TartanStand up your org
How it works

Stand up your org in minutes.

Your AI runs the commands. You approve with your passkey. Every site, person and phone on one private network.

Stand up your orgor stand it up by hand with the CLI →
tartanrun by your AI
# your AI, standing up Acme with the tartan CLI
> tartan signup --new-org acme --org-name "Acme IT"
Creating your passkeyPIN or fingerprint
> tartan code create --org acme --kind device --zone user
> tartan device approve --org acme --device front-desk
Approve front-desk in acme.tartan.netPIN or fingerprint
# acme.tartan.net is up, and front-desk is on it.
>
How it works

Stand up your org in five commands.

  1. Stand up your org.

    Its name, its own IPv6 space, you as its Owner.

    > tartan signup --new-org acme --org-name "Acme IT"
    acme.tartan.net

  2. Make a join code.

    Hand it out as a code, a QR or a link.

    > tartan code create --org acme --kind device --zone user
    one-use code

  3. Let a device in.

    Your passkey approves it.

    > tartan device approve --org acme --device front-desk
    front-desk · on

  4. Give it a name.

    Reach it by name, not by address.

    > tartan name set --org acme --label files --target device:files-01 --state internal
    files.acme.tartan.net

  5. Share one thing.

    One partner org, one port, an end date.

    > tartan grant offer --org acme --grantee northgate --devices app-01 --grantee_groups staff --ports 443/tcp --ttl 14d
    443/tcp · 14 days
Overlay first

Get rid of the site-to-site mess.

Simplify with one overlay. Every site joins as is, conflicting subnets and all.

192.168.1.x10.20.0.x192.168.1.x172.16.0.x192.168.1.x10.10.0.x IPSEC TUNNELS · A VPN GATEWAYacme.tartan.net · one private IPv6 networkhqfd3c::a1warehousefd3c::b2yardfd3c::c3branchfd3c::d4shopfd3c::e5homefd3c::f6ONE TARTAN OVERLAY
The idea

What is overlay networking?

One encrypted network laid over the ones you already have. Devices talk straight to each other, by name, wherever they sit.

THE TARTAN OVERLAYdevices talk directly, encrypted end to endone private IPv6 /48 · a name for every device laptop desktop files nas printer camera phoneOne overlay on top of the networks you already haveTHE NETWORKS UNDERNEATH6 sites · 15 site-to-site tunnels · 3 sites on one subnet Site 1192.168.1.0/24 Site 2192.168.1.0/24 Site 310.20.0.0/24 Site 4192.168.1.0/24 Site 510.10.0.0/24 Site 6172.16.0.0/24 VPN gateway

What’s inside.

The overlay

Every device gets a certificate from your org’s own authority and its own private IPv6 address. Devices find each other and connect directly, through NAT, encrypted end to end.

Your org and its space

Its own private IPv6 /48, its own authority, its own names under acme.tartan.net. Never anyone else’s.

Names

Every device and resource reached by name, with a real TLS certificate. Only your Tartan names go to Tartan’s resolver; everything else resolves as before.

Sites and legacy systems

A pair of gateways on your own hypervisor brings a site in. Printers and appliances that can’t run the agent are reached by name, even when two sites share a subnet.

The firewall

Default deny on every device. Rules follow each device’s certificate, not its address, and you open only what you need.

Devices

On desktops the agent runs as a service, on from boot. Phones join by code, QR or link and stay on. A revoked device is off in seconds.

Partners and techs

Give a partner org exactly the names and ports you choose, with an end date. A tech on your team gets 10 hours at a time, signed off with their own passkey.

The control plane

It hands out certificates, names and rules, and keeps the audit log. It is never in your traffic’s path. Drive it from the console, the CLI or your AI.

Your network is your house.

Your network. Your names. Your rules.

Stand up your orgor stand it up by hand with the CLI →