ZitiNexus: Zero Trust Network Access

What it is

ZitiNexus is a multi-tenant management platform for OpenZiti networks. It replaces the VPN with identity-based private access: instead of putting a user "inside" the network and trusting everything behind the firewall, every request is authorised against a policy for a specific service, by a specific identity, on a specific device.

The portal is the control plane. Network traffic does not pass through it — it flows directly between the client and the service through the OpenZiti fabric, so the management layer is never in the data path and never becomes a bottleneck.

What you get

Tenant isolation by construction. Every tenant gets a unique resource prefix, its own administrators and its own view of the network. Two tenants cannot see or reach each other's identities, services or routers — not by policy alone, but because the resources are namespaced apart.

Full control over the access model. Create and manage identities with group assignments, define services with multiple endpoints, and set host and intercept configurations. Policies then decide which identity may reach which service.

Router provisioning with enrollment tokens. Deploy edge routers and enrol them without manual certificate handling.

Role-based administration. Super-admin, tenant-admin and user roles, so a tenant can run its own access without seeing the platform.

Single sign-on. Keycloak OIDC integration, with tenant provisioning designed for automated onboarding.

Endpoints

ZitiNexus serves clients across the platforms your staff actually use:

Platform	Client
Windows	Machine Tunnel — access without per-app configuration
macOS	Native edge client
iOS and Android	Native edge client
Linux	Tunnel service

A machine tunnel matters for managed fleets: the endpoint is reachable by identity before anyone logs in, which is what makes patching and remote administration work without a VPN.

Why it replaces a VPN

A VPN answers one question — is this user on the network? — and then grants broad access. ZitiNexus answers a narrower, more useful one on every request: may this identity reach this service, right now?

The practical consequences:

• A stolen credential does not open the estate; it opens the services that identity was already entitled to.
• Access is per application, so a contractor can reach one internal tool without seeing file shares or the ERP.
• Every authorisation is logged against a named identity, which is what auditors actually ask for.
• There is no concentrator to size, patch or expose.

Where it fits

ZitiNexus is suited to organisations replacing legacy VPN concentrators, publishing internal applications to remote staff without a DMZ, or consolidating per-application access under one auditable policy set.

It is operated from Singapore and currently optimised for the Southeast Asia region.