Security & Compliance
Enterprise security, built in from day one
Granular access control, encrypted secrets, comprehensive audit trails, and network security. Everything you need to meet compliance requirements and keep your infrastructure secure.
Access Control
Granular permissions for every team member
Substrate's role-based access control gives you fine-grained control over who can do what in your infrastructure. Assign roles at the organization, project, or individual resource level, and create custom roles tailored to your team's workflow.
- Organization, project, and resource-level permissions
- Custom roles with fine-grained actions
- Team member management with role assignment
- Permission inheritance and overrides
Permission Matrix
| Role | Clusters | Deploy | Secrets | Billing | Members |
|---|---|---|---|---|---|
| Owner | |||||
| Admin | — | ||||
| Developer | — | — | — | — | |
| Viewer | — | — | — | — | — |
DATABASE_URL
Production
STRIPE_SECRET_KEY
Production
AWS_ACCESS_KEY
Organization
OLD_API_KEY
Staging
Secrets Management
Encrypted secrets, zero exposure
Store sensitive credentials, API keys, and connection strings with AES-256 encryption at rest. Substrate manages the full lifecycle of your secrets, from creation and rotation to revocation, with every access logged for compliance.
- AES-256 encryption at rest
- Scoped to organization, project, or account
- Secret rotation with zero downtime
- Status management (active, disabled, revoked)
- Audit logging for every secret access
Audit Trails
Every action, logged and searchable
Substrate records every API call, configuration change, and access event with complete context. Built for compliance auditors who need proof and engineers who need answers fast.
Multi-Factor Authentication
MFA for every account
Protect every account with time-based one-time passwords (TOTP) using any standard authenticator app. Organization administrators can enforce MFA policies to ensure every team member has a second factor enabled before accessing infrastructure.
- TOTP authenticator app support
- Backup codes for account recovery
- Enforced MFA policies across organizations
- Secure session management with configurable expiry
Enter verification code
Open your authenticator app
Firewall Rules
Allow Office VPN
10.0.0.0/8
Allow CI Pipeline
203.0.113.0/24
Allow Monitoring
192.168.1.0/24
Legacy Access
172.16.0.0/16
Network Security
Firewall rules at the cluster level
Define IP-based firewall rules that control access to your Kubernetes API servers. Substrate syncs firewall rules with your cloud provider's native security groups, so you get defense in depth without managing multiple configuration surfaces.
- IP and CIDR-based firewall rules
- Protocol and port configuration
- Cloud provider firewall sync
- Rule enable and disable without deletion
Secure your infrastructure today
Enterprise-grade security is included in every Substrate plan. Start with RBAC, secrets management, and audit trails from day one.
Start free