Sign InGet Started Free
Features

Zero-trust control on a SafeZoneNet-managed mesh

Natural-language ACL drafting, policy simulation, posture checks, route approval, tamper-evident audit history, and field-level encryption at rest.

Security

Zero-trust architecture with defense in depth

Zero Trust Architecture

Every connection is verified. No implicit trust based on network location. Authenticate and authorize every request with cryptographic proofs.

  • Device certificate auth
  • 6 self-reported device posture checks
  • Least-privilege access via custom RBAC

WireGuard Encryption

Modern, fast, audited encryption. ChaCha20-Poly1305 with Curve25519 key exchange — the same primitives used by signal-grade messaging.

  • ChaCha20-Poly1305 / Curve25519
  • Perfect forward secrecy
  • Field-level AES-256-GCM at rest

Encryption at Rest

Sensitive fields are encrypted at rest with AES-256-GCM under a SafeZoneNet-managed key. Customer-managed keys are not offered.

  • AES-256-GCM field encryption
  • SafeZoneNet-managed key
  • Customer-managed keys: not offered

Audit & Tamper Evidence

Every audit row is HMAC-chained to its predecessor, so a modified or deleted row breaks the chain. This gives tamper evidence within the documented key and storage trust model — it is not a claim of cryptographic immutability.

  • HMAC-SHA256 hash chain integrity
  • Keyword search across audit events
  • SIEM integration + 365-day retention

Review Assistance

Policy, threat, audit, and compliance workflows with human approval paths

Threat Review

Rule-based anomaly scoring with LLM-drafted incident explanations. Unusual access signals are queued for an operator to review.

  • Reviewable threat context
  • LLM-generated explanations
  • Rule-based risk scores

Policy Drafting

Describe access intent in plain language, then validate and simulate ACL changes before rollout.

  • Natural language input
  • Policy simulation
  • Conflict prevention

Drift Signals

Recent access patterns highlight policies worth tightening. Find unused rules and over-broad grants before they become incidents.

  • Policy review suggestions
  • Unused-rule detection
  • Over-grant insights

Approved Response

Signals become reviewable actions so operators can approve isolation, session revocation, or policy changes with audit evidence.

  • Approval queue
  • Audited decisions
  • Human-in-loop

Audit Search

Search network and admin events by keyword to speed up investigation and evidence collection.

  • Keyword search
  • Forensic search
  • Compliance reports

Infrastructure

Mesh connectivity, relay fallback, and network health

Managed Relay

When a direct peer-to-peer path is not available, traffic falls back to a SafeZoneNet-managed relay. The relay forwards encrypted WireGuard packets and cannot decrypt them.

  • Encrypted relay fallback
  • Relay-assisted reachability
  • Tenant-scoped routes

SafeZoneNet-Managed Mesh

Direct WireGuard peer-to-peer when possible, relay-assisted when NAT prevents it. MagicDNS for automatic name resolution; subnet routes and exit nodes for legacy network reachability.

  • SafeZoneNet control plane + managed relay
  • MagicDNS · subnet routes · exit nodes
  • Direct paths preferred over the relay

Real-time Analytics

Deep visibility into network traffic, connection patterns, and usage trends. Make data-driven security decisions.

  • Traffic analytics
  • Usage trends
  • Custom dashboards

Network Health Score

Composite health score derived from live connectivity, performance, relay availability, and coverage signals. See trends before issues hit users.

  • Connectivity & performance
  • Relay availability
  • Trend visibility

Enterprise

Built for organizational scale

SSO & Identity

OIDC single sign-on with provider types for Google Workspace, Microsoft Entra ID (Azure AD), and Okta. SAML 2.0 is in limited beta and enabled on request.

  • OIDC (SAML 2.0 beta on request)
  • Google Workspace · Entra ID · Okta
  • Custom RBAC roles + audit chain

Sub-Organizations

Isolated workspaces within a single contract — perfect for MSPs managing multiple customers, or large enterprises separating business units. Full RLS-enforced tenant isolation, optional policy inheritance.

  • Included in Business, unlimited in Enterprise
  • Row-level security isolation
  • Optional parent-org policy inheritance

Audit Log Export

Export your tamper-evident audit log for an auditor to review. SafeZoneNet does not generate framework-mapped SOC 2, ISO 27001, HIPAA, or GDPR evidence packages. An export supports your assessment; it does not establish compliance or replace an audit.

  • HMAC-chained audit history
  • Exportable for auditor review
  • No framework-mapped evidence packages

API, CLI & Automation

Full REST API plus a multi-platform CLI (`safezonenet up`, `peers`, `routes`, `netcheck`). Notifications go to email, Slack, Teams, or any webhook; audit logs can be forwarded to Splunk or Datadog.

  • REST API + OpenAPI contract
  • CLI for Win / Mac / Linux
  • Email · Slack · Teams · webhook; audit logs to Splunk · Datadog

Guided Onboarding

Enroll devices with tenant-scoped join tokens and guided setup for managed mesh access.

  • Guided setup
  • Device enrollment
  • Join tokens

Security Center

Centralized security management with API key rotation, MFA enforcement, and device trust policies. Full control over your security posture.

  • API key management
  • MFA enforcement
  • Device trust

Billing & Usage

Transparent usage-based billing with detailed breakdowns. Export invoices, manage subscriptions, and track costs.

  • Usage tracking
  • Invoice exports
  • Cost analytics

Ready to get started?

Start with mesh access, ACLs, DNS, and audit history. No credit card required.

Start Free