Zero trust network access

Replace your VPN with access that checks who and what device first.

ShieldPath grants each person access to the specific internal apps, servers and databases they need, based on their group in Okta, Microsoft Entra ID or Google Workspace and the health of their device. No open inbound ports, no flat network, no shared VPN password.

Start a 14-day trial See pricing

Clients: macOS, Windows, Linux, iOS, Android, ChromeOS
Connectors run on: Docker, Linux hosts, AWS, Azure, Google Cloud
Pricing from: $6 per user / month, 14-day trial

How ShieldPath decides who gets in

Five pieces work together on every connection request.

01 Resources, not networks
02 Identity from your IdP
03 Device posture checks
04 Connectors that dial out
05 Every connection on record

01 Resources, not networks

You define resources by hostname, IP or CIDR range and port. A user who is allowed to reach the Grafana dashboard sees only that address on port 443, not the rest of the subnet it lives on. Everything else in the network stays invisible to their device.

Resource list with access groups

S ShieldPath

Resources
Groups
Devices
Connectors
Activity

Resources

Network: aws-us-west-2

Protected resources

Protected resources
Resource	Address	Ports	Groups
Production Postgres Database	10.20.4.18	5432	Platform
Grafana Web app	grafana.internal	443	Engineering
Kubernetes API Cluster	k8s.prod.internal	6443	Platform
NetSuite sandbox proxy Web app	10.20.9.0/28	443	Finance

Illustrative product interface

02 Identity from your IdP

Users sign in through your existing identity provider with SSO and MFA. Groups sync over SCIM, so when someone moves from Support to Finance, or leaves the company, their access changes within minutes without a ticket to IT.

Groups synced from identity providers

S ShieldPath

Resources
Groups
Devices
Connectors
Activity

Groups

SCIM sync: 4 min ago

Synced groups

Synced groups
Group	Source	Members	Sync
Engineering	Okta	42	Synced
Platform	Okta	9	Synced
Finance	Microsoft Entra ID	7	Synced
Contractors	Google Workspace	5	Expires 30d

Illustrative product interface

03 Device posture checks

Before a connection opens, the client reports disk encryption, OS version, screen lock and whether your EDR agent is running. Policies can require a compliant device for sensitive resources, so a valid password on an unmanaged laptop is not enough to reach production.

Device compliance overview

S ShieldPath

Resources
Groups
Devices
Connectors
Activity

Devices

Policy: Production access

Compliant: 61; Allowed
Needs update: 4; OS below minimum
Blocked: 1; EDR not running

Recent checks

Recent checks
Device	OS	Result
MBP-ENG-014 FileVault on	macOS 15	Compliant
WIN-FIN-003 BitLocker on	Windows 11	Update OS
LNX-OPS-021 LUKS on	Ubuntu 24.04	EDR missing

Illustrative product interface

04 Connectors that dial out

A connector is a small container you run next to your resources, in a VPC, a data center or an office closet. It makes outbound connections only, so you need no public IP, no inbound firewall rule and no port forwarding. Run two per network for failover.

Terminal

$ docker run -d --name shieldpath-connector --restart unless-stopped \
  -e SP_NETWORK=aws-us-west-2 -e SP_TOKEN=$CONNECTOR_TOKEN shieldpath/connector:stable
Connector registered: conn-usw2-a
Outbound tunnel established on 443/udp
Status: online. Inbound ports open: 0

Illustrative product interface

05 Every connection on record

Each allowed or denied connection, sign-in and policy change is written to the activity log with user, device, resource and reason. Filter it in the console, export it as CSV, or stream it to your SIEM on the Business plan.

Activity log with allowed and denied connections

S ShieldPath

Resources
Groups
Devices
Connectors
Activity

Activity

Last 24 hours

j.alvarez · MBP-ENG-014 Connected to Production Postgres (5432) 09:42
LNX-OPS-021 Denied Kubernetes API: device EDR not running 09:31
admin Policy 'Finance apps' updated: require MFA every 12h 08:57
system Contractors group access expires in 30 days 08:00

Illustrative product interface

How we handle your traffic and data

An access product sits in the path of your most sensitive systems. These are the specific commitments behind every plan.

Encrypted end to end: Traffic between the client and your connector runs in a WireGuard tunnel. ShieldPath relays coordinate the connection but cannot decrypt the payload.
Keys rotate daily: Session keys are rotated at least every 24 hours and revoked immediately when a user or device is removed.
Admin accounts need MFA: Console access requires SSO with MFA. WebAuthn security keys are supported for admins.
Least privilege by default: New users can reach nothing until a policy grants a resource. Admin roles are split into owner, admin and read-only auditor.
Your logs, your retention: Activity logs are kept 30 days on Team and 180 days on Business, and can be exported as CSV at any time.
Deletion on request: When you close an account, configuration and logs are deleted within 30 days. Write to us for an earlier purge.

Questions IT teams ask first

How is this different from a traditional VPN?

A VPN puts a device on the network and then relies on firewall rules to limit it. ShieldPath never joins the device to the network. Each connection is checked against identity, group and device posture, and only the specific resource and port in the policy is reachable.

How long does deployment take?

Most teams have a first resource protected in under an hour: run a connector, connect your identity provider, write one policy, and install the client. Moving every VPN user over usually takes a few days of rollout by group.

Do I need to open firewall ports or get a public IP?

No. Connectors only make outbound connections, over 443/udp with a TCP fallback. Your resources keep their private addresses.

Which devices and operating systems are supported?

Clients are available for macOS, Windows, Linux, iOS, Android and ChromeOS. Connectors run as a Docker container or a Linux package on any host that can reach your resources.

Does all internet traffic go through ShieldPath?

No. Split tunneling is the default: only traffic to protected resources goes through ShieldPath. Everything else uses the device's normal connection.

Can we try it before paying?

Yes. Every plan starts with a 14-day trial with no card required. Refunds for paid subscriptions follow our Refund Policy, linked in the footer.

Protect your first internal resource this afternoon.

Tell us your team size and identity provider, and we will set up your trial workspace and send connector instructions within one business day.

Start a 14-day trial contact@shieldpath.online