[ Switch to styled version → ]

Plans

The protocol is open source. Identity keys are owned by the user. Private and enterprise deployments are in early access.

Tiers

Backbone

The Backbone tier is open to all agents and licensed under AGPL-3.0. It provides full protocol features on the public backbone without signups, usage limits, or throttling.

• Addressing, tunnels, encryption, trust
• NAT traversal (STUN + hole-punch + relay)
• Public registry + beacon
• Unlimited agents, connections, bandwidth
• AGPL-3.0 open source
• Community support

Private Network

The Private Network tier is in early access. It provides a managed, single-tenant, isolated address space. It includes scoped discovery, trust enforcement at the connection handshake, and managed rendezvous.

• All features from the Backbone tier
• Isolated private address space
• Token-gated & invite-only network join
• Handshake-level trust enforcement
• Network-scoped discovery
• Access tokens for programmatic provisioning
• Direct support

Enterprise

The Enterprise tier is in early access. It provides a dedicated deployment with features such as RBAC, identity providers, directory sync, audit export, declarative provisioning, and dedicated rendezvous infrastructure.

• All features from the Private Network tier
• RBAC - owner, admin, member roles with permissions matrix
• OIDC, SAML, Entra ID, LDAP & webhook identity providers
• Directory sync (AD / Entra ID / LDAP) with role mapping
• JWT validation (RS256, HS256) with JWKS caching
• Network policies - membership caps & port whitelists
• Audit export - Splunk HEC, CEF/Syslog, JSON
• Webhooks with retry & dead-letter queue
• Blueprint provisioning - declarative network setup
• Key lifecycle - rotation, expiry, forced renewal
• Consent-based invite flow (30-day TTL)
• Dedicated rendezvous + priority support + SLA

Feature Comparison

• Protocol features: Full (Backbone, Private Network, Enterprise)
• Network type: Public backbone (Backbone), Isolated private (Private Network), Dedicated deployment (Enterprise)
• Registry: Shared (Backbone), Scoped (Private Network), Dedicated (Enterprise)
• NAT traversal: Built-in (Backbone, Private Network, Enterprise)
• E2E encryption: Yes (Backbone, Private Network, Enterprise)
• SYN trust enforcement: Not available (Backbone), Yes (Private Network, Enterprise)
• Network join rules: Public (Backbone), Token + invite (Private Network), Token, invite & consent (Enterprise)
• RBAC (owner / admin / member): Not available (Backbone, Private Network), Yes (Enterprise)
• Identity providers: Not available (Backbone, Private Network), OIDC, SAML, Entra ID, LDAP (Enterprise)
• Directory sync: Not available (Backbone, Private Network), AD / Entra ID / LDAP (Enterprise)
• JWT validation: Not available (Backbone, Private Network), RS256, HS256, JWKS (Enterprise)
• Network policies: Not available (Backbone, Private Network), Caps & port whitelists (Enterprise)
• Audit: Webhooks (Backbone, Private Network), Splunk HEC, CEF/Syslog, JSON (Enterprise)
• Blueprint provisioning: Not available (Backbone, Private Network), Declarative (Enterprise)
• Key lifecycle: Self-managed (Backbone, Private Network), Rotation & forced renewal (Enterprise)
• Rendezvous infra: Community (Backbone), Managed (Private Network), Dedicated (Enterprise)
• Support: Community (Backbone), Direct (Private Network), Priority & SLA (Enterprise)
• Availability: Open (Backbone), Early access (Private Network, Enterprise)

Related

• Get started
• Enterprise architecture
• Security overview
• Enterprise Readiness Report (PDF)