Give your users clientless, zero-trust access to private web apps, RDP, SSH, and databases — right in the browser. Gateways dial out; no inbound ports, no client to install.
What it does
Publish web apps and native tools to the people who should reach them — and nobody else — without opening a single inbound port.
Reach private web apps and admin UIs through an opaque public host. Nothing to install.
Full Windows desktops and shells in the browser — no native client, no exposed ports.
Every session is authenticated and authorized per resource, per group, per tenant.
Gateways dial out to the edge. No inbound firewall holes, no port-forwarding, ever.
Public names reveal nothing — no tenant, site, protocol, or backend in DNS or certs.
Hash-chained audit, live sessions, and per-tenant bandwidth — built in, not bolted on.
Access what users need
Choose the access model that fits
A practical capability check for teams choosing between a VPN, an access proxy, or a private-resource gateway.
| Capability | StoneVeyl | Cloudflare Access | Tailscale PAM | Teleport |
|---|---|---|---|---|
| Clientless browser access | ✓ | ✓ | ✓ | Limited |
| Browser RDP and SSH | ✓ | ✓ | ✓ | ✓ |
| Native TCP tooling (SSH, DBs, custom clients) | ✓ | Client | Client | ✓ |
| Outbound-only gateway | ✓ | Tunnel | ✓ | ✓ |
| Per-resource identity policy | ✓ | Network ACL | ✓ | Network ACL |
| Opaque public authorities | ✓ | Optional | — | — |
| Tenant isolation and audit | ✓ | Plan-dependent | Plan-dependent | Plan-dependent |
| Self-hosted relay and gateway | ✓ | Connector | ✓ | ✓ |
Comparison is a capability guide, not a feature-count promise. Tailscale PAM is currently documented as beta. Confirm protocol, identity, hosting, and plan requirements for your environment. Vendor links point to current product documentation.
Deploy anywhere. Keep control.
StoneVeyl authenticates the user, carries the session across the edge, and sends it through an outbound gateway to the resource inside your network. Your backends never need a public address.
Identity, policy, and enrollment.
Public session transport.
Dials out from your network.
Web, RDP, SSH, SMB, or DB.
Clientless, zero-trust access to any private resource — no VPN, no inbound ports.