Security Architecture Overview

activate is designed around zero trust security principles — no user, device, or network segment is trusted by default every interaction, whether internal or external, is authenticated, authorised, and encrypted security principles zero trust design activate assumes all connections are untrusted until verified authentication and authorisation are required for every session and api request identity and access control are delegated to trusted identity providers such as {{microsoft entra id}} or {{active directory}} encrypted communication all communication between users, services, and the activate database occurs over https/tls unencrypted http requests are automatically redirected to https platform hardening activate applies secure defaults that align with owasp and microsoft recommendations, including secure and httponly cookie flags strict content security policy (csp) protection against cross site scripting (xss) and cross site request forgery (csrf) security alignment these measures ensure activate meets the standards expected of enterprise grade, internet facing applications security configuration is applied by default and can be extended as required for implementation details and configuration guidance, see web security configuration and defaults in the administration section