Use cases
One network, many jobs
However your team describes the problem — "VPN replacement", "secure CI access", "reaching the NAS from anywhere" — the answer is the same identity-aware mesh.
However your team describes the problem — "VPN replacement", "secure CI access", "reaching the NAS from anywhere" — the answer is the same identity-aware mesh.
Secure internal access for your global team. Retire the legacy appliance and its ticket queue.
Explore →Servers, VPCs, and clusters reachable by name — zero bastion hosts, zero exposed ports.
Explore →Just-in-time, fully audited SSH / K8s / database sessions instead of shared credentials.
Explore →Inventory every AI service on your network, then set allow / log / block policy per team.
Explore →Deny-by-default rules keyed to identity, reviewed like code, applied everywhere.
Explore →SSO, SCIM, audit logs, and network-as-code for organizations with real compliance needs.
Explore →Production-grade networking on the free plan until you're big enough to pay.
Explore →Your NAS, Pi cluster, and desktops on one private network. Free for up to 3 users.
Explore →Deeper dives on the situations teams bring us most.
Any app, any device, any network — identity-checked every time.
Explore →AWS + GCP + Azure on one private mesh, no transit hubs.
Explore →Clusters on the tailnet — pods, services, and node SSH, privately.
Explore →Fleets that dial out — robots, kiosks, gateways on one mesh.
Explore →Publish apps to the tailnet — not the internet.
Explore →Offices and data centers as one LAN, minus the IPsec ceremony.
Explore →Private paths into every VPC and VNET — no transit hubs, no public endpoints.
Explore →Servers and clusters by name and identity — zero bastion hosts.
Explore →Deny-by-default keyed to identity — without the multi-year program.
Explore →Every agent gets a scoped identity — not the keys to the kingdom.
Explore →They all start the same way: install, log in, connected.