TartanStand up your org
Security

Locked down by default.

Every device checks every connection. Nothing gets in that you didn’t let in.

Stand up your orgor stand it up by hand with the CLI →
Every connection, checkedacme.tartan.net
laptop→files445/tcpallowed
phone→host3389/tcpno rule
192.168.1.40→files445/tcpno certificate
tech→host3389/tcp10 h left
phone→app443/tcpallowed
front-desk→acmerevoked
For frontline builders

Build it in-house. Share it safely.

Got people with no IT background building apps with AI? Protect your company from what they don’t know. The app stays inside your org, and your whole company can use it, at every site and from home, encrypted end to end. A partner org can have it too: one port, for as long as you choose.

HQ Warehouse Home 443 · 14 days partner org your.app.tartan.net
  1. Build it.Your team’s app, on a server in your org.
  2. Name it.your.app.tartan.net, with a real TLS certificate.
  3. Share it.With your people at every site. With a partner, if you choose.
Deep security

Four locks, one inside the next.

1234
  1. Encrypted, device to deviceCurve25519 keys, a Noise handshake, AES-256-GCM on the wire.
  2. Your org’s own authorityIt signs every device. Each device’s key is made on the device.
  3. A firewall on every deviceDefault deny. You open only what you need.
  4. A passkey for every changeBound to that one change, from an approved admin device.

Every change is logged: who made it, and from which device.

What each lock stops.

Stopped by lock 1

Someone taps the wire.

Every packet is encrypted, device to device. All they see is noise.

Stopped by lock 2

A laptop is stolen.

Revoke it. It’s off your network in seconds.

Stopped by lock 3

Someone fakes an IP address.

The firewall checks the certificate, not the address.

Stopped by lock 4

Someone phishes a password.

There isn’t one to phish. Passkeys only.

Locked by default

Every door is locked, unless you hold the key.

TARTAN445443laptop files phone app host printerA FIREWALL AT THE EDGE laptop files phone app host printer
  1. Less for IT to carry.One overlay that works everywhere. No tunnels to keep alive, no gateway to babysit.
  2. No address conflicts.Every device gets its own address. Sites keep the subnets they have.
  3. Less security to worry about.Default deny on every device. You open only what you need.

Hold your own ground.

Your network. Your names. Your rules.

Stand up your orgor stand it up by hand with the CLI →

Found a security issue? Read the security policy or /.well-known/security.txt.