Every device.
Its own identity.
A URL.
Give every field device a cryptographic identity and a private or public URL — without opening a port.
- no inbound ports
- mutual TLS
- zero-knowledge relay
- one static binary
Online in three steps
No inbound ports. No runtime to install. One static binary.
Register the device
Add a device in the console and choose how its services are exposed.
Run the agent
Download a preconfigured agent or mint an enrollment token, run one installer, and the device connects itself.
Reach it anywhere
The device dials out to the relay; you reach it by hostname. It opens no inbound ports.
Boring where it counts. Sharp where it matters.
Per-device PKI
Every device holds its own CA-issued certificate. The private key is generated on the device and never leaves it.
Zero-knowledge passthrough
Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload.
Hostname routing
Many devices share one address, demultiplexed by hostname — no port-per-device sprawl.
Fast revocation
Revoke a device and its live tunnels drop in seconds — the relay re-checks certificate status continuously.
Isolated organizations
Every resource belongs to an organization, and the boundary is enforced and adversarially tested in CI.
Gateway fan-out
One agent can expose anything on the device network — cameras, PLCs, gateways — each service behind its own route.
Edge access rules
Attach IP allowlists, basic auth, or mutual-TLS to a route as edge access rules.
Account security
Console accounts get role-based access, optional TOTP two-factor, and an append-only audit trail.
Boring, ownable infra
No Redis, no Kubernetes, no external broker — infrastructure you could run yourself.
Docs that read like an engineer wrote them
Quickstart, a full console guide, the wire protocol, and an ESP32/Arduino device library — all at docs.tollan.ie.
Ship your first tunnel
Register a device, install the agent, and expose a service end to end — in a few minutes.
embeddedESP32 & Arduino library
A device-side agent for microcontrollers — a developer preview, kept wire-compatible with the rest of the fleet.
protocolThe tollan.v1 wire protocol
One authenticated connection, a handful of frames. Every agent implements it for you.
The relay never reads your bytes
Passthrough traffic is never decrypted at the relay. We route by TLS SNI without reading a single byte of your payload.
Read the security modelSimple, device-based pricing
Beta pricing — validated with our first fleet operators.