Zero Trust Network Access
Laptop, rack, cluster, phone: one network
Install the agent and the device gets a 100.x address, connects directly to the other devices, and reaches only what a rule allows.
No card · No open ports
In short
Direct links, deny by default
Easy to demo is not the same as easy to keep. These three are what everything else rests on.
Device-to-device mesh
Each pair of devices opens its own encrypted link, direct through NAT where possible, relayed where not.
Any cloud, any site
A VM in one cloud, a container in another, your own rack: one network, no tunnel per pair.
Access by identity, not network position
Joining grants nothing. A rule between two named groups opens one port. A device requirement can close it.
Control plane
The control plane never carries traffic
The control plane hands each device its configuration. The Discovery Service passes on the sealed messages two devices use to find a path to each other. Neither one can read your traffic.
- Configuration down, state backDown: the devices it may reach and the rules that apply. Back: online or not, and the agent version and OS that device requirements check.
- Encrypted end to endA session goes straight between the two devices and stays encrypted the whole way.
- Identity, run for youMembers sign in with Google SSO or email and password, with a second factor where the organization requires one and passkeys where it allows them. Block a member and every device they signed in on disconnects at once.
What you get
Everything in one dashboard
No second console, no add-on. Each card links to its docs page.
Access rules
Source group, destination group, port. Anything no rule names is dropped. There is no default-allow to switch off.
Read moreDevice requirements
Checked every time a device connects, not once at login: agent version, OS, country. A device that falls short loses access.
Read morePrivate DNS
Keep the hostnames you already use. They resolve inside the network, and can be limited to one group.
Read moreOrganizations
Client, staging and production as separate networks under one login. A rule in one is invisible elsewhere.
Read moreRoutes and internet gateway
One device advertises the subnet behind it. Internet traffic can leave through an Internet Gateway you choose.
Read moreActivity log
Who changed what, and when. Append-only: no edit, no delete, not even for an admin.
Read moreWhat it replaces
Three things you stop maintaining
Routines that grow up around an appliance. Nothing here needs them.
A firewall change request
A new service means a ticket, a wait, and a rule that outlives the service.
One rule between two groups
Backend to the message queue on 5672. Delete the rule, delete the access.
A tunnel for every pair of sites
Three sites is three tunnels, six is fifteen, each with its own keys and route table.
One route per site
Sites join as equals. The subnet behind each stays reachable at the addresses it has.
One VPN login shared by every script
A password in a pipeline variable, and a log entry you can't tell from a person's.
A service account per pipeline
Each runner enrolls with an enrollment key, and each pipeline calls the SXAccess API with its own service account. The activity log shows that name, not a person's.
Platforms
The same agent on every machine
macOS, Windows, Linux, Docker, Kubernetes, Android and iOS. One set of rules for all of them.
Desktop
The app on macOS and Windows: sign in and press Connect. On Linux and macOS, the CLI: one install command, then sxaccess start.
Read moreServers and images
Configure the agent from the environment: a Dockerfile, cloud-init, a CI job. A VM enrols at boot.
Read moreManaged fleets
Silent install from your MDM with an enrollment key. Device requirements apply from the start.
Read moreMobile
Android and iOS are full members: a phone is a device like any other, under the same rules.
Read moreHosted
One edition, and we run it
There is no self-hosted edition and no published source.
- You run the agent, nothing elseOne agent per device is your whole footprint. The control plane, its patches and its pager are ours.
- Not self-hosted, not open sourceIf the control plane has to sit inside your perimeter, tell us what it must satisfy.
- An uptime SLA in the contractBusiness carries a 99.99% uptime SLA, written into the contract.
Roadmap
From ZTNA to SASE in nine months
What ships today, and the steps toward a full secure access service edge. Dates are targets, not promises.
- Now
ZTNA, shipping today
Identity-based access, encrypted end to end, device requirements, routes, internet gateway, private DNS, activity log.
- Oct to Dec 2026
Secure web gateway
DNS and web filtering per group, applied at the Internet Gateway you choose. Not routed through us.
- Jan to Feb 2027
Device requirements from MDM and EDR
New checks that read your MDM and EDR: compliance state, disk encryption. Today a process check on the CLI agent can already require a running security agent.
- Mar to Apr 2027
Cloud firewall
Layer 3 to 7 rules for private and internet traffic, in the same console as access rules.
- May to Jun 2027
SaaS access, one rule model
Identity-aware access to SaaS through the gateway. One rule model across private, internet and SaaS traffic.
Two machines, one rule, no card
Five members and five devices, free. Enrol two machines, write one rule, watch the link come up.
Free plan · Change plans any time