A tenancy model that survives growth
Console, organisation, branch, gateway. Switching context is instant, and a gateway can be reached from any level without losing the page you were on.
Zero Trust Console
Every firewall you manage, in one console you host
Organisations, branches and gateways in one tree. Role-scoped access down to a single firewall. Installed on your own server, under your own domain, with your customers' data staying with you.
Building the network is drawing it
Place the sites and connect them. The console writes the configuration for both ends of every tunnel and pushes it — nobody opens a firewall and types a rule. Minutes, not an afternoon.
Gateways, from the fleet
The firewalls a customer already has, listed by site. Drag one onto the canvas and it becomes a spoke or the hub.
One hub terminates every tunnel
Everything arriving at the primary hub meets the same policy: application control, IDS/IPS, TLS inspection, DLP and the AI gateway.
Each tunnel reports itself
Up or down, latency, bytes in each direction — on the link, where you are looking, not in a log you would have to open.
Failover, chosen per topology
How quickly spokes move to a backup hub when the primary stops answering is a setting of the drawing, not of each firewall.
Change the drawing, then deploy
The canvas knows when it differs from what the firewalls run. One button writes the configuration for both ends of every tunnel and pushes it.
Tunnel transport
Chosen once for the topology.
- WireGuard
- Recommended
- OpenVPN
- Remote devices supported
- GRE
- Site to site only
People, not just sites
Remote users are added the same way, with a one-time enrolment link. Access is per device, so a lost laptop is revoked on its own.
Keeping the fleet current
Zedmos publishes the releases. You decide which firewalls take them and when.
Zedmos
We publish a release
For the console and for the firewall, on their own schedules. The console tells you one is available rather than waiting for you to look.
You
You choose who takes it
A few firewalls first, then the rest — or the whole estate at once. Upgrading a small group before the others is what finds a problem while it is still small.
You
You can see what is running where
The version of every firewall, in one list. A device that fell behind fell behind for a reason, and it is missing every fix since.
Where your customers live in the tool
Four levels. A role is granted at one of them and reaches everything below it — which is how a first-line engineer sees the customer they are assigned and nobody else's.
Console — yours
Installed on your server, under your domain. Every customer you manage is an organisation in it; the count here is the whole estate.
Organisation — one per customer
Switch it at the top and every page below follows: their firewalls, their policy, their reports, and no sight of anyone else's.
Branch — one per site
A customer with eleven offices is eleven branches under one organisation. A site engineer can be scoped to exactly one of them.
Firewall — the appliance itself
Whichever platform it runs, it registers into its branch on first boot and reports here.
Three roles, granted per level
Owner changes anything including who else has access; administrator changes policy and configuration; viewer reads reports and sessions and changes nothing.
What happens when you change a policy
Written once, in one place, for as many firewalls as it should reach — and enforced on each of them whether or not the console is reachable afterwards.
One token per customer
Generate a register token, put it in the installer, and the firewall registers itself into the right organisation and branch on first boot.
The estate at a glance
Registered, online, connected, offline. A firewall that stopped reporting is a number here before it is a phone call.
Filter by customer, site or state
The same list serves one engineer looking after one customer and the person responsible for all of them.
Versions, per firewall
Every firewall shows what it runs. A release is offered, not forced: a few firewalls first, then the rest, or the whole estate at once.
Live watch, from here
Open the live sessions of any firewall in the list without logging in to the firewall itself.
You
Write it at the level it belongs to
A rule for one customer sits at their organisation; one for a single site sits at that branch. A firewall added later inherits it without anyone editing anything.
You
See what it would do first
The risk in a policy change is never the syntax — it is a correct rule that matches more than you meant. Comparing it against real traffic surfaces that before your users do.
Zedmos
It reaches every firewall in scope
Distribution is reported per device, so a partial rollout is visible rather than assumed. Three failures out of forty is a fact you are told, not one you discover.
Zedmos
Each firewall enforces on its own
Management and enforcement are separate. If the console is unreachable, every firewall keeps enforcing what it already holds — a security control that failed when a management server did would fail at exactly the wrong moment.
- Unlimited
- Organisations
- 3 × 3
- Roles × scopes
- Self-hosted
- Deployment
- Docker
- Install
Every site on one map
Fleet · 1 of 9
The console opens on the whole estate: organisations, branches and gateways in one tree, and every site placed on a live map with its current health.
What the console gives an operator
Access you can actually delegate
Owner, administrator and viewer, each scoped to an organisation, a branch or a single gateway. A technician sees one customer; a partner sees their own.
Onboarding without a truck roll
An install token registers a firewall into the right organisation on first boot. It appears in the console, and policy follows.
Demo & pricing: info@zedmos.com
Request a demo