// Zero-trust access · NEXUS Connect
Private access without the perimeter.
Connect users, devices, and agents to the resources they're authorized for — not to your network. Every connection is identity-aware, device-aware, least-privilege, time-bound, and revocable.
// live inspection
Access is created only after posture and identity check out — then it disappears.
laptop-macOS · disk unencrypted
Posturefail
ReasonFileVault off
RemediationEnable disk encryption
Resourcesnone
hover a request to inspect its decision
Device posture
- Encryption, lock, OS, and firewall checks
- Decision: pass → full · restricted → limited · fail → none
- Restricted devices get trimmed resource scope
- Deny-on-unknown by default
Secure connectivity
- Hybrid post-quantum handshake (X25519 + ML-KEM-768, FIPS 203)
- End-to-end session key never transmitted
- Least-privilege resource scoping
- Session list & instant revocation
Access & resources
- Guest & contractor time-limited links
- Sidecar fleet management with heartbeats
- Resource registration
- Magic DNS — private <resource>.<company>.nexus addressing
On the roadmap
- Native clients (Win/Mac/Linux/iOS/Android)
- Kernel WireGuard tunnels & split tunneling
- Real X25519MLKEM768 TLS termination
- Clientless browser isolation for contractors
Status: control plane, device posture, hybrid-PQC handshake, guest access, sidecar heartbeats and Magic DNS are live. The WireGuard kernel data plane and native clients are in private beta / simulated behind clean interfaces — SecKav does not yet ship a production tunnel client. This page reflects that honestly.