ButterCMS takes security and compliance seriously. The platform is hosted on Heroku and AWS infrastructure adhering to industry-leading compliance standards, with automatic daily backups and continuous 24/7 monitoring.Documentation Index
Fetch the complete documentation index at: https://buttercms.com/docs/llms.txt
Use this file to discover all available pages before exploring further.
Our security commitment
ButterCMS prioritizes security and compliance by hosting on secure AWS data centers, implementing data encryption, conducting daily backups, adhering to industry standards, monitoring infrastructure 24/7, and offering professional support for security-related concerns.ButterCMS Security Principles:
- Security by Design - Security is built into every layer of our platform
- Defense in Depth - Multiple overlapping security controls
- Continuous Monitoring - 24/7 infrastructure monitoring and threat detection
- Data Protection - Industry-standard encryption at rest and in transit
- Compliance First - Adherence to leading security frameworks and standards
Security architecture
ButterCMS handles all aspects of security for you. Data is encrypted at rest (AES-256) and in transit (TLS 1.2), hosted in ISO 27001-certified data centers. See Infrastructure & Hosting for network controls, WAF configuration, and DDoS protection details.Security layers
| Layer | Protection |
|---|---|
| Application | Web Application Firewall (WAF), rate limiting, input validation |
| Transport | TLS 1.2+ encryption, HTTP Strict Transport Security (HSTS) |
| Authentication | SSO, MFA, role-based access control |
| Data | AES-256 encryption at rest, encrypted backups |
| Infrastructure | AWS security groups, VPC isolation, 24/7 monitoring |
| Physical | ISO 27001 certified data centers, physical access controls |
Session security
ButterCMS implements secure session handling:| Feature | Description |
|---|---|
| Session timeout | Automatic logout after inactivity |
| Secure cookies | HttpOnly, Secure, and SameSite flags applied |
| Session invalidation | Logging out terminates the session immediately |
| Concurrent sessions | Multiple devices are supported |
Secure access practices
- Log out when using shared or public computers
- Do not check “Remember Me” on shared devices
- Review active sessions periodically
- Report any suspicious activity immediately
Brute force protection
ButterCMS protects against brute force attacks:| Protection | Description |
|---|---|
| Login rate limiting | Limits login attempts per time period |
| Progressive delays | Increasing wait times after failed attempts |
| Account lockout | Temporary lockout after repeated failures |
| IP blocking | Suspicious IPs may be temporarily blocked |
If you’re locked out due to too many failed attempts, wait a few minutes before trying again, or use the password reset option.
Key security features
Encryption
AES-256 encryption at rest and TLS 1.2 in transit protect your data
Access Control
Role-based permissions and SSO integration for enterprise teams
Monitoring
24/7 infrastructure monitoring with automated threat detection
Backups
Automatic daily backups ensure data redundancy and recovery
Fully managed security
ButterCMS is a closed-source, fully-hosted platform. This means you don’t have to worry about maintaining servers, applying security patches, or managing infrastructure. Our team handles all security operations, including:- Applying security updates and patches
- Monitoring for vulnerabilities
- Managing SSL certificates
- Conducting security assessments
- Responding to security incidents
Security for enterprise
For enterprise applications, ButterCMS offers advanced security controls, including:- Advanced security controls - Enhanced security features for enterprise requirements
- Dedicated support - Enterprise support with a dedicated customer success manager
- Compliance support - Help meeting enterprise compliance requirements
Enterprise security features
| Feature | Description |
|---|---|
| Single Sign-On (SSO) | SAML 2.0 integration with Azure AD, Okta, Google, OneLogin |
| Custom Roles | Define granular permissions for your team |
| Audit Logs | Track all user activity and content changes |
| Access Logs | Monitor API access patterns |
| Dedicated Support | Priority access to security expertise |
Contact Enterprise Sales
Learn about enterprise security features and get a custom security assessment
Reporting security issues
Responsible disclosure
If you discover a potential security vulnerability in ButterCMS, we encourage responsible disclosure. Please contact our security team:- Email: security@buttercms.com
- Support: Use the in-app chat or email support@buttercms.com
Security resources
Infrastructure & Hosting
Learn about our hosting environment and infrastructure security
Data Protection
Understand how your data is encrypted and protected
Access & Authentication
Explore authentication options including SSO and MFA
Compliance Certifications
View our compliance certifications and standards