Government
One secure network for every agency. Keys that never leave your hands.
Connect agencies, contractors and emergency responders in minutes, on the hardware you have. VeilNet holds none of your data, and no outside console sits between your teams and their work.
- Time to connect an agency
- Minutes
- New hardware
- None
- Root of trust
- Yours
- Data held by VeilNet
- None
Minutes, not a budget cycle.
Government networks often take longer to stand up than the programs they serve. VeilNet is one command, the same day, and it works alongside the legacy systems you can't touch.
No hardware
VeilNet is software for the machines you already run: Linux, Windows, macOS, FreeBSD and OpenBSD, on amd64 or arm64. No appliance to buy or accredit.
Rapid deployment
An operator commissions a machine in your guardian, and one command enrols it. It finds the network in under a minute, with no approval chain outside your agency.
One dashboard, full visibility
Your own console shows telemetry from every machine and records every renewal and control action, refusals included. Machines can also export to your own collector over OTLP.
Cut cloud complexity
Give each agency its own sub-realm on one network across every cloud and data centre. Two sub-realms can share a range, so each keeps its existing address plan.
Stays up when conditions don't.
Field units and incident sites rarely have good links. VeilNet finds a way through NAT and firewalls, takes the fastest route it can measure, and drops a failed gateway within two seconds.
Authenticated NAT and firewall traversal
Machines connect directly, by hole punching or through a relay, across agency firewalls and NAT. No port is forwarded at your sites, and anyone without a credential gets no reply.
Instant failover
Run two gateways for the same network. When one stops, or its traffic fails for two seconds, its flows move to the other, with no one at a console.
Multi-pathing
Every route is costed by measured round-trip time, and traffic takes the cheapest. Where several gateways serve one network, flows spread across all of them.
Unique device IDs
A relocated vehicle or a redeployed laptop keeps its ID and IPv6 address, because both come from its own post-quantum key, not the network it's on. The ID never rotates.
Australia's ISM sets the timeline: plan in 2026, be underway by 2028, and stop using RSA and elliptic-curve cryptography by the end of 2030.
Source: Australian Signals Directorate ↗Secure by default. Accountable by design.
Public-sector networks are persistent targets, and you answer for citizens' data. VeilNet encrypts and authenticates every connection against adversaries harvesting traffic today, and your own staff can verify it on your own systems.
End-to-end encryption
Every connection is sealed end to end with ML-KEM-1024 and AES-256-GCM, inside a hop-by-hop TLS 1.3 layer. A relay can't read the traffic or see the route.
Zero-trust authentication
No network location is trusted. Each machine presents its credential chain and an ML-DSA signature, and every peer checks it before any data moves.
Smarter permissions
Taints keep contractors and seconded teams in their own compartments. Named powers decide who may block machines or move them, and every link of a credential chain must grant a power for it to hold.
Validated and quantum-ready
On its FIPS base, your guardian's TLS, sign-in and key sealing run in a FIPS 140-3 validated module, certificate #4985. Connections use NIST's ML-KEM and ML-DSA, category 5 by default.
Looking for validated, quantum-ready networking?
Start with the service that can't afford downtime. The assessment shows which links lack post-quantum protection, what changes with VeilNet and what each option costs, and you keep the report whatever you decide.