Most teams finish onboarding in under an afternoon. Private resources come online the moment our lightweight connector image is live.
Almost nothing on their side. People sign in with the identity provider they already use, and the client sits quietly in the tray until a protected resource is requested.
Yes. Most rollouts keep the old tunnel available for a few weeks, move one team at a time, and retire it once the traffic has drained.
Sessions are encrypted end to end between the client and your connector. We route metadata only, so payloads are never readable by us.
Change tiers whenever you like from the workspace settings page. The remaining balance is prorated to the day and applied to your next invoice.
The first charge lands the day your trial closes, then on the same date each cycle. Seat additions are billed at the end of the period they were added in.
Any major card, plus bank transfer and annual invoicing on team and enterprise tiers. Purchase orders are accepted above 40 seats.
Device posture checks, a short session lifetime, and hardware keys for admins cover most of the remaining exposure once access is scoped per resource.
There is. Registered nonprofits and accredited schools receive 45% off every paid tier, and classroom labs under 25 seats are free for the academic year.