//Zero Trust Posture

Zero Trust Security Posture

ButtrBase is designed with Zero Trust principles: never trust, always verify.

Core Principles Applied

1. Verify Explicitly

Every request is authenticated and authorized, regardless of network origin:

  • JWT validation on every API call
  • Short-lived tokens (1 hour default)
  • Step-up authentication for sensitive operations

    • 2. Least Privilege Access

  • RBAC V2 with fine-grained permissions
  • Service accounts scoped to minimum required permissions
  • Org-level API keys with explicit scope lists

    • 3. Assume Breach

  • Full audit logging of all admin actions
  • Anomaly detection on auth patterns
  • Automatic session revocation on suspicious activity
  • mTLS for service-to-service communication

Compliance

| Standard | Status | |----------|--------| | SOC 2 Type II | ✅ Certified | | ISO 27001 | ✅ Certified | | GDPR | ✅ Compliant | | HIPAA | 🚧 In Progress | | FedRAMP | 📋 Planned |