Zilla for Kafka
Universal Kafka access, governed at the edge.
Connect Kafka clients across networks, expose real-time data through familiar APIs, and bring IoT devices directly into Kafka. Enforce access and field-level policies at the gateway without custom middleware or exposing brokers.
Powering Global Data-Driven Organizations
The Problem
Kafka was built for systems, not for governed access at scale.
The wrapper farm
Exposing Kafka to apps, partners, devices, and agents means wrapper services, until the wrapper layer becomes the product.
Custom code
Duplicated logic
Ops overhead
Uneven governance
The governance gap
Isolation, identity, and edge enforcement aren't built in. You build them yourself or go without.
Tenant isolation
Identity end-to-end
Schema at the edge
Per-tenant quotas
Field-level privacy
Audit trails
Kafka-native proxying
Proxy Kafka traffic without changing clients.
Zilla transparently proxies Kafka producers, consumers, and Kafka Connect with only a bootstrap.servers change, preserving the full Kafka protocol, including consumer groups, transactions, and idempotent producers.
Kafka-native
Standard Kafka clients in Java, Go, Python, .NET, Node, and other languages connect without SDKs, drivers, or rewrites.
only bootstrap.servers changes
Identity at the wire
Authenticate Kafka clients with SASL, SCRAM, mTLS, or AWS IAM, then enforce access at the gateway.
sasl
scram
mtls
aws iam
Policy on passthrough
Apply configuration rules, schema validation, and data privacy controls before Kafka traffic reaches the cluster.
config
schema
privacy
Data masking and encryption
Encrypt sensitive and PII fields before Kafka, then decrypt, redact, or omit them based on consumer authorization, including data already stored in the clear.
encrypt on write · redact on read
Virtual Clusters
Segment one physical Kafka cluster into isolated logical clusters for teams, tenants, partners, or environments.
one cluster → many tenants
Dynamic topic aliases
Clients use the same topic name while the gateway routes each to its own internal topic based on authenticated identity, without per-client configuration.
messages → messages-${identity}
Baseline Controls at the Edge
Identity, schema, and telemetry before traffic reaches Kafka.
The controls enterprises expect at a boundary, applied on the traffic path, not bolted on behind it.
Identity for every client
Authenticate non-Kafka clients with JWT, Azure AD, or AWS Lambda authorizers.
Authenticate Kafka-native clients with SASL, SCRAM, mTLS, or AWS IAM.
Use identity to authorize routes, topics, tools, tenants, and access patterns.
Schema enforcement
Validate messages against your existing schema registry and reject invalid data before it reaches Kafka.
Registries: Confluent Schema Registry, Karapace, Apicurio, AWS Glue, and inline filesystem schemas.
Formats: Avro, JSON Schema, Protobuf, and scalar types.
Telemetry
Export Kafka-aware metrics and structured events to Prometheus, OpenTelemetry, stdout, CloudWatch, and Syslog.
Track request duration, response codes, produce and fetch volume, topic access, client identity, and quota violations.
No log spelunking to answer who read what, and when.
Governance
Data quality and governance, enforced at the edge.
Define policy centrally. Enforce it at the gateway. Keep Kafka ACLs and quotas in place and add the controls Kafka cannot provide on its own.
Configuration policy enforcement
Enforce Kafka guardrails across topics, clusters, producers, and consumers, including naming, retention, API and client versions, record sizes, poll rates, and consumer lag.
Field-level encryption and crypto-shredding
Encrypt fields before Kafka, then decrypt, redact, or omit based on consumer authorization. Keep keys in your KMS and enable GDPR erasure by destroying per-user KEKs.
Streaming schema validation
Validate JSON, Avro, and Protobuf messages at near line rate before they reach Kafka. Reject bad data at the edge, not downstream.
Multi-Protocol Mediation
Connect every client that does not speak Kafka.
Zilla gives browsers, mobile apps, IoT devices, services, and AI agents governed access to Kafka through multiple protocols, with unified identity, schema, telemetry, and policy controls, and support for OpenAPI, AsyncAPI, and Protocol Buffers.
“Zilla Plus gave us exactly what we needed — secure, Kafka-native connectivity to our private MSK clusters from anywhere, without compromising security or building custom integrations. It’s accelerated our project delivery and simplified how we connect critical business systems across our ecosystem.”
Karthik Rajendran
Platform Owner, KONE
Key Results
Connected MSK clusters securely without public exposure
Accelerated project delivery across SAP & third-party systems
Reduced dev overhead by eliminating custom integrations
‍“Zilla’s extensive protocol support, integrations with AWS services such as Glue Schema Registry and Secrets Manager, as well as robust logging capabilities, gives me confidence it can be a one-stop solution for all of our external MSK integration needs.”
Gordon Zardoya
Solution Architect, N Brown-Castle Fintech
Key Results
Secure endpoints enabled fast partner integrations
Lead time cut, team focused on Kafka design
Unified interface across Kafka and non-Kafka apps
“Zilla Plus gives us a way to make real-time data in Amazon MSK accessible through familiar APIs without exposing our Kafka infrastructure or building custom middleware for every partner. It gives us a reusable integration pattern that is secure, scalable, and much easier to operate.”
Lotta Opderbeck
Technical Product Owner
Key Results
Kept Amazon MSK private while enabling secure external partner access
Avoided building and operating partner-specific REST-to-Kafka middleware services
Created a reusable integration pattern for future partners and regulations
Start building with Zilla.
Browse the docs and see Zilla in action, or talk through your architecture with an engineer.
Join the Community
Trade notes with the engineers running Zilla in production, and get help from the team in Slack.
