How does Zscaler China Premium address compliance with the Great Firewall?

By partnering with legitimate ISPs inside China who perform traffic splitting, Chinese website traffic stays on the China internet while global traffic is routed appropriately through authorized channels, eliminating the compliance risk of sending blocked or sensitive information across borders.

How do users in China connect to the Zscaler service?

Users install the Zscaler Client Connector (ZCC) which automatically connects authenticated users to the closest Zscaler node, enabling direct cloud security access without backhauling traffic to corporate data centers.

Solving China Internet Compliance and Security with Zero Trust

Name: Solving China Internet Compliance and Security with Zero Trust
Uploaded: 2026-04-22T18:43:49-04:00
Duration: 3 min 52 s
Description: TL;DR Zscaler China Premium combines security-as-a-service and network-as-a-service by positioning Zero Trust Exchange nodes inside premium ISP data centers within China. The solution eliminates backhauling by connecting users directly to the nearest Z...

Zscaler

04/22/2026

0 (0%)

Report Like Favorite

Transcript

This is Henry again. Let's step into the solution that Zscaler is going to resolve for the five issues that we are listing here. First of all, Zscaler is a cloud security leader in the market, and what we are doing is to provide cloud security services through the Zero Trust Exchange available over the global internet. We have 160 plus data centers globally, including China. What we do is we provide services there available over normal internet. Especially in China, we make a special offer, what we call China Premium. What we do there is to position the Zero Trust Exchange inside a premium internet service provider. It is then a combination of the security as a service and network as a service. To resolve that, this helps us as an overview on architecture to resolve the five issues. By placing the Zero Trust Exchange in the cross-border ISP data centers, the Zero Trust Exchange, the Zscaler nodes there actually are providing the security services, which is covering the secure web gateway, the SSL inspection, the antivirus, the DOP, the firewall IPS that you are going to have for your on-prem stacks. This helps to provide the service and connectivity as a service at the same time from the cloud. Remember, we mentioned this is only available, required for a normal internet in China. For the China users, the easiest way to access this service is to insert a Zscaler client connector, what we call ZCC. The authenticated user with the ZCC will always connect to the closest data center or closest Zscaler nodes available for the user. This traffic will go to the ZTE without coming back to the data center. That helps to resolve the backhauling issues. Because of that, we are also basically having the connectivity arise on the Zscaler nodes. Zscaler is doing a Zero Trust basically contextual check for the access from the user by looking at who is accessing what application, at which time, using what kind of device, covering what kind of traffic. Is that a dangerous traffic? Is that a bad actor with a potential attack? Or is that traffic containing sensible data? After looking at all the context, the access can be authorized after checking the policies that you as a customer or organization define. If that authorized access is an internet traffic, the traffic will go to the ISP who is making the traffic split. This is important to notice that the Zscaler partner ISP here inside China is going to do the traffic split for you. If it is a Chinese website's traffic, it goes to the China internet, which means you actually do not have that risk of compliance anymore. If that's the global internet traffic, it breaks out by the ISP to the global internet as well. Since it is a legit internet service provider inside China, you don't have that compliance risk of sending sensitive or blocked information by the Great Firewall to the global internet as well. That is how we basically solve the internet traffic issues for the users in China. How about what if the users require access to private applications?

TL;DR

Zscaler China Premium combines security-as-a-service and network-as-a-service by positioning Zero Trust Exchange nodes inside premium ISP data centers within China.
The solution eliminates backhauling by connecting users directly to the nearest Zscaler node via the client connector, removing the need to route traffic through corporate data centers.
ISP-managed traffic splitting automatically routes Chinese website traffic to China internet and global traffic appropriately, addressing Great Firewall compliance requirements.

Summary

This video addresses the unique challenges multinational organizations face when securing internet traffic for users in China, including compliance risks with the Great Firewall, latency from backhauling traffic, and the complexity of maintaining on-premises security stacks. Henry from Zscaler explains how the Zero Trust Exchange for China Premium solves these issues by combining security-as-a-service with network-as-a-service through partnerships with premium ISPs inside China. The solution positions Zscaler nodes within cross-border ISP data centers, providing full security stack capabilities including secure web gateway, SSL inspection, antivirus, DLP, and firewall services without requiring traffic to route back to corporate data centers. A key differentiator is the ISP-managed traffic split that routes Chinese website traffic to the China internet and global traffic appropriately, eliminating compliance risks associated with cross-border data transmission. Users connect via the Zscaler Client Connector to the nearest node, where Zero Trust contextual checks evaluate user identity, device posture, application access, and traffic content before authorizing connections based on organizational policies.

Chapters

0:00 - Introduction
0:14 - Zscaler Global Infrastructure
0:38 - China Premium Architecture
1:41 - User Connection Flow
2:19 - Zero Trust Contextual Checks
2:51 - ISP Traffic Splitting

Key Quotes

0:43 "Especially in China, we make a special offer, what we call China Premium. What we do there is to position the Zero Trust Exchange inside a premium internet service provider."
2:05 "That helps to resolve the backhauling issues."
3:14 "If it is a Chinese website's traffic, it goes to the China internet, which means you actually do not have that risk of compliance anymore."

Categories:

Tags:

Show more Show less

Browse videos

Upcoming Webinar Calendar

10/20/2026

11:00 AM

10/20/2026

Master Data Governance for AI with Cyera and Snowflake Insights

https://www.truthinit.com/index.php/channel/2137/master-data-governance-for-ai-with-cyera-and-snowflake-insights/
10/27/2026

11:00 AM

10/27/2026

Maximize Security, Value, and Profit from Your Microsoft Investment

https://www.truthinit.com/index.php/channel/2178/maximize-security-value-and-profit-from-your-microsoft-investment/
10/27/2026

11:00 AM

10/27/2026

Illumio: See It. Stop It. Contain It. Lateral Movement Defense in Action

https://www.truthinit.com/index.php/channel/2182/see-it-stop-it-contain-it-lateral-movement-defense-in-action/
10/27/2026

01:00 PM

10/27/2026

The HUMAN Experience: Real-Time Insights into Page Intelligence

https://www.truthinit.com/index.php/channel/2139/the-human-experience-real-time-insights-into-page-intelligence/
10/28/2026

01:00 AM

10/28/2026

Ensuring AI Security Across the APAC Region

https://www.truthinit.com/index.php/channel/2125/ensuring-ai-security-across-the-apac-region/
10/28/2026

06:00 AM

10/28/2026

EMEA: Ensuring Comprehensive AI Security Across All Platforms

https://www.truthinit.com/index.php/channel/2127/emea-ensuring-comprehensive-ai-security-across-all-platforms/
10/28/2026

01:00 PM

10/28/2026

AMERICAS: Safeguarding AI Across All Fronts

https://www.truthinit.com/index.php/channel/2126/americas-safeguarding-ai-across-all-fronts/
10/28/2026

01:00 PM

10/28/2026

EnvZero: Near-Zero Time to Resolution--Live Agentic Remediation for Failed and Drifted Infrastructure

https://www.truthinit.com/index.php/channel/2179/envzero-near-zero-time-to-resolution-live-agentic-remediation-for-failed-and-drifted-infrastructure/
11/04/2026

11:00 AM

11/04/2026

Aligning Agentic Intent: Understanding Your Agents' Purpose vs. Their Actions

https://www.truthinit.com/index.php/channel/2158/aligning-agentic-intent-understanding-your-agents-purpose-vs-their-actions/
11/05/2026

02:00 PM

11/05/2026

HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.

https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
11/05/2026

02:00 PM

11/05/2026

Reclaim Your Evenings: Leverage Data Intelligence to Minimize Risk and Boost AI Adoption

https://www.truthinit.com/index.php/channel/2172/reclaim-your-evenings-leverage-data-intelligence-to-minimize-risk-and-boost-ai-adoption/
11/12/2026

01:00 PM

11/12/2026

Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
11/19/2026

01:00 PM

11/19/2026

Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
11/19/2026

01:00 PM

11/19/2026

Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/