TrustCeroZero Trust web access, with the audit trail built in.
TrustCero is the control panel for Cloudflare Zero Trust, built for companies without a security team. Set the rules, see every laptop that's covered, and keep dated proof for your auditor and your customers' security questionnaires.
For companies of 10 to 200 people on macOS and Windows.
- Enforced by CloudflareRules run on Cloudflare's global network, in your account.
- Logs stay yoursBrowsing logs never leave your Cloudflare account.
- Two-factor for every adminNo exceptions, including single sign-on.
- Dated evidenceOne file per audit period, its hash in the audit log.
What TrustCero is
TrustCero is a control panel and record keeper for Cloudflare Zero Trust. Cloudflare does the filtering on its global network, under your own account. TrustCero is where your company decides the rules, checks that every laptop is covered, and keeps proof of both.
- You set the rules in the TrustCero Console: list sites to block or allow, or group them, like personal file sharing. The most specific rule wins, and monitor mode lets you see what a rule would block before it blocks anything.
- TrustCero applies them as Cloudflare Gateway DNS policies in your account and keeps them in sync. It only changes the rules it created, and reads back your list of devices.
- Cloudflare enforces them. The WARP app on each laptop sends its lookups to Cloudflare, which allows or blocks each one and logs it in your account.
- TrustCero keeps the proof. Every sign-in, rule change, and sync goes into an audit log admins can't edit. Download a dated evidence file whenever an auditor or customer asks.
Why teams use it
Answer security questionnaires with proof
When a customer asks whether you control web access and know your company devices, answer yes and attach a dated record, not just a promise.
Evidence for the whole audit period
Auditors want to see a control working over months, not just today. TrustCero keeps every policy version, each time it was applied (including failures), and dated device lists.
No security team required
You get Cloudflare's global network without learning Gateway's rule syntax. Plain rules, monitor mode first, and a clear view of which laptops are covered.
Your data stays yours
Lookup logs stay in your Cloudflare account, and the rules live there too. Disconnect TrustCero and it removes the rules it created. Rules you made yourself are never touched.
Rules, devices, and records in one place
Everything an admin needs, in plain language. Start in monitor mode to see what your rules would block, then switch to enforce when you're ready.
- Block or allow sites one by one, or in categories you name.
- See each laptop running WARP, who uses it, and when it was last seen.
- Every policy version kept, with who published it and when.
- Sign in with a password, Google, or Microsoft, plus two-factor.
Where TrustCero fits in an audit
TrustCero doesn't perform audits or certify compliance. SOC 2 reports come from independent auditors, and ISO 27001 certificates from certification bodies. TrustCero gives you records for a few specific controls (web access rules, device inventory, and who changed what) for your auditor to review alongside the rest of your security program.
Monitoring that respects your team
TrustCero manages your rules; it doesn't read your team's traffic. Rules work on site names, so there's no page content to collect.
- No page content, messages, passwords, keystrokes, or screenshots. TrustCero never decrypts traffic.
- Connection logs stay in your own Cloudflare account, under your control.
- Two-factor authentication required for every admin.
- Two-factor secrets and Cloudflare credentials encrypted at rest.
- Each company's data kept separate at the database level.
- We never sell your data or share it for advertising.
Monitoring employees comes with notice obligations that vary by state and country. Tell your team before you turn it on; our privacy policy explains what's collected.
See TrustCero in action
A 30-minute walkthrough of rules applied through Cloudflare Zero Trust, the audit log, and the evidence export.