Security

Secure platform access, API traffic and the data that flows through your environments.

Get started

Generated passwords, inactive auto-created channels and an audit log that records traffic from the first request.

Security defaults

Platform access

Security defaults Generated passwords, inactive auto-created channels and an audit log that records traffic from the first request. Dashboard authentication Control who signs in to the Dashboard, with built-in accounts or Microsoft Entra ID. Changing passwords Set your own passwords for the Dashboard, SSH and IDE users.

API traffic

Channel security Authenticate the API traffic that reaches your channels. Outgoing connections Authenticate Zato to the systems that your outgoing connections call. SSL/TLS Encrypt API and Dashboard traffic with your own or generated certificates. Rate limiting and firewall Control how much traffic any one caller sends and block abusive addresses. Quota tiers Apply one named rate-limit plan to any number of API clients.

Checklists

Security checklist Work through the security decisions an environment needs before it goes live. Ports and network Decide which ports to publish, which to keep closed and what outbound access to allow. Cryptography and secrets Generate secrets, encrypt data and hash passwords with the built-in crypto API.

Compliance

PII (GDPR, HIPAA, PDPA) Meet data protection obligations with the platform's controls for personal data. SBOM Inspect the exact package versions that a Zato installation runs.