Capabilities
What is built, what is shown in emulation, and what is planned.
§1 Built
Built
Built and self-tested in an emulated multi-owner environment.
Per-application identity and tunnels
Every application gets its own key, tunnel and isolated routing domain.
Owner-issued authorizations
Designed so only the network's owner can authorize a client; the operator cannot.
Overlapping address spaces
Owners keep their private ranges, even identical ones; source and destination addresses are translated in both directions.
Owner-set NAT binding policy
Dynamic, approval-gated, or static-only bindings for owner hosts — set per owner.
IPsec and WireGuard owner gateways
The service peers with the owner's existing gateway: WireGuard, or IPsec with IKEv2 and a pre-shared key, one gateway per owner. No changes inside the owner's network.
IPv4 and IPv6 inside the service
Dual-stack address realms and hosts; the carrier side is IPv4.
Mutual-TLS API and owner portal
Decide, request, revoke and read your own record; identity comes from certificates.
Verified revocation
Access is removed and checked before it is recorded as revoked.
On-board isolation policy
Clients are blocked from each other, the router and the flight controller; drops are counted and logged.
Per-owner placement in the service address realm
Each owner realm has its own block of service addresses; optionally, a host's address is the block plus the host part of its owner address.
Address assignment on first sight
Under the dynamic policy, an owner host within the owner's declared ranges gets its service address when first seen; the packet that reveals it is dropped, and traffic flows from the next.
One service address per client across owners
One IPv4 and one IPv6 service address per client, kept whichever owners it reaches.
Device record with licence check and address push
Optional licence validated at enrolment; access to each owner added on that owner's approval; the device is notified when its addresses change.
Certificate renewal and OTA updates over IPv6, per owner
A maintenance client renews a unit's certificate from that owner's own CA and fetches that owner's signed update through the service. The service holds no owner key; an update signed by another owner fails verification.
Time-bounded authorizations
A tenant may propose a time window; the owner sets it on approval and may narrow but not widen it. Access opens and closes by itself, and closing is verified like any revocation.
Per-tenant and per-device limits
Each tenant's API use is rate-limited by its certificate; each device's traffic is policed to a set rate before it reaches any owner's network.
Self-service onboarding
The operator invites a tenant with a one-time token; the tenant enrols from its own machine with a key it generated, then issues one-time tokens for its devices, which enrol the same way. Keys are generated where they are used; the service never holds them.
Encryption at rest
Tunnel keys, IPsec secrets and the device's evidence key and captured data are stored encrypted; plaintext a tool needs lives in memory only. Protection depends on where the key file is kept, and the operator guide says so.
Hash-chained audit log
Every decision recorded under the identity that made it; each owner reads the part that concerns it. The chain head is time-stamped by an RFC 3161 authority.
§2 Built — emulation only
Built — emulation only
Built, but its behaviour depends on real links, and it has been shown in emulation only.
Survives carrier NAT (CGNAT) and link handover
Designed to survive address changes, NAT mapping expiry and link switches without re-enrolment.
Link policy (cellular / satellite) with traffic classes
One active link at a time, with failover and return. Each class lists the links it may use, and store-and-forward data waits for one of them. No command or control traffic class is defined.
Store-and-forward with evidence at capture
Signed when captured, delivered in order, checkpointed at the service, verifiable by the owner.
§3 Roadmap
Roadmap
Planned for later releases.
Multipath QUIC transport
Tenant function plane (acceleration, inspection)
Shared clear-text functions run inside the service, between the tunnels, and never passed from one device to another.
Federated points of presence
Application-level gateways
Translation of IP addresses carried inside protocol payloads (for example FTP, SIP, SNMP traps), enabled per protocol and per owner realm.
On-device translation client
Optional translation on the device as well as in the service, so applications can use owners' own private addresses.