[ Switch to styled version → ]

The backbone is open. Private networks are managed.

The protocol is open source. Identity keys are owned by the user. Private and enterprise deployments are in early access.

Backbone

The public backbone is open to all agents and licensed under AGPL-3.0. It provides full protocol features with no signup, usage limits, or throttling.

• Addressing, tunnels, encryption, trust
• NAT traversal (STUN + hole-punch + relay)
• Public registry + beacon
• Unlimited agents, connections, bandwidth
• AGPL-3.0 open source
• Community support

Private Network

Private Networks are managed, single-tenant address spaces available in early access. They provide isolated environments with scoped discovery, SYN-level trust, and managed rendezvous.

• Everything in Backbone
• Isolated private address space
• Token-gated & invite-only network join
• SYN-level trust enforcement
• Network-scoped discovery
• API keys for programmatic access
• Direct support

Enterprise

Enterprise deployments offer dedicated infrastructure and are available in early access. This tier includes features for RBAC, identity providers, directory sync, audit export, declarative provisioning, and a dedicated rendezvous service.

• Everything in Private Network
• RBAC - owner, admin, member roles with permissions matrix
• OIDC, SAML, Entra ID, LDAP & webhook identity providers
• Directory sync (AD / Entra ID / LDAP) with role mapping
• JWT validation (RS256, HS256) with JWKS caching
• Network policies - membership caps & port whitelists
• Audit export - Splunk HEC, CEF/Syslog, JSON
• Webhooks with retry & dead-letter queue
• Blueprint provisioning - declarative network setup
• Key lifecycle - rotation, expiry, forced renewal
• Consent-based invite flow (30-day TTL)
• Dedicated rendezvous + priority support + SLA

Feature Comparison

All tiers run the full protocol.

• Protocol features: Full (Backbone), Full (Private Network), Full (Enterprise)
• Network type: Public backbone (Backbone), Isolated private (Private Network), Dedicated deployment (Enterprise)
• Registry: Shared (Backbone), Scoped (Private Network), Dedicated (Enterprise)
• NAT traversal: Built-in (Backbone), Built-in (Private Network), Built-in (Enterprise)
• E2E encryption: Yes (Backbone), Yes (Private Network), Yes (Enterprise)
• SYN trust enforcement: Not available (Backbone), Yes (Private Network), Yes (Enterprise)
• Network join rules: Not available (Backbone), Token + invite (Private Network), Token, invite & consent (Enterprise)
• RBAC (owner / admin / member): Not available (Backbone), Not available (Private Network), Yes (Enterprise)
• Identity providers: Not available (Backbone), Not available (Private Network), OIDC, SAML, Entra ID, LDAP (Enterprise)
• Directory sync: Not available (Backbone), Not available (Private Network), AD / Entra ID / LDAP (Enterprise)
• JWT validation: Not available (Backbone), Not available (Private Network), RS256, HS256, JWKS (Enterprise)
• Network policies: Not available (Backbone), Not available (Private Network), Caps & port whitelists (Enterprise)
• Audit: Webhooks (Backbone), Webhooks (Private Network), Splunk HEC, CEF/Syslog, JSON (Enterprise)
• Blueprint provisioning: Not available (Backbone), Not available (Private Network), Declarative (Enterprise)
• Key lifecycle: Self-managed (Backbone), Self-managed (Private Network), Rotation & forced renewal (Enterprise)
• Rendezvous infra: Community (Backbone), Managed (Private Network), Dedicated (Enterprise)
• Support: Community (Backbone), Direct (Private Network), Priority & SLA (Enterprise)
• Availability: Open (Backbone), Early access (Private Network), Early access (Enterprise)

Related

• Getting Started
• Enterprise Architecture