material changes are communicated per the Data Processing Agreement.

• Vercel Inc. — application hosting and content delivery; US.
• Supabase — managed PostgreSQL database and object storage; US.
• Stripe, Inc. — payment processing and subscription billing; US.
• Email / SMTP provider — transactional email; a provider has not yet been selected (to be added before launch).

Shared-responsibility summary

Security is a partnership. Zentrum24 Academy is responsible for the security of the platform — infrastructure, tenant isolation, encryption, application security, and audit integrity as described above. Customers are responsible for security in the platform: managing their users and roles, enforcing MFA and SSO policies, safeguarding administrator credentials and API tokens, defining retention and access-review practices, and validating the system for their specific regulated use.

Contact

• Security & vulnerability reports: contact@zentrum24.com
• Privacy / data-subject requests: contact@zentrum24.com
• General / sales / trust inquiries: contact@zentrum24.com

Zentrum24 LLC, 1621 Central Ave, Cheyenne, Wyoming 82001, USA. Governing law: State of Wyoming, USA. This whitepaper is provided for informational purposes, is subject to change, and does not create contractual obligations except as expressly stated in a signed agreement between Zentrum24 LLC and the customer.