Security Architecture Overview
Activate is designed around Zero Trust Security principles — no user, device, or network segment is trusted by default. Every interaction, whether internal or external, is authenticated, authorised, and encrypted.
Security Principles
Zero Trust Design
Activate assumes all connections are untrusted until verified. Authentication and authorisation are required for every session and API request. Identity and access control are delegated to trusted identity providers such asMicrosoft Entra ID or Active Directory
Encrypted Communication
All communication between users, services, and the Activate database occurs over HTTPS/TLS. Unencrypted HTTP requests are automatically redirected to HTTPS.
Platform Hardening
Activate applies secure defaults that align with OWASP and Microsoft recommendations, including:
- Secure and HttpOnly cookie flags
- Strict Content Security Policy (CSP)
- Protection against Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF)
Security Alignment
These measures ensure Activate meets the standards expected of enterprise-grade, internet-facing applications.
Security configuration is applied by default and can be extended as required. For implementation details and configuration guidance, see Web Security Configuration and Defaults in the Administration section.