Your Installations Stay Private
Sites never expose ports. All connections are initiated outbound through encrypted tunnels — your installations remain invisible to the outside world.
[ 00 ]
Build worlds
that respond.
Connect devices, locations, and experiences with open-source orchestration.
[ 01 // FEATURES ]
Built for what you build.
You Decide What Flows Where
Every message between sites requires an explicit policy. Nothing crosses boundaries without your permission. Complete control over what data goes where.
Cryptographic Trust
Every device is verified with mutual TLS certificates. No passwords, no tokens — mathematical proof that each connection is exactly who it claims to be.
See Everything in Real Time
A live dashboard shows every connected site, every message flow, every heartbeat. Know the state of your entire installation network at a glance.
Isolated by Design
Each site gets its own cryptographically isolated account. A compromise at one location cannot affect another. Security is architectural, not bolted on.
Full History, Always
Every action, every connection, every policy change is logged with full context. When something happens, you can trace exactly what, when, and why.
[ 02 // PROCEDURE ]
Three steps to connected.
- Step / 0101
Install the Agent
Drop the lightweight agent onto each site. It connects outbound to the cloud gateway — no ports to open, no firewall rules to manage.
- Step / 0202
Connect to the Gateway
The agent authenticates with its unique certificate and joins the cloud mesh. Your sites can now see each other through the secure relay.
- Step / 0303
Define and Create
Set policies for what flows between sites. Route messages, synchronize state, orchestrate experiences across locations — all through a single control plane.
[ 03 // ARCHITECTURE ]
Serious infrastructure,
creative on the surface.
- 01Sitesoutbound TLS · zero ports exposed
- 02Edge ProxyEnvoy · rate limiting · TLS termination
- 03AuthmTLS + OIDC · cryptographic identity
- 04Message Routerpolicy-driven routing
- 05Cloud NATSisolated accounts per site
- 06Policy Engineevery flow explicitly allowed
- 07Control Planesite management, certs, audit
- 08Dashboardreal-time monitoring
NATS · FastAPI · PostgreSQL · mTLS · OIDC · Redis · Envoy
[ 04 // DOWNLOAD ]