A policy-controlled communication system including a plurality of client devices establishing a secure session with remote instances on a web server using a protocol. The system includes a policy component with a set of policies customized based on parameters. The policies specify configuration settings of encryption protocols for content security on a client device. The parameters include connection, application, source, destination, data classification, type, user groups, encryption type, and/or performance. A local application selects a cloud service. A mid-link server includes a router to provision the set of policies, a security developer to determine an encryption link to deliver the cloud service to the client device and a linker to select a session protocol for establishing the secure session between the client device and the web server based on the set of policies. The router establishes via the encryption link the secure session based on the selected session protocol.