Zero Trust in SaaS Applications: From Theory to Practice

Zero Trust is an assumption, not a product

"Zero Trust" has lately become a phrase printed on the box of every security product. But at heart it's a simple idea: being inside the network doesn't make you trustworthy. Whether a request comes from the company VPN or from a signed-in user, it gets verified again every time.

In a system like PlusTurk, which holds law firms' debt collection files and hospitals' patient appointments, working on this assumption isn't optional, because the cost of a leak is very high.

What it means in practice

1. Identity and permission checks on every request

Being signed in doesn't mean a user can see everything. In PlusTurk the agent, unit manager and company owner roles are defined separately, and even the permission to see a phone number is managed on its own.

async function canViewPhoneNumber(userId: string, recordId: string) {
  const user = await getUser(userId);
  if (user.role === "FIRM_OWNER") return true;
  if (user.role === "UNIT_MANAGER") return belongsToUnit(user, recordId);
  return false; // agents can't see it by default
}

2. Never storing secrets in plain text

Virtual POS and SMS provider API credentials are stored encrypted and are never written back to the screen. Not even an administrator can say "show me the API key"; they can only say "generate a new one". That reduces risk from both inside and outside.

3. Activity history and traceability

Who viewed which file and when, who created which payment link: all of it is logged. Part of Zero Trust is being able to look back when something goes wrong.

4. Closed by default

When I add a new feature, the default permission level is always "least privilege". Unless explicitly granted otherwise, an agent can't access anything. That removes the risk of a security hole caused by someone forgetting.

5. Two-factor authentication

2FA is mandatory, especially for accounts with broad permissions such as the company owner. Even if a password leaks, it isn't enough on its own.

What this means for a small team

You don't need a big security team to set up Zero Trust. What you need is to ask one question every time you add a feature: "Who really needs access to this information, and how do I verify it?" Ask it from the start, and you won't have to patch security in later.

Conclusion

Zero Trust isn't something you buy and install. It's a discipline you keep up in every line of code. I designed it into PlusTurk from the very beginning, because adding it later is both more expensive and riskier.