[ Switch to styled version → ]

Plans

The protocol is open source. Identity keys are owned by the user. Private and enterprise deployments are in early access.

Tiers

Backbone

The Backbone tier is open to all agents and licensed under AGPL-3.0. It provides full protocol features with no metered plan limit; fair-use and security controls still apply.

• Addressing, tunnels, encryption, trust
• NAT traversal (STUN + hole-punch + relay)
• Public registry + beacon
• No metered agent or bandwidth plan limit
• AGPL-3.0 open source
• Community support

Private Network

The Private Network tier is in early access. It provides a managed, single-tenant, isolated address space. It includes scoped discovery, trust enforcement at the connection handshake, and managed rendezvous.

• All features from the Backbone tier
• Isolated private address space
• Token-gated & invite-only network join
• Handshake-level trust enforcement
• Network-scoped discovery
• Access tokens for programmatic provisioning
• Direct support

Enterprise

The Enterprise tier is in early access. It provides a dedicated deployment with features such as RBAC, identity providers, directory sync, audit export, declarative provisioning, and dedicated rendezvous infrastructure.

• All features from the Private Network tier
• RBAC - owner, admin, member roles with permissions matrix
• OIDC/JWT validation & external identity bridges
• Directory mapping for existing agents and roles
• JWT validation (RS256, HS256) with JWKS caching
• Network policies - membership caps & port whitelists
• Audit export - Splunk HEC, CEF/Syslog, JSON
• Webhooks with retry & dead-letter queue
• Blueprint provisioning - declarative network setup
• Key lifecycle - rotation, expiry, forced renewal
• Consent-based invite flow (30-day TTL)
• Dedicated rendezvous + priority support + negotiated SLA options

Feature Comparison

• Protocol features: Full (Backbone, Private Network, Enterprise)
• Network type: Public backbone (Backbone), Isolated private (Private Network), Dedicated deployment (Enterprise)
• Registry: Shared (Backbone), Scoped (Private Network), Dedicated (Enterprise)
• NAT traversal: Built-in (Backbone, Private Network, Enterprise)
• E2E encryption: Yes (Backbone, Private Network, Enterprise)
• SYN trust enforcement: Yes (Backbone, Private Network, Enterprise)
• Network join rules: Public (Backbone), Token + invite (Private Network), Token, invite & consent (Enterprise)
• RBAC (owner / admin / member): Not available (Backbone, Private Network), Yes (Enterprise)
• Identity providers: Not available (Backbone, Private Network), OIDC and external identity bridges (Enterprise)
• Directory sync: Not available (Backbone, Private Network), directory mapping for existing agents (Enterprise)
• JWT validation: Not available (Backbone, Private Network), RS256, HS256, JWKS (Enterprise)
• Network policies: Not available (Backbone, Private Network), Caps & port whitelists (Enterprise)
• Audit: Webhooks (Backbone, Private Network), Splunk HEC, CEF/Syslog, JSON (Enterprise)
• Blueprint provisioning: Not available (Backbone, Private Network), Declarative (Enterprise)
• Key lifecycle: Self-managed (Backbone, Private Network), Rotation & forced renewal (Enterprise)
• Rendezvous infra: Community (Backbone), Managed (Private Network), Dedicated (Enterprise)
• Support: Community (Backbone), Direct (Private Network), Priority & negotiated SLA options (Enterprise)
• Availability: Open (Backbone), Early access (Private Network, Enterprise)

Related

• Get started
• Enterprise architecture
• Security overview
• Enterprise Readiness Report (PDF)