--- title: "Secure and Govern" description: "One enforcement point for every API, LLM, and MCP call. Policies live in Git, run at the edge, and leave an audit trail your security reviewers can export." canonicalUrl: "https://zuplo.com/solutions/secure-and-govern" sourceUrl: "https://zuplo.com/solutions/secure-and-govern" pageType: "use-case" generatedAt: "2026-09-22" --- # One enforcement point for every API, LLM, and MCP call. > Reduce compliance risk and enable cross-team standardization with built-in > authentication, validation, and centralized policy enforcement at the edge. ## Why teams choose Zuplo for security Built to enable shipping, not block it. Traditional security adds review steps, custom code, and ops burden. Zuplo embeds security policies in your gateway so teams ship without breaking compliance. - **Reviewable by design** — Policies live in Git, enforced at the edge, with an immutable audit trail your reviewers can export. - **One policy, every API** — Define authentication, validation, and rate limits once. Apply them consistently across every team, project, and environment. - **Audit-ready by default** — SOC 2 Type II, audit logs, and policy enforcement evidence built into the platform, not bolted on after the fact. ## Security without the boilerplate - **Define security as reusable policies.** Auth, schema validation, traffic limits, and audit logging — configured once, applied everywhere. No middleware required. ([Learn more](/features/api-security)) - **Your OpenAPI spec is your security contract.** Every request is validated against your spec before it ever touches your backend. Auth, schema, headers — enforced at the edge. ([Learn more](/features/open-api)) - **Every request. Logged and observable.** Real-time event feed for every auth check, rate limit, and rejection. Send enriched logs to Datadog, New Relic, Splunk, or your own platform. ([Learn more](/features/api-observability)) - **Built for real-world abuse.** Block by IP, region, user agent, key tier, or custom logic. Runs on a global edge network with built-in DDoS protection. ([Learn more](https://zuplo.com/docs/articles/monitoring-your-gateway)) ## Enforce company-wide standards across every API Security shouldn't depend on which team wrote the service. Define reusable policies once and apply them across environments and APIs. - Require logging on all endpoints - Enforce auth across every route - Standardize rate limits by tier - Prevent accidental public exposure ## Know exactly what happened — and why Every request is traced end-to-end. See which policies ran, how long each step took, and exactly why a request succeeded or was rejected. Export enriched logs and traces to your observability stack: Datadog, New Relic, Splunk, or a custom destination. ## Built for production. Ready for enterprise. SOC 2 Type II, with SAML SSO, audit logs, and RBAC available on Enterprise. Everything teams need to deploy API security at scale — without the ops overhead. - **Global edge network** — Deployed worldwide across hundreds of PoPs, with built-in DDoS protection and low-latency request handling. - **SOC 2 Type II certified** — Compliance controls baked in, with a BAA available for HIPAA workloads and audit evidence ready for your reviewers. - **High availability** — Redundant by design — no single point of failure, no maintenance windows, no surprises. - **Enterprise SLAs** — Contractual uptime guarantees backed by 24/7 incident response from our engineering team. - **Full audit trail** — Every request, policy decision, and config change logged, searchable, and exportable on demand. - **Access controls** — Environment isolation on every plan. SAML SSO and project-level RBAC available on Enterprise. ## Underlying capabilities Each capability is a first-class part of the platform, composable with everything else. - **[API Security](/features/api-security)** — Built-in authentication, validation, mTLS, IP allowlisting, and threat detection at the edge. - **[API Key Management](/features/api-key-management)** — Issue, rotate, and revoke API keys. Self-service for developers, audit trail for compliance. - **[API Governance](/features/api-governance)** — Enforce OpenAPI specs, naming conventions, and security policies across every team and project. See also: [all features](/features) ## FAQ **What authentication methods does Zuplo support?** Zuplo supports API key authentication, JWT/OAuth2 validation, mTLS, and custom authentication policies written in TypeScript. It integrates natively with Auth0, Clerk, Firebase, Supabase, Okta, AWS Cognito, and other identity providers — applying auth enforcement at the gateway before requests reach your backend. **How does Zuplo validate JWT tokens?** Zuplo validates JWT tokens against configurable JWKS endpoints or static public keys. Validation includes signature verification, expiry checks, audience and issuer claims, and custom claim extraction. Validated claims are forwarded to your backend on the request context so you don't duplicate validation logic. **Can I enforce IP allowlisting and blocklisting at the API gateway?** Yes. Zuplo's IP restriction policies let you define allowlists and blocklists at the route, route group, or gateway level. Rules are evaluated at the edge before any upstream traffic is forwarded, making enforcement both consistent and extremely low-latency. **Does Zuplo support mTLS for service-to-service API security?** Yes. Zuplo supports mutual TLS (mTLS) for authenticating clients using certificates. This is commonly used in service-to-service communication and zero-trust architectures where API keys or JWTs alone are insufficient. **What compliance certifications does Zuplo hold?** Zuplo is SOC 2 Type II certified. It enforces TLS 1.2+ on all connections, supports GitHub secret scanning integration, and provides audit logging for all gateway policy changes. Enterprise customers can also deploy on dedicated infrastructure to satisfy data residency and isolation requirements. **How does Zuplo handle API key management at scale?** Zuplo provides a built-in API key service with programmatic key creation, rotation, revocation, and metadata tagging — all via API or the developer portal. Keys can carry custom metadata (plan, tier, user ID) that policies read at runtime to enforce access control without database round-trips. ## Next steps - Start a free account (`/signup`) - Talk to a Security Architect / Security Expert (`/schedule-call`) - Read more about [API Security](/features/api-security), [API Key Management](/features/api-key-management), and [API Governance](/features/api-governance)