Zscaler Internet Access (ZIA) is Zscaler’s cloud-delivered secure web gateway and firewall service for traffic to the internet and SaaS applications. Zscaler describes it as a SaaS product “that can be licensed in various ways”.[1] Its primary metric is the seat, a subscription for an individual authorized user. Seats are counted as the total number of unique individual users over the previous rolling 90-day period, and the total endpoints across all seats may not exceed three times the number of seats purchased.[1] A fair use policy measures ZIA Monthly Traffic against a cloud-wide average.[1] ZIA can also be licensed per site, per workload, per data centre (for dedicated IP addresses) and, in China, per megabit of purchased bandwidth.[1][3] The ZIA data sheet states that “All Zscaler Internet Access editions are priced per user”, although some products inside a platform edition may be priced on other units.[6]
Editions
ZIA is sold inside the Zscaler platform bundles. The ZIA data sheet compares the Essentials Platform with the Zscaler Platform.[6] Both include content filtering, file type control, TLS/SSL inspection, bandwidth control, Nanolog Streaming Service, Cloud NSS for more than 500 users and the ZIA Private Service Edge virtual appliance.[6] Differences between the two include the following.
| Capability | Essentials Platform | Zscaler Platform |
|---|---|---|
| Access to high-cost public data centres (Australia, New Zealand, Dubai, South America, Africa, South Korea, Taiwan, Mainland China) | Not included | Included[6] |
| Source IP Anchoring | Not included | Included[6] |
| Private Access (ZPA) | 1 user per 20 subscribed users (minimum 500 subscribed users) | Included[6] |
| Inline web and GenAI DLP, all apps | Not included | Included[6] |
| Zero Trust for Workloads | 1 GB of monthly workload traffic per subscribed user | 2 GB of monthly workload traffic per subscribed user[6] |
| Deception Standard | Not included | Included[6] |
Neither bundle includes China Premium or regulated Middle East data centre access, hardware ZIA Private Service Edge instances, Sandbox Advanced, Zero Trust Firewall Advanced or Zero Trust Browser Advanced. Each of these is bought separately.[6] On the Pricing and Plans page, Cyber Browser Isolation Advanced includes “1.5 GB/user/month of isolation traffic (upgradeable to unlimited isolation)”.[7] The Pricing and Plans page lists “Zero Trust for Workloads (1GB/user/month)” under the standard versions of both bundles, while the data sheet gives 2 GB for the Zscaler Platform. The two documents differ, and the Order governs.[6][7] Catalog proof: ZIA editions are priced per user, Platform bundles include 1 GB or 2 GB of workload traffic per subscribed user.
Metrics
| Zscaler name | Catalog row | Zscaler definition |
|---|---|---|
| Seat | Seat | A subscription license for an individual authorized user; counted as unique individual users of ZIA over the previous rolling 90-day period[1] |
| ZIA Monthly Traffic | ZIA Monthly Traffic | Authenticated and Unauthenticated Traffic uploaded and downloaded via ZIA in a calendar month, in GB[1] |
| Site | Site | A subscription for a site or location that enables Zero Trust SD-WAN and/or IoT device visibility[1] |
| Workload | Workload | A unique domain name, an IP address, or a set of IP addresses, for subscriptions licensed per workload instead of per GB[1] |
| Data Center | Data Center | The Zscaler data centre associated with a subscribed pair of IP addresses (Managed Dedicated IP)[1] |
| Light Customer User | Light Customer User | A Seat designated as a light or occasional user[2] |
| Bandwidth | Bandwidth (China Premium) | Data processed in a Zscaler Premium data centre in China, in Mbps from five-minute samples[3] |
Authenticated Traffic is traffic sent and received by a known seat. Unauthenticated Traffic is traffic not related to a known seat, “including inline guest Wi-Fi, device, server, and workload traffic”.[1] The Light Users Product Sheets define ZIA Monthly Traffic slightly differently, as “non-seat Authenticated Traffic and Unauthenticated Traffic”.[2] The SLA document defines a Seat as a subscription license for the SaaS for an individual Authorized User.[5] The EUSA defines an Authorized User to include employees, agents, contractors and other third parties authorized by the customer or its Affiliates.[4]
Counting / floors
Rolling 90-day seat count (undated, retrieved 2026-09-26). Seats are counted as unique individual users of ZIA over the previous rolling 90 days.[1] A user who authenticates once within the window counts, so seasonal staff, contractors and leavers stay in the count for up to 90 days. Catalog proof: ZIA seats counted as unique users over a rolling 90-day period.
Three endpoints per seat (undated, retrieved 2026-09-26). “The total endpoints across all seats may not exceed three times the number of seats purchased.”[1] The cap applies to the total, not to each user, so one user with five devices is acceptable if others use fewer. Catalog proof: ZIA endpoints may not exceed three times the seats purchased.
Fair use (undated, retrieved 2026-09-26). Average ZIA Monthly Traffic across all purchased seats should be less than two times the cloud-wide average, currently 8 GB per seat per month, plus any additional bandwidth entitlement. On current figures, that is 16 GB per purchased seat per month on average. Unauthenticated traffic above the threshold requires a subscription for additional bandwidth.[1] Traffic from guest Wi-Fi, servers, IoT devices and workloads sent through ZIA without a seat therefore uses up the pool created by user seats. Catalog proof: ZIA fair use: average monthly traffic below twice the cloud-wide average.
Light Customer Users (last updated 2025-08-15). For Light Customer Users, ZIA use is limited by both the number of seats and the monthly traffic, with an allowance of 1 GB per ZIA Light seat.[2] If traffic exceeds the allowances by more than 10%, Zscaler notifies the customer or Partner. The customer then has three options: a bandwidth reduction plan, buying additional seats or monthly traffic prorated to the current term, or upgrading light users to regular seats. If none is done within 90 days, Zscaler or the Partner may invoice from the date of notification.[2] The Light Users sheet counts seats over the same rolling 90-day window.[2] Catalog proof: Light Customer User allowances and remediation after 10% overage, Light Users seat count uses a rolling 90-day window.
Sites (undated, retrieved 2026-09-26). For an IoT site, only the parent location is counted. In a hub-and-spoke deployment, each spoke or branch behind the hub counts as a site. Each site includes a number of devices set by its subscription type.[1] Catalog proof: IoT hub-and-spoke: each spoke behind the hub counts as a site.
Isolation and SIPA (undated, retrieved 2026-09-26). Zero Trust Browser (Isolation or Cloud Browser Isolation) and Source IP Anchoring are subscribed per seat, with a maximum aggregate amount of ZIA Monthly Traffic across all seats.[1] The standalone Zero Trust Browser policy applies the data limit stated in the purchased SKU. If the SKU states none, average monthly traffic must stay below two times the cloud-wide average of 8 GB per seat.[9] Catalog proof: Browser Isolation, SIPA and ZPA B2B Federation are subscribed per seat, Zero Trust Browser data limits from the SKU, else 2x cloud-wide average.
Risk360 (undated, retrieved 2026-09-26). Risk360 is licensed per seat, but the number of licences is based on unique individual users of ZIA over the previous 90 days, not on users of Risk360.[10]
Overage (EUSA last updated 2026-08-01). Usage above the Order, including usage limits in the Documentation, must be promptly purchased.[4] Zscaler states that it periodically reviews seats, sites, workloads and monthly traffic to ensure license compliance.[1] Catalog proof: Usage above purchased quantities must be purchased promptly, Zscaler periodically reviews seats, sites, workloads and traffic for license compliance.
Virtualization & partitioning
ZIA has no host-based rules. Workloads are counted under the Workload metric: a VM, VDI instance, serverless function or container-based resource, identified by a unique domain name, IP address or set of IP addresses.[1] The Workload Communications policy was folded into the ZIA and ZPA policies effective 19 April 2024.[8] Traffic from a ZIA Virtual Service Edge deployed in the customer’s network is excluded from the ZIA availability SLA, because Zscaler has no control over its operation.[5] Catalog proof: Workload Communications policy replaced by ZIA and ZPA Workload metric.
Cloud / BYOL
ZIA is delivered only from Zscaler’s cloud, and the customer must forward traffic to it through PAC files, IPsec or GRE tunnels, or the Zscaler App.[4] Zscaler reserves the right to manage bandwidth and route traffic “in a commercially optimal way”.[4] Dedicated egress IP addresses (Zscaler Managed Dedicated IP) are licensed per data centre, and “The same pair of IP addresses cannot be transferred to a different data center during the lifetime of the subscription.”[1] Catalog proof: Managed Dedicated IP pair cannot move to another data center.
ZIA China Premium and Premium Plus (undated, retrieved 2026-09-26). These are licensed by the bandwidth purchased for the term.[3] For Premium, Zscaler takes five-minute receive and transmit samples for each Premium data centre in China, takes the 95th percentile of each, uses the larger value, and sums the results across data centres (the P95 Accounting Method). The customer must stay within purchased bandwidth for 95% of the time, which allows about 36 hours of burst in a 30-day month. Bursts may never exceed 130% of the purchased bandwidth.[3] Premium Plus uses the highest sample (the Peak Accounting Method) and has no burst allowance.[3] On written request, Zscaler provides bandwidth usage reports for the previous calendar month.[3] Catalog proof: ZIA China Premium: P95 accounting and 130% burst limit, ZIA China Premium Plus: peak accounting with no burst allowance.
Programs
- Light Customer Users (last updated 2025-08-15), described above.[2]
- ZIA China Premium and Premium Plus, described above. It is subject to the Supplemental Premium China Services Availability Agreement.[3]
- SLA Service Credits (last updated 2026-09-21). ZIA commits to process 99.999% of Transactions and Sessions each month, with credits from 3 days to 30 days of fees.[5] There are also latency and virus capture rate agreements. The latency SLA covers only Qualified Transactions, which include “a reasonable number of Transactions and Data Packets per Seat (based on Zscaler’s cloudwide average)”.[5] Catalog proof: ZIA Service Availability Agreement of 99.999% of transactions.
Out of scope
- ZIA prices and discounts, which Zscaler does not publish.
- Legacy ZIA edition names (Business, Transformation, Unlimited), for which no current Zscaler document was retrieved.
- Data Security add-ons (Endpoint, Email, SaaS Security, DSPM) beyond their mention on Zscaler platform bundles and editions.
- ZIA for Government (FedRAMP) terms.
Catalog rows
Catalog rows for this article, grouped by table.
- Metrics
- Programs
- Rules
- ZIA seats counted as unique users over a rolling 90-day period
- ZIA endpoints may not exceed three times the seats purchased
- ZIA fair use: average monthly traffic below twice the cloud-wide average
- Light Customer User allowances and remediation after 10% overage
- Light Users seat count uses a rolling 90-day window
- IoT hub-and-spoke: each spoke behind the hub counts as a site
- Browser Isolation, SIPA and ZPA B2B Federation are subscribed per seat
- Zero Trust Browser data limits from the SKU, else 2x cloud-wide average
- Managed Dedicated IP pair cannot move to another data center
- ZIA China Premium: P95 accounting and 130% burst limit
- ZIA China Premium Plus: peak accounting with no burst allowance
- ZIA editions are priced per user
- Platform bundles include 1 GB or 2 GB of workload traffic per subscribed user
- ZIA Service Availability Agreement of 99.999% of transactions