netsecure

One private network for your locations, run from one console.

Each site runs a gateway. The console holds your policies, your sites and your logs. Here is what each part does.

Illustrative product interface

From sign-up to a connected network

  1. 01

    Create the organization

    Connect Okta, Microsoft Entra ID, Google Workspace or JumpCloud so admins sign in with your existing accounts.

  2. 02

    Install a gateway per site

    One command on a Linux box or VM at the location. It joins with a single-use token and only dials out.

  3. 03

    Tag subnets, write policies

    Label VLANs as pos, cameras or back-office and allow only the flows each one needs.

  4. 04

    Add the cloud

    Place a gateway in your AWS, Azure or Google Cloud network so every site reaches it privately.

Policies as readable rules, in the console or as code

Edit policies in the console or keep them in Git and push through the REST API. Every change is versioned with who made it and when, and you can roll back to any earlier version in one click.

mesh-policy.json

{
  "tags": {
    "tag:pos": ["site:*/vlan20"],
    "tag:cameras": ["site:*/vlan30"],
    "tag:hq-payments": ["site:hq/10.10.4.0/24"]
  },
  "rules": [
    { "src": "tag:pos", "dst": "tag:hq-payments", "ports": ["tcp/443"], "action": "allow" },
    { "src": "tag:cameras", "dst": "tag:hq-nvr", "ports": ["tcp/554"], "action": "allow" },
    { "src": "tag:guest-wifi", "dst": "*", "action": "deny" }
  ]
}
Site gateways
Runs on Ubuntu 22.04/24.04 LTS, Debian 12 or Docker, on x86_64 and ARM64. Advertises local subnets, needs no inbound ports and updates itself in a maintenance window you set.
Segmentation
Tag-based allow rules between subnets at any site. Default deny between tags, so a new camera VLAN reaches nothing until you allow it.
DNS filtering
Block malware, phishing and newly registered domains per tag. Guest Wi-Fi and point-of-sale can follow different lists.
Dual-WAN failover
Watch two uplinks per gateway and move tunnels on packet loss or latency thresholds you choose. Operations plan and above.
Flow logs and alerts
Connection metadata per site, searchable in the console. Email alerts when a site goes offline or switches uplink. Stream to Splunk HEC, Datadog or Amazon S3.
API and SCIM
REST API for sites, tags and policies. SCIM provisioning keeps console admins in sync with your identity provider.

How we protect your network and data

  • Encryption. WireGuard between all sites; TLS 1.2+ for the console and API. Gateway private keys are generated on the device and rotate every 24 hours.
  • Access to the console. SSO through your identity provider, mandatory MFA for local accounts, Owner / Admin / Read-only roles.
  • What we store. Site names, policies and connection metadata. We do not inspect or store packet payloads.
  • Export and deletion. Export policies and logs at any time. When you close the account, logs and configuration are deleted within 30 days.
  • Support. Email replies within one business day on Essentials and within 4 hours on Operations.

Questions about your site layout?

See pricing Email an engineer