Private network

Every location and every device, one private network.

Connect your offices, warehouses, branches, remote staff and phones. ShadowLatch shows where every device is, lets you say exactly who can reach what, and enforces it on each device, with traffic encrypted end to end. It runs on the same agent, in the same console, as everything else.

Locations

Every place you work, on one map.

Your offices, warehouses and branches each appear as a location with its networks inside it. ShadowLatch proves where a device is from the network it's on and the location's own address, so a laptop counts as at the office only when it really is. Devices that are out (at home, in a hotel, on cellular) sit in Away, and devices that aren't connected wait under Offline. Lines show which places and people can reach each other, live.

Verified locations, proven networks and network anchors that keep a location connected
Mesh links drawn between the exact devices, groups and networks they connect
Folds to the devices that matter when a location holds hundreds

Mesh links

Say who can reach what, in a sentence.

A link reads like a sentence: Remote staff can reach Main office using Remote desktop. Pick who (a device, a group, a profile or a whole location), where (a device, a location, or only some of its networks) and what (everything, a service you name, or ports). Two locations link both ways; everything else goes one way. Nothing is reachable until a link says so, and a block in a device's own profile always wins.

Location to location, group to location, device to device
Per service: Remote desktop, file sharing, SSH, or your own
Profile rules that block a service are shown on the link they override

ShadowLatch Mesh links with example data

Devices

Every device, where it is and how to reach it.

One page for the whole fleet: where each device is right now, its group and profile, its private network name and address, and whether it carries traffic for its location or relays for others. Filter to offline devices, devices on the mesh, devices away or anything that needs attention, and group the list by location or by group.

Private names like file-srv-01.internal on every device
Network anchor, carrier and relay tags at a glance
Search by name, address, version, user or note

A location, up close

Know why a device counts as here.

Open a location to see how ShadowLatch knows a device is there: the location's internet address and the network anchors that vouch for it. Below are its anchors, its networks, internal domains, the mesh links that use it, and whether devices may send their internet through it.

Static or changing internet addresses, both handled
Several anchors per location take over from each other
Internet through a location, for the profiles that ask for it

ShadowLatch A location, up close with example data

How it works

Private by design, simple to run.

Encrypted end to end

Traffic between your devices is encrypted on the device that sends it and decrypted only by the one that receives it. WireGuard does the encryption; ShadowLatch decides who may talk.

Direct when it can be

Devices connect straight to each other, through home routers and office firewalls, with no ports to open. When two devices can't, a relay you choose passes their already-encrypted traffic along. It can't read it.

Enforced on every device

Each device holds its own list of who may reach it, signed in your console. We can remove a device's access; we can't add one. A link never overrides a device's own blocks.

Internet your way, per profile

Most devices browse the internet on their own connection and reach only what their links allow. A profile can instead send its devices' internet through one of your locations, when away or always. If that location can't be reached, the internet pauses rather than leaving unprotected.

Phones and laptops on the road

Remote staff reach the office from home, a hotel or cellular the same way they do at their desk, by name or address, with the same rules.

Names that just work

Every device on the private network gets a name like file-srv-01.internal. Internal domains at a location resolve through it when a device is away.

Details

What you get.

The private network is part of the same agent that already shows and controls your devices' connections, so access between locations follows the same profiles, groups and audit log. Read what it records in our privacy policy.

Windows and Linux computers, servers and Android phones
Locations verified by their networks and internet address; devices away are recognized as away
Network anchors: always-on computers that carry a location's traffic, with automatic failover
One-click relays on your own devices, checked from the internet before they're used
Links by location, group, profile or device, per service or port, one way or both ways
Internet per profile: direct, through a location when away, or always through a location
Private names (.internal) for every device, and your internal domains when away
Lost or stolen: one click cuts a device off from the network
Every change signed in your console and recorded in the audit log

Connect your locations in an afternoon.

Install the agent on an always-on computer at each location, link who needs what, and you're done.

Request beta access See the whole product