Identity authentication and sessions
Employees sign in with administrator-created accounts. TOTP is available, and Passkeys are supported on compatible Windows Clients. The server checks active sessions and account status.
Platform capabilities: From identity to network enforcement
Encrypted tunnels protect data in transit. Zero-trust access also needs to identify the employee and device, evaluate access rules, and enforce the decision on the network. VeloTrust brings those steps into one self-hosted management flow.
What the platform does
A network connection does not grant access to every resource
VeloTrust manages access to private business resources: admins verify employee accounts and registered devices, assign permissions for work, and let Gateways enforce access rules.
Core capabilities
Clear boundaries from identity decisions to network enforcement
Device identity and management
A device is enrolled when an employee first connects and receives a device credential. Admins can review and disable devices, keeping employee and endpoint identity distinct.
Access policy by resource
Admins connect security groups to protected resources and define which connections are allowed. Access without a matching allow rule is denied by default.
Encrypted tunnel and network access
Clients and Gateways use WireGuard for encrypted data transport; business traffic reaches private resources through a controlled Gateway.
Configuration sync and enforcement
HUB compiles Client and Gateway configuration from current business policy and tracks synchronization through configuration digests and node acknowledgements.
Revocation and operations
Changes to employees, devices, or policies trigger access updates. Online Clients clear tunnels; offline devices are checked at their next authentication.
Zero-trust access flow
Every access request follows a clear security process
- 01
Verify identity
Employees sign in with their own account. Organizations can enable TOTP; Passkeys are supported on compatible Windows Clients.
- 02
Recognize the device
The Client enrolls on first connection. The control plane verifies the account and device credential on later connections.
- 03
Evaluate policy
Management connects employee groups to protected resources and decides whether the current connection is allowed.
- 04
Enforce access
HUB synchronizes configuration, and Gateways control which network resources can be reached.
- 05
Change or revoke
Admins update access when accounts, devices, or policies change. Online connections process revocation; offline devices are checked at their next authentication.
Compared with assembling components yourself
Put routine access administration into one workflow
Open-source components offer flexibility. Teams that configure accounts, devices, tunnels, routes, and access rules separately need to maintain the relationships between them. VeloTrust brings employees, devices, resources, and Gateway rules into one management flow to reduce switching between tools for routine access changes. Organizations still deploy and maintain the services and Gateways themselves.
Self-hosted deployment
Your organization controls where the platform runs
VeloTrust can run on infrastructure your organization owns or is authorized to manage. Deployment requires Management, HUB, a PostgreSQL database, and a Linux Gateway that can reach private resources. Your organization operates servers, networks, certificates, backups, and upgrades.
Review deployment requirementsReal-world scenarios
See how VeloTrust fits your access needs
Start with remote employee access and different resource needs by role, then plan around your existing network.
Explore solutionsStart by reviewing access and deployment needs
Explore the scenarios and quick start, then download a Client that is currently published.