Security you can verify, not just trust.
Never Trust is our architecture and our promise: assume breach, verify every request, and prove it. This is where security, compliance, and procurement teams find the evidence to clear a vendor review — controls, attestations, policies, and the document room — for an enforcement model proven on a regulated platform that secured $15B+ in assets with zero security losses — now reimagined and rebuilt for .NET 10. Track record refers to the predecessor platform; B5 Secure’s own attestations are in progress.
Compliance posture
B5 Secure builds to recognized control frameworks and is progressing through independent attestation. Each item below shows its current, honestly-labeled status — reports are released under NDA through the document room.
A roadmap, honestly labeled, is the rigorous signal — not the gap.
The vendors who claim every certification at once are the risk. B5 Secure shows exactly where each control stands — because the controls are built and operating first, and attestation confirms what is already true.
The control set is implemented and operating today. Independent attestation verifies it — it does not create it. A report confirms the work; it is not a prerequisite for doing it.
Every per-action [Permission] and ADA decision writes an immutable, queryable authorization record — the same evidence a SOC 2, ISO 27001, or fair-lending examiner asks to see. The architecture produces the audit trail as a byproduct of enforcement.
Nothing here is asserted before it is independently verified. The FIPS 140-3 Level 3 HSM — already validated — is the standard the rest of the program is held to.
SOC 2 Type I
In progressPoint-in-time design assessment of controls, ahead of the Type II observation window.
SOC 2 Type II
In progressSecurity, Availability, and Confidentiality Trust Services Criteria. Observation period underway; report available under NDA on completion.
ISO/IEC 27001:2022
RoadmapInformation Security Management System certification. ISMS scoped; Stage 1 readiness targeted in the certification roadmap.
ISO/IEC 42001:2023
RoadmapAI Management System — the governance standard for responsible AI, aligned to our AI governance program.
PCI DSS 4.0
RoadmapDesigned to support cardholder-data environments; tokenization and segmentation patterns in place for in-scope deployments.
NIST CSF 2.0
AlignedControls mapped across Govern, Identify, Protect, Detect, Respond, and Recover.
NIST AI RMF 1.0
AlignedMap / Measure / Manage / Govern functions applied to model lifecycle and AI-assisted operations.
GDPR & UK GDPR
Programs in placeLawful-basis, data-minimization, and subject-rights processes; Data Processing Addendum available on request.
CCPA / CPRA
Programs in placeConsumer rights honored via the privacy request workflow below; no sale of personal information.
CSA STAR
RoadmapCAIQ v4 self-assessment maintained and available under NDA; STAR Level 2 on the roadmap.
FIPS 140-3 Level 3
Validated HSMSigning and key-wrapping keys are generated and held in an Azure Managed HSM validated to FIPS 140-3 Level 3, with key attestation. For on-prem and air-gapped deployments, keys live in a customer-provided FIPS 140-3 HSM via the same key-custody interface. The validation is a property of the HSM module; B5 Secure uses a validated module rather than being a separately validated cryptographic module itself.
NIST SSDF & SLSA
AlignedSecure SDLC aligned to NIST SP 800-218; build provenance targeting SLSA Level 3 with signed artifacts and SBOMs.
Risk profile
The summary answers a security reviewer asks first — where the service runs, what it touches, and how critical it is.
Security controls
The control families an enterprise review evaluates, mapped to how B5 Secure actually enforces them — the Never Trust pipeline, B5SecurityKit on .NET 10, and Azure platform services.
01Identity & Access Control
- Zero assumed trust: every request — human, service, or job — is authenticated and authorized through one pipeline.
- Adaptive MFA, passkeys / FIDO2, and PBKDF2 password hashing with a swappable algorithm.
- Least-privilege permits scoped to action and record; field-level authorization with implied-permission derivation.
- Administrative impersonation and transfer are guard-railed and fully logged.
02Encryption & Key Management
- TLS 1.3 in transit; AES-256 at rest with customer-managed keys.
- Signing keys generated and held in a FIPS 140-3 Level 3 Azure Managed HSM; keys never leave the hardware boundary.
- Multi-person control over the HSM security domain via Shamir secret sharing; policy-driven rotation.
- Crypto-agility: primitives are resolved, not hard-coded, enabling ML-KEM / ML-DSA migration without re-architecture.
03Application & Product Security
- Secure SDLC aligned to NIST SSDF: SAST, DAST, dependency, secret, and container scanning in CI.
- Request integrity via RFC 9421 HTTP Message Signatures / HMAC — canonical signing with timestamp expiry and nonce-based replay defense.
- XSS screening and context-aware output encoding across API, email, and rendering surfaces.
- Signed build artifacts and SBOM generation; provenance targeting SLSA Level 3.
04Infrastructure & Network
- Per-identity IP firewall and origin allow-listing bind sensitive credentials to known networks.
- Confidential computing — AMD SEV-SNP and Intel TDX enclaves — protect data in use for the most sensitive operations.
- Hardware root of trust and attestation; secrets held in Azure Key Vault, never in source or config.
- Deny-by-default segmentation with an adaptive identity-firewall layer over the static core.
05Monitoring, Logging & Detection
- Every request is logged with the signals needed to surface replay, credential abuse, and call-back attempts.
- Microsoft Sentinel SIEM and Defender XDR for correlation, alerting, and threat detection.
- Continuous Access Evaluation revokes active sessions in near-real-time when risk changes.
- Tamper-evident audit trails retained per policy and available to authorized reviewers.
06Vulnerability & Threat Management
- Continuous dependency and container scanning with severity-prioritized remediation SLAs.
- Third-party penetration testing annually and on major release; executive summary available under NDA.
- GitHub Advanced Security and secret scanning across repositories.
- Coordinated disclosure program with safe harbor (see Disclosure).
07Business Continuity & Recovery
- Active-active multi-region with automated failover; cyber-recovery vault for ransomware resilience.
- Recovery objectives: RPO < 5 minutes, RTO < 30 minutes for critical services.
- Backups encrypted, region-redundant, and restore-tested.
- BCP / DR plan reviewed and exercised at least annually.
08Risk, Vendor & Personnel
- Documented risk-assessment process with periodic review and treatment tracking.
- Subprocessor due diligence and a maintained, published subprocessor inventory.
- Background screening, least-privilege access provisioning, and prompt deprovisioning.
- Annual security-awareness training and acceptable-use, access-control, and incident-response policies.
AI governance
Where B5 Secure applies AI to security operations, it is governed to NIST AI RMF and ISO/IEC 42001, with EU AI Act readiness — explainable, traceable, and under human oversight.
AIModel lifecycle governance
- Model inventory with documented purpose, owner, data lineage, and risk classification.
- Bias, drift, and performance monitoring with alerting on degradation.
- Human-in-the-loop on consequential decisions; no unsupervised enforcement actions.
- Immutable AI audit trails capturing inputs, model version, and outcome for review.
AIData & model protection
- Training and inference data handled under the same least-privilege and encryption controls as platform data.
- Prompt-injection and model-manipulation defenses on AI-assisted surfaces.
- Confidential computing for sensitive inference; tenant isolation maintained.
- Explainability and traceability sufficient to support regulatory reporting.
Document room
Everything an enterprise security review typically requests, in one place. Public items are downloadable now; NDA-gated items are released after a short access request and email verification.
To request NDA-gated documents, email security@b5secure.com with your name, company, and review purpose. Access is granted per document after verification.
Data privacy
B5 Secure honors data-subject rights under GDPR and CCPA/CPRA. Submit a request to privacy@b5secure.com and we will verify and respond within the statutory window.
Data Processing Addendum, retention schedule, and records of processing are available on request. See also our Privacy Policy and Cookies Policy.
Availability & resilience
Engineered for a security control plane that customers depend on — with published targets and a live status page.
Real-time service status, uptime history, and incident notifications are published on the status page. Security incidents are handled under a documented, annually-tested Incident Response Plan, with customer notification per contractual and regulatory obligations.
Report a vulnerability
We welcome good-faith security research. Report suspected vulnerabilities to security@b5secure.com — a PGP key is available on request.
Running a security review? Start here.
Request the documents you need, or talk to our security team directly. The same Never Trust pipeline that secures $15B+ in assets is ready for your due diligence.
Q4 2026 roadmap extensions
These capabilities are specified and not yet released. Each page carries its status from the Product Truth Registry.