The developer experience
Install the client, authenticate with your IdP, and reach your services by name. No IP configuration, no shared VPN profile, no "what subnet is that on" questions.
Solutions · Developer Access
Secure developer access without a flat VPN.
Give engineers, operators, and remote workers scoped access to internal services and development environments — without issuing a flat-tunnel credential that opens the whole network.
Access the services you need. Not the subnet around them.
NetSeed routes access per service, per identity. A developer can reach their assigned database and internal API — not the neighboring services, the admin panel, or the production secrets store.
-
.ns service access Reach internal services by name — db.infra.ns, api.prod.ns — without managing VPN routes or /etc/hosts entries.
-
Local DNS / loopback VIP Services resolve locally in userspace. No kernel module, no root install, no system resolver rewrite.
-
User-level least privilege Access is bound to the identity that authenticated — not the machine, not the subnet. Engineers get exactly the services they are assigned.
-
Internal environment access Connect to staging, development, and production environments through separate access policies — same client, different scope.
-
Dev and troubleshooting access Issue scoped access for incident response and debugging without opening a standing gateway to the full production network.
How it works
Identity in, scoped access out.
Every developer session is bound to an authenticated identity. The access path is determined by policy, not by network proximity.
Authenticate
The developer authenticates through the organization's IdP via NSC. Device identity is bound to the session — managed device conditions can be applied.
Receive scoped config
NSD issues a signed configuration listing exactly which services and gateways are reachable for this identity. Nothing else is in scope.
Tunnel to gateway
NSC opens a WireGuard tunnel to the nearest NSGW. The gateway evaluates policy at ingress — unauthorized flows are dropped before reaching the site.
Site enforces, site records
NSN applies ACL next to the workload and proxies the connection. A per-flow audit record is emitted: identity, device, destination, policy, bytes.
The difference
Access by identity. Not by network proximity.
Service-level, not subnet-level
A session grants access to assigned services, not to the surrounding network. Lateral movement within the site requires a separate, explicit policy.
No shared credentials
Each developer session gets its own WireGuard keypair, generated on their device. There is no shared VPN profile to copy, leak, or share.
Every flow is a record
Connection logs are not enough. NetSeed records every flow: who reached what, from which device, under which policy, and how many bytes crossed.