Private by default

The access path

Devices connect to an encrypted mesh. A gateway and access policy forward traffic to the selected private workload. The service can keep its standard port and private address.

The customer does not need to publish a new public address for every VM, container, database, or internal tool.

Zero trust is an operating rule

The mesh authenticates peers. ACLs decide which peer can reach which deployment. The deployment authenticates the user or service. A connection is allowed because it satisfies those checks, not because it came from a trusted office network.

Use the mesh you already have

The default managed path uses NetBird. The architecture also supports customer-owned mesh choices and an audited bastion path where those fit the organisation better.

The important result is the same: management traffic stays off public interfaces.

The result

One private access boundary can serve many workloads. Exposure becomes an intentional property of a recipe, not an accidental consequence of how a VM was provisioned.