--- title: "Zero Trust Security" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/zero-trust/" description: "Calico enables a zero-trust environment built on three core capabilities: encryption, least privilege access controls, and defense in depth." --- Solution # Zero Trust Security Provide zero trust security with encryption, least privilege access controls, and defense in depth for cloud-native applications with Calico. [Start Free](https://www.calicocloud.io/) [Get a Demo](https://www.tigera.io/demo/) ![zerotrust](https://embed-ssl.wistia.com/deliveries/a3f7e64217dfc4b8aca695a2231bd669.jpg?image_crop_resized=612x344) ## Benefits ![Two overlapping blue parallelograms](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/05/Icon-1.png) ### Protects sensitive data, enables compliance Be compliant with corporate and regulatory data protection requirements that specify the use of encryption, including SOX, HIPAA, GDPR, and PCI. ### Automatically blocks unauthorized access Implement least privilege access control with deny-all network traffic by default, allowing only the connections that have been authorized. ### Empowers developers with self-service policy changes Helps developers maintain the security posture needed to meet compliance requirements mandated by legislation or internal security team. ## Trusted by Customers Worldwide [![Orange logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Orange.png)](http://www.orange.com/en) [![Siemens Healthineers logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-siemens-healthineers.png)](https://www.siemens-healthineers.com/) [![RBC logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-RBC.png)](https://www.rbcroyalbank.com/) [![Marsh McLennan logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Marsh-and-McLennan.png)](http://www.mmc.com/) [![Nowcom logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-NOWCOM.png)](http://www.nowcom.com/) [![Presidio logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Presidio.png)](https://www.presidio.com/) [![Box logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-box.png)](http://www.box.com/home) [![Nvidia logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Nvidia.png)](https://www.nvidia.com/) [![FM Global logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-FM-Global.png)](https://www.fmglobal.com/) [![Upwork logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-upwork.png)](https://www.upwork.com/) [![Essentra logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/04/logo-Essentra.png)](https://www.essentra.com/en) [![GoDaddy logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/03/logo-GoDaddy.png)](https://www.godaddy.com/) [![Arvato Systems logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/01/logo-Arvato-systems.png)](https://www.arvato-systems.com/) [![Aldagi logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/10/logo-aldagi.png)](https://aldagi.ge/en/) [![NBC Universal logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/logo-NBC-Universal.png)](https://www.nbcuniversal.com/) [![Chipotle logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/logo-Chipotle.png)](https://www.chipotle.com/) [![Meridianlink logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-Meridianlink.png)](http://www.meridianlink.com/) [![Mulligan Funding logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-MulliganFunding.png)](https://www.mulliganfunding.com/) [![HanseMerkur logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-HanseMerkur.png)](http://www.hmrv.de/en) [![Fiserv logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/12/logo-fiserv.png)](https://www.fiserv.com/) [![Berenberg logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-BERENBERG.png)](http://www.berenberg.de/en/) [![eHealth logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/10/logo-eHealth.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/ehealth-case-study/) [![Coinmetrics logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/03/logo-coinmetrics.png)](http://coinmetrics.io/) ## Key Features ![Calico Encryption](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/06/calico-encryption.png) ### Data-in-transit Encryption Protect sensitive data that falls under regulatory compliance mandates. Calico utilizes WireGuard to implement data-in-transit encryption. WireGuard runs as a module inside the Linux kernel and provides better performance and lower CPU utilization than IPsec and OpenVPN tunneling protocols. Calico supports WireGuard for self-managed environments such as AWS, Azure, and OpenShift, and managed services such as EKS and AKS. ![View Policy Screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2022/09/View-Policy-5.png) ### Least Privilege Access Controls Protect your application by allowing access to only the information and resources that are necessary. Calico implements least privilege access controls by denying all network traffic by default and allowing only those connections that have been authorized, including ingress and egress outside the cluster. Leverage Calico’s policy recommendation engine or define granular policies yourself to connect cluster resources externally, via application API paths and web methods. Get notifications for unauthorized attempts to connect to another service or location. ![Enforce Security Diagram](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2019/10/Enforce-Security.png) ### Defense-in-Depth Get automatic alerts for security policies changes. Calico monitors and logs all changes to policies, including the version history. The change history shows exactly what changed and is the first step in providing security forensics that provide a record identifying what happened and how. ## How It Works ![Zero Trust Workload Security / Access Controls / DNS Policy](https://embed-ssl.wistia.com/deliveries/d9c190caf09b9a4e4400b4996533d469.jpg?image_crop_resized=1184x666) ## Available on Microsoft Azure, AWS, and Google Marketplace Get started right away on Azure, AWS, or Google Cloud—every Calico component you need to get up and running is ready to go. [On Azure](https://azuremarketplace.microsoft.com/en-ca/marketplace/apps/tigerainc1620235671643.calicocloudsaas?tab=overview) [On AWS](https://aws.amazon.com/marketplace/pp/prodview-pq3tgvtlj3wce) [On Google Cloud](https://console.cloud.google.com/marketplace/product/tigera-public/calico-cloud?inv=1&invt=Ab27_g&project=tigera-public) ![Microsoft Azure, AWS, and Google Cloud logos.](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/07/Solution-cloud-marketplace-AWS-Azure-03.svg) ## Resources ![The New Model for Network Security: Zero Trust](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2020/09/ZeroTrust-network-security-Blog.png) Blog ### The New Model for Network Security: Zero Trust Calico Enterprise Zero Trust Network Security is one of the most effective ways to control access to Kubernetes networks, applications, and data [Learn More](https://www.tigera.io/blog/the-new-model-for-network-security-zero-trust/) ![O’Reilly eBook: Kubernetes Security and Observability](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2024/05/Featured-resources-OReilley-ebook.png) eBook ### O’Reilly eBook: Kubernetes Security and Observability Learn to secure Kubernetes workloads and monitor network traffic for compliance and security. [Learn More](https://www.tigera.io/blog/oreilly-ebook-kubernetes-security-and-observability-early-release/) ![Introduction to Kubernetes Networking and Security](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2023/05/Calico-Enterprise-Tigera-1200x628-1.png) Documentation ### Introduction to Kubernetes Networking and Security Read our docs and see how you can kickstart your Kubernetes journey with Calico Enterprise. [Read More](https://docs.tigera.io/calico-enterprise/latest/about/) ![Calico Logo](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/Calico-logo-2026-black-text.svg) ## Ready to Get Started? Get started for free or request a demo to see Calico in action [Start Free](https://www.calicocloud.io/) [Get a Demo](https://wordpress-1075849-4005834.cloudwaysapps.com/demo/)