As uncompromising as the 5th basement level.
“B5” is the fifth basement level of the Federal Reserve Bank of New York’s gold vault — the world’s largest known depository of monetary gold. It rests on Manhattan bedrock 80 feet below street level, behind a 90-ton steel door, with every compartment sealed by three independent locks and an auditor’s seal.
B5 Secure holds your API to the same standard: layered, independent checks, and access granted only on explicit, verified evidence — never on assumption.
- Defense in depth — many independent layers, like the vault’s three locks per compartment.
- Access on evidence only — absence of evidence is absence of access.
- Continuous oversight — every movement watched, logged and auditable.
- Sealed by default — closed until an explicit, verified action opens it.
Six principles of Never Trust.
Think like an attacker; defend like the vault. B5 Secure builds these into the framework so the secure path is the default path.
Assume breach by default
Design every endpoint as if the next caller is the attacker — and decide accordingly.
Verify every request
No God-mode flags, no internal-only shortcuts. Every request runs the full series of checks.
Least privilege, per action
Grant only what an action needs. A leaked read key can never become an admin.
Return the minimum data
Default to summary views; require explicit privilege to widen the response.
Detect through logging
Log and monitor every request so abuse and replay surface as they happen.
Secure the whole environment
Pin and hash dependencies, lock down access, treat third-party code as untrusted.
Every request runs the full gauntlet.
Each request must clear every applicable layer — explicitly — before it reaches your business logic. Like the vault, the deepest layer (B5) is the strongest: data-aware authorization.
XSS screening
Inbound payloads inspected for script injection before anything is processed.
Authentication
HMAC, Service-HMAC, AuthCookie or Service-Key, with identity, origin and key validation.
IP firewall & MFA
Networks outside the allow-list denied; step-up verification on high-impact actions.
Verification & suspension
Unverified, suspended or expired identities stopped before authorization.
Activity-data authorization (ADA)
The deepest layer — an explicit permit for this exact action and this exact record.
A complete Never Trust toolkit.
HMAC & Service-HMAC
Signed, integrity-checked requests with timestamp expiry and replay prevention — bound to a single operation and record.
AuthCookie & Service-Key
Browser-session and machine-to-machine schemes for every integration, each scoped and revocable.
Activity-data authorization
Authorize the operation and the data it touches — by default, with little code, fully overridable.
Multi-factor authentication
Per-action, per-identity step-up that protects privileged endpoints without slowing everything down.
IP firewall & origin restriction
Lock sensitive keys and admin sessions to known networks; reject spoofable signals as decisions.
Suspension
User- and entity-level suspension for advanced workflows, enforced inside the pipeline.
First-class support across .NET 10.
B5 Secure targets .NET 10 LTS (C# 14) and runs every API surface behind one Never Trust pipeline in a single host.
ASP.NET Core minimal APIs
REST and GraphQL endpoints secured by HMAC and ADA from the first route.
ASP.NET Core MVC & Web API
Convention-driven authorization across controllers, actions and data.
Co-hosted ServiceStack v10
Request-DTO services upgraded in place, mounted inside the ASP.NET Core host.
.NET 10 LTS · multi-target
C# 14 on .NET 10, with .NET Framework (MVC5 / Web API) supported during migration.
The Never Trust pipeline, extended.
Every stage keeps its proven behavior and gains a standards-aligned 2026 capability — additive, flag-gated, behavior-preserving. The code library ships as B5SecurityKit on .NET 10.
HMAC signing
2026: RFC 9421 HTTP Message Signatures, an ML-DSA (FIPS 204) post-quantum option, and HSM keys by reference.
Multi-factor
2026: FIDO2 / WebAuthn passkeys, TOTP (RFC 6238) and risk-based step-up.
Granular authorization
2026: an OpenID AuthZEN 1.0 PEP to OpenFGA (ReBAC) or Cedar/Cerbos (PBAC) — ADA stays the default.
IP firewall
2026: an adaptive identity firewall — geo/ASN, threat-intel feeds, rate limits, device posture, WAF.
Rules-based suspension
2026: a policy engine (Cedar/Rego), Continuous Access Evaluation and Sentinel automation.
Standards we speak
RFC 9421 · FIDO2 · AuthZEN 1.0 · OpenFGA · Cedar/Rego · CAE · ML-DSA. Explore the extensions →
The security spine behind 2M+ accounts and $15B+ in assets.
B5 Secure is the engine that protected ISCP — the Investor Services Cloud Platform, today A8 Core™ — in production for years, now reimagined and rebuilt onto .NET 10.
Production metrics reflect the ICP→ISCP→A8 Core™ lineage secured by this framework.
Hold your API to the vault standard.
Start a trial, read the Never Trust whitepaper, or talk to us about securing your platform end to end.
Turn every API call into a verifiable trust decision.
Start with B5 concepts, exercise isolated test mode, make a first protected call, and use the developer tools, samples, use cases, and step-by-step guides to move toward release-gated production.
Start building with B5 Secure