Our security commitment
ButterCMS prioritizes security and compliance by hosting on secure AWS data centers, implementing data encryption, conducting daily backups, adhering to industry standards, monitoring infrastructure 24/7, and offering professional support for security-related concerns.ButterCMS Security Principles:
- Security by Design - Security is built into every layer of our platform
- Defense in Depth - Multiple overlapping security controls
- Continuous Monitoring - 24/7 infrastructure monitoring and threat detection
- Data Protection - Industry-standard encryption at rest and in transit
- Compliance First - Adherence to leading security frameworks and standards
Security architecture
ButterCMS handles all aspects of security for you. Data is encrypted at rest (AES-256) and in transit (TLS 1.2), hosted in ISO 27001-certified data centers. See Infrastructure & Hosting for network controls, WAF configuration, and DDoS protection details.Security layers
| Layer | Protection |
|---|---|
| Application | Web Application Firewall (WAF), rate limiting, input validation |
| Transport | TLS 1.2+ encryption, HTTP Strict Transport Security (HSTS) |
| Authentication | SSO, MFA, role-based access control |
| Data | AES-256 encryption at rest, encrypted backups |
| Infrastructure | AWS security groups, VPC isolation, 24/7 monitoring |
| Physical | ISO 27001 certified data centers, physical access controls |
Session security
ButterCMS implements secure session handling:| Feature | Description |
|---|---|
| Session timeout | Automatic logout after inactivity |
| Secure cookies | HttpOnly, Secure, and SameSite flags applied |
| Session invalidation | Logging out terminates the session immediately |
| Concurrent sessions | Multiple devices are supported |
Secure access practices
- Log out when using shared or public computers
- Do not check “Remember Me” on shared devices
- Review active sessions periodically
- Report any suspicious activity immediately
Brute force protection
ButterCMS protects against brute force attacks:| Protection | Description |
|---|---|
| Login rate limiting | Limits login attempts per time period |
| Progressive delays | Increasing wait times after failed attempts |
| Account lockout | Temporary lockout after repeated failures |
| IP blocking | Suspicious IPs may be temporarily blocked |
If you’re locked out due to too many failed attempts, wait a few minutes before trying again, or use the password reset option.
Key security features
Encryption
AES-256 encryption at rest and TLS 1.2 in transit protect your data
Access Control
Role-based permissions and SSO integration for enterprise teams
Monitoring
24/7 infrastructure monitoring with automated threat detection
Backups
Automatic daily backups ensure data redundancy and recovery
Fully managed security
ButterCMS is a closed-source, fully-hosted platform. This means you don’t have to worry about maintaining servers, applying security patches, or managing infrastructure. Our team handles all security operations, including:- Applying security updates and patches
- Monitoring for vulnerabilities
- Managing SSL certificates
- Conducting security assessments
- Responding to security incidents
Security for enterprise
For enterprise applications, ButterCMS offers advanced security controls, including:- Advanced security controls - Enhanced security features for enterprise requirements
- Dedicated support - Enterprise support with a dedicated customer success manager
- Compliance support - Help meeting enterprise compliance requirements
Enterprise security features
| Feature | Description |
|---|---|
| Single Sign-On (SSO) | SAML 2.0 integration with Azure AD, Okta, Google, OneLogin |
| Custom Roles | Define granular permissions for your team |
| Audit Logs | Track all user activity and content changes |
| Access Logs | Monitor API access patterns |
| Dedicated Support | Priority access to security expertise |
Contact Enterprise Sales
Learn about enterprise security features and get a custom security assessment
Reporting security issues
Responsible disclosure
If you discover a potential security vulnerability in ButterCMS, we encourage responsible disclosure. Please contact our security team:- Email: security@buttercms.com
- Support: Use the in-app chat or email support@buttercms.com
Security resources
Infrastructure & Hosting
Learn about our hosting environment and infrastructure security
Data Protection
Understand how your data is encrypted and protected
Access & Authentication
Explore authentication options including SSO and MFA
Compliance Certifications
View our compliance certifications and standards