Network Enc

Harden the fleet. Keep the keys on one device.

Linux and Windows servers join an encrypted mesh only with proof you issued. A single-use harden token seals the network. Control actions require the creator device — strangers on the internet cannot stage, join, or unlock your fleet.

See how it works See how we prove it

Lock once. Unlock only from the creator.

Built for server fleets. Harden is the normal path; un-harden is a rare emergency protocol signed by the machine that created the network.

01
Creator device
The unlock key is born on one machine and never leaves it.
02
Proven agents
Servers join only with a join credential you mint — fake peers cannot register.
03
Signed harden
Staging the seal is signed by the creator. The harden token burns on first use.
04
Encrypted mesh
Agents talk through sealed tunnels. On dedicated hosts, firewalls fail closed around known peers.
05
Emergency un-harden
Only a one-time signature from the original creator device can reopen the network.

Trust is not open to the internet

Control-plane actions are gated. Public curiosity is not enough to change your network.

Creator registration protected by a bootstrap secret
Harden staging requires a creator device signature
Agents authenticate with a join token and proof of identity
Emergency unlock burns a single-use signed nonce

Built for private server networks

Keep internal systems sealed between the hosts you trust, on Linux and Windows.

Single-use harden — the token cannot be reused
Creator-only emergency unlock
Encrypted pathways between verified server agents
Works alongside TLS — not instead of it

Prove the seal. Expect outsiders to fail.

Real validation uses a dedicated second server — not a shared public web host. After harden, authorized checks confirm that strangers cannot join, stage, unlock, or ride the mesh without credentials you issued.

01
Dedicated peer
Install a second agent with fail-closed firewall on a machine that is not your public website host.
02
Harden once
Burn the single-use token from the creator device when the roster is ready.
03
Refusal checklist
Attempt join, stage, unlock, and mesh access without proof — each attempt should be refused.

Shared public hosts keep their firewall open so websites stay reachable. The seal proof lives on dedicated fleet servers.

Your network. Sealed.

Harden when ready. Keep the creator device safe. Un-harden only in an emergency.