Zerodha

Zerodha Chooses Cloudflare to Enable Security, Performance — and Financial Compliance

When Zerodha burst into the scene in 2010, it heralded a new era of discount broking in India. By 2019, the fintech company’s disruptive pricing models and in-house technology had made it the biggest stock broker in the country by active retail clients, and the biggest by trading volumes on the top Indian stock exchanges. Today, over one million clients place millions of orders through its powerful ecosystem of investment platforms. Much of the action happens on Kite, its broking platform, which, to Zerodha, signals that technology is what keeps its clients coming back.

For Chief Technology Officer Dr Kailash Nadh and his team, this translates into the heavy responsibility of ensuring that Zerodha delivers the web performance and cyber security that its clients demand and deserve. Considering the frequency and sophistication of today’s cyber threats, tightening regulatory controls, and growing user traffic, Zerodha turned to Cloudflare to achieve all its objectives in a fast, simple, and resource-efficient manner.

From Black Box to True Transparency

“Before Cloudflare, we had a traditional managed services setup with practically zero visibility into what was happening, which is quite common for Indian managed services. We had no dashboard access and everything was done over the phone. If we wanted to add a firewall rule, for example, we had to write in and wait. It was such a black box that we didn’t even know if it was effective—we couldn’t see anything beyond the occasional report!” shared Dr Nadh. “This may have been acceptable in our early days but we’ve grown and now it’s just obsolete. We need solutions that are powerful and scalable, and a customer experience that is seamless and transparent. That’s why we chose Cloudflare.”

Securing the Future

Being in the financial space and dealing with large transactions on a daily basis, cyber security is naturally a top priority for Zerodha.

“Cloudflare WAF has been very effective in thwarting attacks for us. In fact, compared to our previous WAF, Cloudflare seems to be more proactive. It captures even obscure cases and appears to be continuously improving as threats evolve,” said Dr Nadh.

Indeed it is: Cloudflare's security protection leverages collective intelligence derived from millions of Internet properties on its network. The insights from an attack on any one of these properties are automatically applied to better protect them all.

This is important to Zerodha because cybersecurity is also a regulatory requirement. In 2018, the Securities and Exchange Board of India released the Cyber Security & Cyber Resilience Framework for Stock Brokers/Depository Participants as an industry-wide call for stronger cyber defences.

“By the time the framework was released, we were already on Cloudflare, so that was a huge relief. The operational compliance burden is immense but, thankfully, just having Cloudflare allows us to tick off half of those boxes.”

On the web performance side of things, Dr Nadh is just as pleased with what he describes as “incredible gains” from Cloudflare’s CDN and DNS products.

Today, Zerodha uses Cloudflare’s web application firewall (WAF) and advanced DDoS attack protection services to ramp up security, and the Cloudflare network and managed DNS service to achieve better speed and performance.

“Our previous CDN had Points of Presence (PoPs) across Asia, but not in India. Cloudflare has tons of PoPs here and that immediately made a huge difference. CDN performance jumped by at least 100%. We saw latency improvements in many states across the country and have saved about 80% of our bandwidth from heavy caching,” he said. “Cloudflare is beautifully built. It’s completely technical and developer friendly, which makes it is a powerful engine for our business.”