About
The network should be boring
Two machines at the same company should talk without a ticket. Everything else stays shut. That is what Zero Trust means here.
Someone technical writes back.
What we build
A private network, direct between devices
Install an agent and the device joins one private network, direct to the other devices. Built as ZTNA today, growing toward SASE.
- Encrypted end to endA session goes straight between the two devices and is encrypted the whole way.
- Identity, then device requirementsMembers sign in with Google SSO or email and password, with a second factor where the organization requires one and passkeys where it allows them. Agent version, OS and country are checked every time the device connects, and a device that falls short loses access.
- Room for what never runs an agentNothing is renumbered: printers and old appliances stay reachable at their existing addresses.
How we decide
Four positions we build from
The product follows from these. So does what we said no to.
Deny by default
Joining grants nothing. Access exists only where someone wrote a rule between two named groups.
Say what is true
Direct or relayed, the agent on the device says which. The activity log is append-only, admins included.
Rules people can read
Rules name groups or named resources and a port, never bare IP ranges.
Run it so you don't have to
We run the control plane and get paged for it. Your traffic never passes through it.
A hosted service, not a distribution
SXAccess is software as a service: no self-hosted edition, no published source. If you must run the control plane yourself, this is not the product.
The mechanism is in the docs, down to how a session falls back to a relay. Running it is the part we keep.
Questions this page didn't answer
A security questionnaire, a procurement form, a migration you'd rather begin once. Send it over.
Or write to business@sxaccess.com