Identity-based access
Access is granted based on who or what is requesting it — not IP addresses or network location.
Encrypted connectivity
All traffic flows through WireGuard tunnels. No plaintext. No exposed services.
App & service exposure
Expose HTTP apps, TCP services, SSH, databases, and internal APIs with fine-grained controls.
Policy & visibility
Define who can access what and see access activity in one place.