Security is a core part of system design, protecting data, applications, and infrastructure from unauthorized access and threats. A secure architecture anticipates risks and applies least privilege, secure defaults, and defense in depth.

The principle of least privilege grants only the access needed, reducing the attack surface. Defense in depth uses multiple layers of protection such as firewalls, intrusion detection, and encryption to keep sensitive areas secure even if one layer fails.

Authentication verifies a user's identity using methods like passwords, biometrics, or multi-factor authentication (MFA). Authorization determines what authenticated users can do. Common approaches include role-based access control (RBAC) and attribute-based access control (ABAC), which assign permissions by role or attributes.

Privacy is preserved by securing sensitive data with encryption at rest and in transit. Fields like health or financial records should be anonymized or tokenized when the original values are not required.

Compliance means meeting legal and regulatory standards. For example, GDPR enforces data protection, the right to be forgotten, and data portability, while HIPAA requires secure storage, audit logs, and restricted access in healthcare systems.

Compliance affects technical decisions, requiring logging, data retention policies, and secure consent mechanisms. Failure to comply risks fines, legal action, and reputational damage.

Security and compliance must be built into system design from the start. Ignoring them creates vulnerabilities, legal risks, and damages user trust.