Early access

Web access rules and audit evidence for small teams.

TrustCero is the control panel for Cloudflare Zero Trust, built for companies without a security team. Decide which sites your team can use, apply those rules through your own Cloudflare account, and keep dated records of every change, ready when an auditor or a customer's security questionnaire asks.

Request a demo

For companies of 10 to 200 people on macOS and Windows.

What TrustCero is

TrustCero is a control panel and record keeper for Cloudflare Zero Trust. Cloudflare does the filtering on its global network, under your own account. TrustCero is where your company decides the rules, checks that every laptop is covered, and keeps proof of both.

How TrustCero works: you set rules in TrustCero, TrustCero applies them in your Cloudflare account, Cloudflare allows or blocks each laptop's lookups and keeps the logs, and TrustCero exports evidence for your auditor. You company admin TrustCero Console Web access rules Device coverage Audit log you can't edit Policy history Your Cloudflare account Zero Trust Gateway DNS policies Lookup logs (stay in your account) Laptops WARP app sets rules applies rules device list each lookup allow / block exports Evidence file you share Auditor or customer 1 2 3 4 You (admin) sets rules 1 TrustCero Console Rules · Device coverage Audit log · Policy history 4 Evidence file applies rules device list 2 Your Cloudflare account Gateway DNS policies Lookup logs stay here each lookup allow / block 3 Laptops WARP app
Rules flow from TrustCero into your Cloudflare account; your team's browsing never passes through TrustCero.
  1. You set the rules in the TrustCero Console: list sites to block or allow, or group them, like personal file sharing. The most specific rule wins, and monitor mode lets you see what a rule would block before it blocks anything.
  2. TrustCero applies them as Cloudflare Gateway DNS policies in your account and keeps them in sync. It only changes the rules it created, and reads back your list of devices.
  3. Cloudflare enforces them. The WARP app on each laptop sends its lookups to Cloudflare, which allows or blocks each one and logs it in your account.
  4. TrustCero keeps the proof. Every sign-in, rule change, and sync goes into an audit log admins can't edit. Download a dated evidence file whenever an auditor or customer asks.

Why teams use it

Answer security questionnaires with proof

When a customer asks whether you control web access and know your company devices, answer yes and attach a dated record, not just a promise.

Evidence for the whole audit period

Auditors want to see a control working over months, not just today. TrustCero keeps every policy version, each time it was applied (including failures), and dated device lists.

No security team required

You get Cloudflare's global network without learning Gateway's rule syntax. Plain rules, monitor mode first, and a clear view of which laptops are covered.

Your data stays yours

Lookup logs stay in your Cloudflare account, and the rules live there too. Disconnect TrustCero and it removes the rules it created. Rules you made yourself are never touched.

Where TrustCero fits in an audit

TrustCero doesn't perform audits or certify compliance. SOC 2 reports come from independent auditors, and ISO 27001 certificates from certification bodies. TrustCero gives you records for a few specific controls (web access rules, device inventory, and who changed what) for your auditor to review alongside the rest of your security program.

Monitoring that respects your team

TrustCero manages your rules; it doesn't read your team's traffic. Rules work on site names, so there's no page content to collect.

  • No page content, messages, passwords, keystrokes, or screenshots. TrustCero never decrypts traffic.
  • Connection logs stay in your own Cloudflare account, under your control.
  • Two-factor authentication required for every admin.
  • Two-factor secrets and Cloudflare credentials encrypted at rest.
  • Each company's data kept separate at the database level.
  • We never sell your data or share it for advertising.

Monitoring employees comes with notice obligations that vary by state and country. Tell your team before you turn it on; our privacy policy explains what's collected.