Zero Trust Network Access

One network.
Every exit.

Smart routing and automatic failover across gateways and DNS you run yourself. Add Pulse Orbit when you want managed egress, one region at a time. It covers every site, cloud and device, without backhauling traffic through an appliance.

Book a demo → See pricing
Runs in your network · Self-hosted gateways & DNS · Pulse Orbit egress

Application-aware access

Policy follows the app and the identity, not the IP address.

01 · AGENT

It starts on the device.

Every connection begins with a verified identity: the user, the device posture, the app making the request. No identity, no path.

  • SSO identity + device posture check
  • Works on any OS, any network

02 · GATEWAY

Policy is evaluated at the gateway.

Per-app, per-identity rules resolve at the gateway closest to the request. The gateway knows the application, not just an IP and a port.

  • Per-app, per-identity policy
  • No brittle IP allowlists

03 · EGRESS

Egress on your terms.

Leave from your own exit nodes, or hand egress to Pulse Orbit. Pin the region, keep your keys, and decide what gets logged, down to nothing at all.

  • Self-hosted or Orbit egress
  • Region pinning + logging you control

04 · APP

A private path to the app.

The connection lands on the application directly. It is never exposed to the public internet, and resolves through internal, app-based DNS.

  • Apps never exposed publicly
  • Internal / app-based DNS

Pulse Orbit · Managed Egress

Global egress, when you want it.

Egress is a choice. Keep it all in your own network with self-hosted gateways and DNS, or hand it to Pulse Orbit: managed exit regions you opt into one by one, each tagged for data residency and health-checked continuously. Smart routing picks the fastest path, live.

·Opt-in by region ·Data-residency tags ·Smart routing built in
pulse-agent · egress simulation
Agent online. Waiting for egress request…
exit policy orbit · region uk-lon · residency UK ✓
● londonscore 94
● frankfurtscore 81
● new yorkscore 47
smart routing → london · tunnel up

Your data, your control

We route it.
We never read it.

Egress from your own nodes, pin the region, and decide what gets logged: full, metadata only, or off. Privacy is the default, not an upsell.

·BYO exit nodes ·Region pinning ·Logging you control

Smart routing · The HA in PulseHA

Every path scored.
Every failure survived.

Gateways are ranked on live signals for latency, load, region and priority, and every agent keeps re-measuring its own round-trip times. When a path goes quiet, traffic moves to the next-best gateway in seconds, and the event lands in your audit log.

routes · payments-api re-ranked live
●gw-lon-2 score 94 · active
●gw-ams-1 score 87 · standby
●gw-lon-1 handshake stale
↯failed over to gw-lon-2 · detected in seconds · ✓ audited
<5 s
Failover detection
6
Live routing signals
30 s
Route re-optimization
0
Apps exposed to the internet

Everything in Network

The whole surface, up front.

Nothing buried behind a sales call. Every plan includes the full self-hosted network.

◧

Zero trust access Lead

Identity- and app-level policy across any port or cloud, with no IP allowlists to keep up to date.

payments-api allow internal-db allow legacy-smb blocked
⛉

Your data, your control Lead

BYO exit nodes, region pinning, and logging you control: metadata, full, or off.

⤬

High availability

Ranked multi-gateway failover, detected in seconds. The HA in PulseHA.

↯

Smart routing

Paths scored on latency, load, region and priority, re-ranked live.

⇄

Pulse Orbit egress

Managed exit regions you opt into one by one, each tagged for data residency.

▦

Self-hosted gateways

Deploy at any site or cloud, with health, metrics and tunnels in one console.

⊚

Internal / app DNS

Private resolution mapped to apps.

◎

Site-to-site

Connect whole networks behind gateways, with no appliance mesh to maintain.

⊞

SSO & SCIM

SAML, OIDC and Entra auto-login, with SCIM provisioning and JIT.

Test before you trust

Simulate any access decision before it ships.

Pick a user, a device and a service, and watch the decision resolve stage by stage, from posture and device to access and egress, with the exact policy that matched. No guessing in production.

policy simulator 
# simulate · who can reach what, and why
user     dana@acme.com
device   macbook-dana · managed
service  payments-api

→ posture   ✓ pass  # disk encryption · screen lock
→ device    ✓ pass  # managed · agent up to date
→ access    ✓ allow # matched policy: eng-payments
→ egress    orbit · eu-central # region pinned

decision ALLOW

Built for teams who cannot afford an outage.

Level 1K Logo

“When a game server falls over, we have minutes to fix it before players leave. That only works if we can reach it. PulseHA keeps our team's access to every site up when a gateway dies, and none of our panels or databases are open to the internet.”

David, Co-founder, Level 1K
Microsoft Azure

Self-hosted gateways on the infrastructure you already run, including Azure, with health and policy in one console.

Oliver Chen
James Walker
David Okonkwo
Anna Kowalski
Sarah Mitchell
Nathan Brooks
+1

Built by engineers who operate production networks. Security tooling should earn trust in the path, not the pitch.

Plans

The self-hosted network ships in every tier.

Run your own gateways, exits and DNS on day one. Pulse Orbit and security unlock at Business and above.

Core

For small teams getting started with zero trust access.

  • Zero trust access
  • Self-hosted exit nodes
  • Pulse Orbit egress
Contact sales
Most popular

Business

For growing teams who need more control and visibility.

  • Everything in Core
  • Pulse Orbit egress (3 regions)
  • Advanced security & SSO
Contact sales

Enterprise

For organizations with advanced security and compliance needs.

  • Everything in Business
  • All Pulse Orbit regions
  • Custom limits & SLAs
Contact sales

Full feature breakdown on the pricing page →

Better together · Business and up

Network pairs with Pulse Security.

Same policy engine, same fabric. Add DNS-layer threat blocking without adding a single appliance.

  • DNS-layer threat blocking on the gateways you already route through.
  • One policy model: the same identity- and app-aware rules.
  • Unlocks at Business tier and above. No migration, just switch it on.
Explore Security
⛨ pulse-security · live events Active
✕ 09:42:01 crypto-drainer.net · malware feed block
✓ 09:42:03 payments-api → stripe allow
✕ 09:42:06 unmanaged host · posture denied block
✓ 09:42:09 eng-payments · internal-db allow