Forty-two whitepapers. One vault.
Every block of the B5 Secure pipeline — and every 2026 extension — drills down to a full, architect-voice whitepaper. Forty-two papers across four series, from the Never Trust mindset to hardware-rooted cryptography, each grounded in the same proof point: $15B+ in assets protected and secure, zero losses.
Never Trust
Six principles of the Never Trust posture — think like an attacker, defend like the vault.
Assume Breach by Default
Design as though the attacker is already the one calling your endpoint. The most dangerous vulnerabilities are not exotic exploits — they are conveniences that behave exactly as built, for the wrong c
Read the whitepaper →Aggressively Verify Every Request
Zero assumed trust means every request earns its access through the full series of checks — no undocumented switches, no internal-only exemptions. Absence of evidence must always mean absence of acces
Read the whitepaper →Grant Least-Privilege Access
A dashboard that only reads data needs only read permits. Scope every credential to the action and the record it serves, so a leaked key opens a few endpoints — not your whole platform.
Read the whitepaper →Limit the Data You Return
APIs tend to return whole records; clients need a fraction. Default to summary responses and require explicit privilege to widen them — the single most effective brake on record-scraping.
Read the whitepaper →Detect Through Continuous Logging
Log and monitor every request. Replay attempts, credential abuse, and phishing call-backs all show up in the logs — if you are recording the right signals and watching them.
Read the whitepaper →Secure the Whole Environment
Pin and hash dependencies, prefer audited packages, lock down inbound and outbound network access, and keep secrets in a vault. The application is only as trustworthy as the ground it runs on.
Read the whitepaper →Features
Twenty-five capabilities of B5SecurityKit, from XSS screening at B1 to activity-data authorization at B5.
XSS Protection
Detect and resist XSS injection and sanitize untrusted data wherever it lands — emails, API payloads, and both front-end and back-end rendering — by encoding for the output context so a value meant as
Read the whitepaper →Authentication
Securely connect browsers, mobile apps, IoT devices, background jobs, and third parties through one pipeline that supports multiple schemes and identity types — so every caller is verified the same wa
Read the whitepaper →IP Firewall
Restrict access to trusted networks or machines, applied equally to API keys and high-privileged user sessions. Bind sensitive credentials to known address ranges so a leaked key is useless from anywh
Read the whitepaper →Multi-Factor Authentication
Enforce multi-factor verification as policy rather than per-controller code, then selectively exempt specific users, operations, or trusted networks. The second factor is required where the risk is, a
Read the whitepaper →User Account Verification
Limit what an account can do until its email or mobile number is verified, backed by an end-to-end verification workflow — with chosen operations exempted so onboarding is never fully blocked.
Read the whitepaper →Activity-Data Authorization
Authorize not just the action but the specific data it touches, down to individual records and fields. Conventions derive permission codes and flag sensitive fields automatically, so authorization sta
Read the whitepaper →Suspension
Suspend a whole user, or a single operation on a single entity such as an account or contact, in response to KYC, fraud, or OFAC signals — while still permitting chosen operations. Revocation takes ef
Read the whitepaper →HMAC
Every request carries a keyed HMAC signature over its canonical form, with a timestamp expiry window and nonce-based replay prevention. The signature proves both the caller’s identity and that the pay
Read the whitepaper →Service-HMAC
Machine-to-machine HMAC that can be bound to specific values — a particular record id, say — and carries its own expiry, so a signed service call is scoped to exactly the operation and object it was i
Read the whitepaper →Service-Key
Scoped API keys that grant an integration only the endpoints it actually needs and nothing more — least privilege at the credential level keeps a compromised key’s blast radius small.
Read the whitepaper →AuthCookie
Browser-session authentication with sensitive-key protection and origin restriction, so the session cookie is hardened against theft and cross-site reuse and kept out of JavaScript’s reach.
Read the whitepaper →Identities
Site-to-site keys, feature keys, and user sessions are all first-class identities, each authenticated and authorized through the same pipeline — one model for humans and machines, with no second, weak
Read the whitepaper →Replay & Tamper Protection
Request integrity checks and short expiration windows defeat replayed or tampered calls: a captured request cannot be resent, and any change to its contents invalidates the signature.
Read the whitepaper →Account Management
A complete account lifecycle out of the box — registration, login, two-factor, forgot-password, account settings, IP-firewall management, and email verification — so the security-sensitive flows ship
Read the whitepaper →User Management
Add, remove, and suspend users; manage the permits and permissions that decide what each one may do — the administrative surface behind least-privilege access.
Read the whitepaper →Administration
Impersonation and transfer (adopt) — the highest-trust administrative actions — with the guardrails that keep them accountable.
Read the whitepaper →Security Notifications
Event notifications for security-relevant actions — so the people who should know about a change find out in time to act on it.
Read the whitepaper →Professional Error Handling
Production-ready error handling that does not leak internals — full diagnostics where your team can see them, and nothing useful to an attacker in the response.
Read the whitepaper →Source Packages
Models, views, controllers, and endpoints with async, managers, and dependency injection baked in — the secure patterns delivered as source you can read, extend, and own.
Read the whitepaper →Strong Password Hashing
PBKDF2 salted hashing to defeat dictionary and rainbow-table attacks — with the algorithm swappable, so your defenses keep pace as hardware does.
Read the whitepaper →Password / Credential Blocking
Detect and protect data when credentials are compromised — so a password known to be breached becomes a closed door rather than an open one.
Read the whitepaper →Request Integrity & Expiration
Defeat tampering, man-in-the-middle, and replay attacks, and define how long a request may live — so a captured or altered call is rejected, not executed.
Read the whitepaper →Integrator Identification
Reject connections from clients outside the origin allow-list — so unrecognized callers never reach the parts of the system meant for known integrators.
Read the whitepaper →Key-Leakage Protection
Stop sensitive API keys from being used from browsers or non-allow-listed IPs — so a key that escapes into client code or an attacker’s infrastructure simply stops working.
Read the whitepaper →Feature Hiding
Show menus, actions, and pages by privilege level through permission-based authorization — so the interface reflects what a user is actually allowed to do.
Read the whitepaper →Advanced Cryptography
Hardware-rooted, crypto-agile, post-quantum-ready — FIPS 140-3 Level 3 and beyond.
FIPS 140-3 Level 3
Signing keys live in an Azure Key Vault Managed HSM — a single-tenant module validated to FIPS 140-3 Level 3, with key attestation proving provenance inside the hardware boundary. B5 Secure signs by r
Read the whitepaper →Multi-Person Control
The HSM security domain is split across a quorum of key holders by Shamir’s secret sharing — no single individual can export or recover key material, and rotation is policy-driven, not manual.
Read the whitepaper →Confidential by Default
Encryption at rest with customer-managed keys, TLS 1.3 in transit, and confidential computing — AMD SEV-SNP, Intel TDX — to protect the most sensitive operations even while data is being processed.
Read the whitepaper →Security Extensions
Every stage keeps its proven behavior and gains a standards-aligned 2026 capability.
HMAC Request Signing
Today: a keyed HMAC over the URL, method, body, timestamp, nonce, and AuthUrn. The 2026 edge keeps the same contract while making it crypto-agile — so the move to post-quantum signing is a configurati
Read the whitepaper →Multi-Factor (Extensions)
Today: a pipeline-enforced second factor with email codes and per-session or inactivity expiry. The 2026 edge moves toward phishing-resistant factors and risk-adaptive prompts — without changing where
Read the whitepaper →Granular Authorization
Today: activity-data authorization — activity-based, data-aware, convention-driven, with implied permissions. The 2026 edge externalizes the decision to a policy engine only for the operations where r
Read the whitepaper →IP Firewall (Extensions)
Today: static IP allow-lists per identity, enforced across the pipeline. This strict core is the foundation the adaptive identity firewall layers on — the deny-by-default ground truth that never moves
Read the whitepaper →Rules-Based Suspension
Today: user and entity suspension with hierarchy-aware exclusion rules. The 2026 edge moves those rules into a versioned policy engine and pairs them with continuous access evaluation.
Read the whitepaper →Co-Hosted, One Host
All of it runs behind a single B5 Secure pipeline on .NET 10 — ASP.NET Core minimal APIs and GraphQL alongside co-hosted ServiceStack — so one security contract governs every surface, old and new.
Read the whitepaper →Adaptive Identity Firewall
The static allow-list stays the strict core. Layered on top: geo and ASN rules, auto-expiring threat-intelligence deny feeds, per-identity and per-endpoint rate limits, and device signals — an adaptiv
Read the whitepaper →Policy-Driven Suspension & CAE
Your hierarchy-aware exclusion rules move into a versioned policy engine (Cedar / Rego), and Continuous Access Evaluation revokes active sessions in near-real-time — closing the gap between a decision
Read the whitepaper →Hold your API to the vault standard.
Start free, or talk to us about securing your platform end to end — the same Never Trust pipeline behind every paper on this page.