Access Control
Role-based access control in Babelize: the available roles, the permission matrix, sign-in methods, two-factor authentication and sessions.
Babelize uses role-based access control (RBAC) to manage who can do what within your projects.
Roles
Each project has exactly one owner. Admins, editors and viewers are added by invitation; ownership moves only by transferring it.
| Role | Description |
|---|---|
| Owner | Full access, billing, can delete the project |
| Admin | Manages members and invitations, edits everything |
| Editor | Runs translations, edits translations and glossary |
| Viewer | Read-only access, can comment |
Permission Matrix
| Permission | Owner | Admin | Editor | Viewer |
|---|---|---|---|---|
| View the project, results and glossary | ✓ | ✓ | ✓ | ✓ |
| Comment | ✓ | ✓ | ✓ | ✓ |
| Run translations and sync | ✓ | ✓ | ✓ | ✗ |
| Edit translations and glossary terms | ✓ | ✓ | ✓ | ✗ |
| Change project settings | ✓ | ✓ | ✗ | ✗ |
| Invite members and change roles | ✓ | ✓ | ✗ | ✗ |
| Archive the project | ✓ | ✓ | ✗ | ✗ |
| Remove members | ✓ | ✗ | ✗ | ✗ |
| Transfer ownership | ✓ | ✗ | ✗ | ✗ |
| Delete the project | ✓ | ✗ | ✗ | ✗ |
Anyone signed in can create their own projects, and any member except the owner can leave a project.
Authentication
| Method | Status |
|---|---|
| Email and password | Available |
| GitHub sign-in | Available |
| Google sign-in | Available |
| Two-factor authentication (TOTP authenticator app) | Optional; once on, required for sensitive account actions |
Passwords are handled by Supabase Auth; Babelize never stores them itself.
GitHub access
GitHub sign-in asks only for your profile and email. Repository access is a separate, single connection through the Babelize GitHub App, limited to the repositories you install it on.
Before October 18, 2026, GitHub sign-in also asked for repository access (the repo permission). If your account signed in with GitHub before then, Babelize still holds that sign-in token, encrypted, and uses it in one case: when GitHub refuses the App's access to a repository you imported into Babelize, such as an organization repository where you installed the App only on your personal account. The App is always tried first.
To limit Babelize to the App:
- Install the Babelize GitHub App on every account or organization whose repositories you translate.
- Revoke Babelize under GitHub → Settings → Applications → Authorized OAuth Apps.
Signing in with GitHub again afterwards asks only for your profile and email.
Sessions
Sessions use HttpOnly, secure cookies. Changing your password signs you out of every other session.
Best Practices
- Least privilege — assign the minimum role needed
- Review access regularly — remove members who no longer need access
- Use OAuth — reduces password-related risks
See the full Security page for how we protect your data.
Last updated: 2026-11-01