---
title: Security Architecture Overview
slug: security-architecture-overview
docTags: 
createdAt: 2025-11-03T21:35:24.583Z
---

Activate is designed around **Zero Trust Security** principles — no user, device, or network segment is trusted by default.
Every interaction, whether internal or external, is authenticated, authorised, and encrypted.

# Security Principles

## Zero Trust Design

Activate assumes all connections are untrusted until verified.
Authentication and authorisation are required for every session and API request.
Identity and access control are delegated to trusted identity providers such asMicrosoft Entra ID  or Active Directory 

## Encrypted Communication

All communication between users, services, and the Activate database occurs over **HTTPS/TLS**.
Unencrypted HTTP requests are automatically redirected to HTTPS.

## Platform Hardening

Activate applies secure defaults that align with **OWASP** and **Microsoft** recommendations, including:

- Secure and HttpOnly cookie flags
- Strict **Content Security Policy** (CSP)
- Protection against **Cross-Site Scripting (XSS)** and **Cross-Site Request Forgery (CSRF)**

## Security Alignment

These measures ensure Activate meets the standards expected of enterprise-grade, internet-facing applications.

:::hint{type="info"}
Security configuration is applied by default and can be extended as required.
For implementation details and configuration guidance, see **Web Security Configuration and Defaults** in the Administration section.
:::