Introduction

B5 Secure is a Never Trust security framework for .NET web applications and APIs. It helps you rapidly build secure, easily maintainable hosted services — microservices, API platforms, MVC apps and serverless functions — on a foundation that grants access only on explicit, verified evidence.

The framework was engineered from scratch on the Never Trust model (zero assumed trust) and has been proven in production: it is the security spine behind ISCP, the Investor Services Cloud Platform that A8 Core™ was reimagined and rebuilt from, protecting more than $15B in assets under custody and millions of accounts.

Two forms

B5 Secure ships in two complementary forms so you can adopt it at the depth your project needs:

• Library — reference the B5 Secure NuGet packages and wire the framework into your application. The fastest way to add the pipeline, authentication and authorization.
• Source packages — installable source you own and extend (Essential, Starter and Premium grades). You get the security subsystem as code in your solution, ready to adapt to your domain.

Supported platforms

B5 Secure targets .NET 10 LTS (C# 14) and runs every API surface behind one Never Trust pipeline in a single host:

• ASP.NET Core minimal APIs — REST + GraphQL
• ASP.NET Core MVC & Web API
• Co-hosted ServiceStack v10 — request-DTO services upgraded in place, mounted inside the ASP.NET Core host
• .NET Framework (MVC5 / Web API) — supported via multi-targeting during migration

How to read these docs

Start with Getting started to build a small multi-tenant CRM on your platform of choice, then read Key Concepts and The Security Pipeline for the mental model. The API Reference documents every library type.