Remote access
Work from anywhere, off the LAN
Each laptop joins one private network and reaches only what its group's rule allows. Device requirements are checked every time it connects.
Free plan · No card · macOS, Windows, Linux, iOS, Android
The problem
A VPN is just a longer cable
It puts the laptop on the office network and stops there. Then it's the firewall and a check that ran once.
One login, the whole subnet
Connected means on the network: every host the firewall lets through, and nobody can list them.
One rule, one service
A contractor's group reaches one system on one port. Groups and ports, never addresses.
Checked once, at login
It passed a check when the tunnel came up. Eight hours later, on hotel wifi, nobody is looking.
Checked at every connection
Minimum agent version, supported OS, expected country, looked up again each time the laptop connects. Connect from a country the rule doesn't allow and it reaches nothing.
How it works
Laptop, identity, rule
The laptop dials out. Sign-in says who, the rule says what.
Install on the laptop
The app on the laptop, or a silent MDM push. Phones run the SXAccess app, under the same rules.
Sign in once
Google SSO or email and password, with a second factor where you require one and passkeys where you allow them. Groups are set on the member, and blocking a member ends their access at once.
Write one rule
Finance to the payroll server on 443. Until that rule exists, the laptop reaches nothing.
What you get
Built for a laptop that moves
No gateway on the internet
The agent dials out from whatever wifi it's on. Nothing to publish, patch or find in a scan.
Read moreDirect from the café to the server
Encrypted the whole way between the two devices, straight through NAT or by relay.
Read moreThe office rack, from home
One office device advertises the subnet behind it. The printer and the old finance box keep their addresses.
Read moreStart with one team at home
Two rules and five devices on the free plan.
No card · Routes and internet gateway included