One private network for your whole team.
Zap Edge connects laptops, servers and cloud workloads into a single encrypted mesh. No VPN concentrators, no open ports, no firewall tickets — just identity-based access that works from anywhere.
14-day trial · No credit card · SSO on every plan
Everything a modern network needs. Nothing it doesn't.
Replace legacy VPN appliances and bastion hosts with a lightweight agent and a policy file your whole team can read.
Zero-trust by default
Every connection is authenticated against your identity provider and checked against policy. Devices see only what they're allowed to.
Peer-to-peer speed
Traffic flows directly between devices over modern encryption. Relays in 12 regions kick in only when NAT gets in the way.
Policy as code
Define access in a single readable file, review it in pull requests, and roll it out with your existing CI pipeline.
SSO & SCIM
Works with Google Workspace, Microsoft Entra ID, Okta and any OIDC provider. Off-boarding revokes access instantly.
Audit-ready logs
Every connection attempt is logged with user, device and policy decision. Stream to your SIEM or export for compliance reviews.
Every platform
Native agents for macOS, Windows, Linux, iOS and Android, plus a container image for Kubernetes and CI runners.
Up and running before your coffee cools.
No hardware, no network redesign. Install the agent, sign in, and your devices find each other.
Install the agent
A single package on servers — zap up --auth-key … — or a regular app on laptops and phones.
Sign in with SSO
Devices join your private network automatically and get a stable address that never changes.
Write your policy
Decide who can reach what: engineers to staging, CI to the registry, finance to nothing but the ERP.
Simple pricing that scales with your team.
Billed per active user. Servers and service accounts are always free.
Team
- Everything in Starter
- Policy as code & ACL reviews
- Any OIDC provider, SCIM
- 30-day audit log
Enterprise
- Dedicated relays & regions
- SIEM streaming, 1-year logs
- 99.99% SLA, 24/7 support
- Security review & DPA
Questions, answered.
Is Zap Edge a replacement for our existing VPN?
For most teams, yes. Zap Edge covers remote access, site-to-site links and access to cloud workloads. You can run it alongside your current VPN during migration.
Where is our data processed?
The control plane runs in Frankfurt. Your traffic goes directly between your own devices and is end-to-end encrypted; relays can't read it.
Do we need to open any firewall ports?
No. Agents only make outbound connections, so there is nothing new to expose to the internet.
Can we self-host the relays?
Enterprise customers can run dedicated relays in their own infrastructure or choose specific regions.
See Zap Edge on your own network.
Tell us a little about your team and we'll set up a 30-minute walkthrough tailored to your stack.