A secure corporate network on top of any communication channel. Offices, data centres, employees, contractors and industrial equipment in one perimeter, where access is granted to a specific service and port rather than to the whole network — and revoked in seconds.
Cover: network management console
Remote sites, mobile crews, contractors and industrial gateways connect over a mix of channels — fibre, LTE, satellite — almost always behind NAT and without public IP addresses. They need secure connectivity and managed access, and connecting the next site should not turn into a project of its own.
A separate challenge of recent years: the familiar Western solutions in this class have left the Russian market, taking updates, support and licence renewals with them.
The dashboard issues each node a certificate from the company’s own certificate authority, with the node’s network address and groups embedded in it. Nodes find each other through beacons and build tunnels directly, bypassing the data centre. Access rules are enforced on the node itself, based on the groups in its certificate, so policy keeps working even when the dashboard is unreachable.
A single point of administration: organisations, networks, devices, groups, access rules, certificate issuance, device posture control, audit log and reports.
Node discovery, NAT traversal and relaying for nodes behind symmetric NAT. Several beacons per network with health checks and automatic failover. Deployed from the dashboard over SSH.
Windows, macOS and Linux, including ARM. A system service keeps the tunnel up and reports device posture; the tray app talks to it locally. Closing the window does not mean leaving the network.
Rules are defined between groups of users and groups of resources, down to protocol and port. An employee gets access to the service they need, not to the whole subnet.
A new device joins the network with a one-time token: no manual key distribution, no route configuration and no engineer visiting the site.
The certificate goes on the organisation’s blocklist and live tunnels are torn down immediately, without waiting for a reconnect. An employee leaving or a contract ending is handled in a single action.
Traffic flows directly between nodes: lower latency, less load on backbone links. NAT is traversed automatically, and a relay node is picked for difficult connections.
The company’s certificate authority issues, rotates on schedule and revokes certificates. A node’s address and groups are embedded in its certificate and cannot be spoofed.
Admission based on actual device posture: OS version, disk encryption, firewall, antivirus, required and forbidden processes. Non-compliant devices are isolated automatically.
Servers, workstations, industrial gateways and IIoT devices get addresses in a shared address space. A single installation hosts several isolated networks, each with its own addressing.
Several beacons per network with health checks and automatic failover. Traffic obfuscation for filtered links and DPI. Works over LTE and satellite.
Configuration backups from the UI and through a separate REST API with its own rotating token — easy to plug into your existing backup routine.
An administrator activity log, dashboard event export to an external syslog or SIEM, device and policy compliance reports — ready-made artefacts for an audit.
Super administrator, organisation administrator and a user with a personal area for their own devices. One installation serves a holding company with independent perimeters.
The licence is a signed file and checking it needs no connection to an external server. Installation makes no calls to external registries or repositories. The interface is in Russian.
Offices, warehouses, production sites and data centres in a single address space. Traffic between two sites goes directly rather than through a central node — including where there are no public IP addresses.
A laptop connects with a token from the dashboard and sees only the systems its owner’s role requires. When someone leaves, access is closed in a single action, without administrators going through every service.
Access strictly to a list of services for the duration of the work, with posture checks on the contractor’s device. When the contract ends, access is revoked immediately instead of lingering in the system.
Encrypted transport for data from industrial gateways and IIoT over LTE and satellite, with segmentation down to “site — specific collection server”. ARM platforms are supported.
The difference between a demo and real operation is how the system behaves when something goes wrong. Here are three decisions we made precisely for that case.
The agent only sends facts about the device’s state. Policy compliance is computed by the dashboard. A compromised client cannot declare itself trusted — it takes no part in the decision.
A check has an expiry date. A device that stops reporting does not stay on the trusted list out of habit: its status changes to “unconfirmed”.
Quarantine only kicks in after several failed reports in a row. Beacons and infrastructure nodes are never cut off. If too large a share of devices is about to be isolated, the dashboard raises an alarm instead of disconnecting them en masse.
We start by observing and only then switch on enforcement — so that policy never gets in the way of operational processes.
We deploy the management dashboard and one or two beacons. Installation runs from the UI over SSH and the image is built on the target server — no external registries required.
We set up organisations, networks and groups and describe access rules between groups of users and resources. Devices join with one-time tokens.
We switch on device posture control without consequences. You can see what share of the fleet does not meet security requirements, and which checks it fails.
We switch policies to enforcement. Non-compliant devices are isolated, while infrastructure stays protected by the safeguards.