Security & Compliance
Enterprise security, built in from day one
Granular access control, encrypted secrets, comprehensive audit trails, and network security. Everything you need to meet compliance requirements and keep your infrastructure secure.
Access Control
Granular permissions for every team member
Substrate's role-based access control gives you fine-grained control over who can do what in your infrastructure. Assign roles at the organization, project, or individual resource level, and create custom roles tailored to your team's workflow.
- Organization, project, and resource-level permissions
- Custom roles with fine-grained actions
- Team member management with role assignment
- Permission inheritance and overrides
Permission Matrix
| Role | Clusters | Deploy | Secrets | Billing | Members |
|---|---|---|---|---|---|
| Owner | |||||
| Admin | — | ||||
| Developer | — | — | — | — | |
| Viewer | — | — | — | — | — |
DATABASE_URL
Production
STRIPE_SECRET_KEY
Production
AWS_ACCESS_KEY
Organization
OLD_API_KEY
Staging
Secrets Management
Encrypted secrets, zero exposure
Store sensitive credentials, API keys, and connection strings with AES-256 encryption at rest. Substrate manages the full lifecycle of your secrets, from creation and rotation to revocation, with every access logged for compliance.
- AES-256 encryption at rest
- Scoped to organization, project, or account
- Secret rotation with zero downtime
- Status management (active, disabled, revoked)
- Audit logging for every secret access
Audit Trails
Every action, logged and searchable
Substrate records every API call, configuration change, and access event with complete context. Built for compliance auditors who need proof and engineers who need answers fast.
Multi-Factor Authentication
MFA for every account
Protect every account with time-based one-time passwords (TOTP) using any standard authenticator app. Organization administrators can enforce MFA policies to ensure every team member has a second factor enabled before accessing infrastructure.
- TOTP authenticator app support
- Backup codes for account recovery
- Enforced MFA policies across organizations
- Secure session management with configurable expiry
Enter verification code
Open your authenticator app
Firewall Rules
Allow Office VPN
10.0.0.0/8
Allow CI Pipeline
203.0.113.0/24
Allow Monitoring
192.168.1.0/24
Legacy Access
172.16.0.0/16
Network Security
Firewall rules at the cluster level
Define IP-based firewall rules that control access to your Kubernetes API servers. Substrate syncs firewall rules with your cloud provider's native security groups, so you get defense in depth without managing multiple configuration surfaces.
- IP and CIDR-based firewall rules
- Protocol and port configuration
- Cloud provider firewall sync
- Rule enable and disable without deletion
Help improve Substrate's recommendations
When you create an organisation we ask you one question, on its own step, before you finish setting up:
“May Substrate use de-identified measurements of this organisation's infrastructure to improve the sizing models we serve to other customers?”
The setting is presented to you switched on, and you can switch it off on that step or at any time afterwards.
You can turn this off at any time in Settings. Turning it off is retroactive: your organisation's contribution is removed and is excluded from every training run after that point, and we keep a dated record of that so it can be checked rather than taken on trust.
Models trained across more than one customer see aggregated, de-identified measurements only. Your organisation, your accounts and your individual resources are replaced with keyed pseudonyms, and no name, tag, account number or identifier forms part of what a model sees. The following are never included, in any form:
- Your application data, of any kind
- Filesystem or database contents
- The text of AI prompts or completions
- Credentials, keys or secrets
Consent policy version 2026-09-24.v1. We record which version you answered, and when, so that what you agreed to is a matter of record rather than of memory.
Secure your infrastructure today
Enterprise-grade security is included in every Substrate plan. Start with RBAC, secrets management, and audit trails from day one.
Start free