EasyAccess closes the three gaps in corporate access: private applications behind your perimeter, public SaaS that no network control can reach, and the open web on devices you do not manage. Every product is self-hosted, so traffic and identity data stay inside your own infrastructure.
Access controls tend to be built one layer at a time, and each layer leaves a gap the next one cannot see.
A VPN puts the device on your network and then trusts whatever it does there. One compromised laptop and an attacker is inside the perimeter, scanning everything the route table allows.
GitHub, AWS and the rest are reachable from any network on earth, by design. No firewall or tunnel can stand in front of them. The only moment every access passes through is sign-in.
Contractors, personal laptops and short-term staff still need to reach internal systems. Installing an agent is not always possible, and the open web they browse is not something you control.
Each product solves one of those gaps on its own. They share a foundation: self-hosted deployment, unified audit, role-based administration and clustered high availability.
Application-layer tunnels over QUIC that replace the VPN entirely. Every service is authorised separately and device posture is verified continuously, not only at connect time.
The browser runs in a disposable container inside your cluster and only a video stream reaches the endpoint, so nothing from the web is executed on the user's machine.
A hybrid identity provider that turns sign-in to public SaaS into a control point. It runs as your directory, or brokers to the one you already have.
Security software earns trust through the decisions it refuses to make. These rules are enforced in code and in review.
A control that fails open is not a control. Where enforcement is impossible, the system refuses rather than quietly weakening.
A device with a contradictory profile is not locked out. It is asked for a stronger factor. Denial is a policy decision, never a side effect of telemetry.
Clients submit discrete observations. They never submit conclusions, and there is no client-side bypass switch of any kind, including for test automation.
If an outcome cannot be carried out in the context that produced it, the system refuses it at runtime and warns the administrator at save time.
Sessions live in PostgreSQL; the in-memory cluster is only a cache. A patch or a node restart must never become a company-wide logout.
Every new policy check arrives disabled, and unknown configuration values deserialise to the safe default rather than to whatever was most permissive.
Regulated buyers do not take feature lists on faith. Controls are mapped to published frameworks and each claim traces back to code in the repository.
EasyAccess ZTNA ships a control matrix mapped to PCI DSS v4.0, ISO 27001:2022, SOC 2, NIST SP 800-53 Rev. 5, OWASP ASVS 4.0, GDPR and SWIFT CSP v2024.
SOC 2 Type II certification is in progress and ISO 27001 certification is planned. Mapping controls to a framework is not the same as holding a certificate, and we say which is which.
Every sign-in, session, policy change and administrative action is recorded, including the refusals. In EasyAccess SSO the audit log is hash-chained, because editing the record is an attacker's second move after taking an identity provider.
CycloneDX software bills of materials are generated from the build and committed to the repository, with third-party licence notices rendered from the same source. A new dependency fails the test suite until it has been reviewed.
There is no EasyAccess cloud for your traffic to pass through, and no per-seat subscription metered by the vendor.
Deploy onto your own Linux hosts with the supplied Ansible roles, backed by your own PostgreSQL. Suitable for data-residency regimes that do not permit a hosted control plane.
CloudFormation templates deploy a multi-AZ, auto-scaling stack with managed PostgreSQL, KMS-backed encryption and native integration into CloudWatch, Security Hub and Secrets Manager. Listed on AWS Marketplace.
No outbound dependency is required at runtime. EasyAccess ZTNA even builds its own map tiles for the geographic access view rather than calling a third-party tile service, so a closed network stays closed.
Tell us which of the three gaps is open in your organisation and we will walk through the product that closes it, on your architecture rather than a generic deck.