Control plane
Management handles identity, devices, resources, and policy. HUB handles authentication, configuration compilation, and synchronization with nodes. Access changes propagate through configuration updates and revocation notifications.
A managed loop from access decision to network enforcement
The control plane manages identity, devices, resources, and policy. HUB handles authentication and configuration sync. Clients and Gateways form the encrypted path for business access.
How an access request works
Identity, device, policy, and the network connection
- 01
Employee and Client
The employee signs in with a company-created account. The Client connects using its registered device credential.
- 02
Management
Admins manage employees, devices, groups, protected resources, and access policy.
- 03
HUB control channel
HUB verifies node identity, reads current state, and compiles and synchronizes configuration for Clients and Gateways.
- 04
Encrypted WireGuard path
Clients and Gateways establish an encrypted data path. Ordinary business traffic does not pass through HUB.
- 05
Gateway and business resources
The Gateway enforces ACL rules on network access. Traffic without a matching allow rule is denied by default.
Control plane and data plane
Manage policy separately from business traffic
Data plane
Clients and Gateways use WireGuard to carry encrypted business traffic. Gateways enforce access rules at the company network boundary; HUB does not carry ordinary business traffic.
Access revocation
When an admin disables an account or device, or tightens a policy, HUB notifies connected nodes to apply the change. An online Client clears the affected tunnel; a disconnected device is checked against current state when it authenticates again.
Engineering details
The control services are built with Go. PostgreSQL stores management data and current configuration state. HUB uses a gRPC control channel to communicate with nodes. WireGuard carries encrypted data between Clients and Gateways. Production capabilities depend on the released version and acceptance results.
Learn how to deploy and get started
The quick start lists the services, database, Gateway, and employee onboarding steps admins need to prepare.