# Security

Secure platform access, API traffic and the data that flows through your environments.

## Get started

Generated passwords and an audit log that records traffic from the first request.

[Security defaults](https://zato.io/docs/admin/security/defaults.html)

service.py

```
# Know which client is calling
self.channel.security.username
'partner.acme'

# Keep secrets encrypted at rest
self.crypto.encrypt(api_key)
'gAAAAABaxzkr2Rizsro...'

self.crypto.decrypt(encrypted)
'sk-live-1234'
```

## Platform access

[Security defaults Generated passwords and an audit log that records traffic from the first request.](https://zato.io/docs/admin/security/defaults.html) [Dashboard authentication Control who signs in to the Dashboard, with built-in accounts or Microsoft Entra ID.](https://zato.io/docs/admin/dashboard-auth.html) [Changing passwords Set your own passwords for the Dashboard, SSH and IDE users.](https://zato.io/docs/admin/security/change-password.html)

## API traffic

[Channel security Authenticate the API traffic that reaches your channels.](https://zato.io/docs/admin/security/channel.html) [Outgoing connections Authenticate Zato to the systems that your outgoing connections call.](https://zato.io/docs/admin/security/outgoing.html) [SSL/TLS Encrypt API and Dashboard traffic with your own or generated certificates.](https://zato.io/docs/admin/security/ssl/index.html) [Rate limiting and firewall Control how much traffic any one caller sends and block abusive addresses.](https://zato.io/docs/admin/guide/rate-limit.html) [Quota tiers Apply one named rate-limit plan to any number of API clients.](https://zato.io/docs/admin/guide/quota-tiers.html)

## Checklists

[Security checklist Work through the security decisions an environment needs before it goes live.](https://zato.io/docs/admin/security/checklist.html) [Ports and network Decide which ports to publish, which to keep closed and what outbound access to allow.](https://zato.io/docs/admin/ports.html) [Cryptography and secrets Generate secrets, encrypt data and hash passwords with the built-in crypto API.](https://zato.io/docs/dev/crypto/index.html)

## Compliance

[PII (GDPR, HIPAA, PDPA) Meet data protection obligations with the platform's controls for personal data.](https://zato.io/docs/admin/security/pii.html) [SBOM Inspect the exact package versions that a Zato installation runs.](https://zato.io/docs/admin/security/sbom.html)