Endpoint Management & Monitoring

The Zero Trust Network Setup

Replace a traditional VPN with an identity-based zero-trust network — platform selection, deployment, an initial ACL policy, and onboarding for up to 5 users and their primary devices.

This engagement replaces a traditional VPN with an identity-based zero-trust network. We help you choose the platform — commercial managed options (Tailscale, Cloudflare Zero Trust, Twingate) or the self-hosted Headscale for customers who want to keep the control plane in-house — then deploy it, build an initial ACL/policy structure (scoped to 3 user groups and 10 internal apps in this engagement), and onboard up to 5 initial users along with their primary devices. Configuration documentation is handed over at completion so your own team can operate day to day. Digital-sovereignty-minded customers (EU, regulated industries, avoiding vendor lock-in) typically lean toward Headscale; customers who want convenience and zero operational burden typically lean toward a commercial platform. Either way, you keep paying the platform's own subscription directly — Headscale is free open source with no per-user fee. This is a one-off install: growth beyond the initial 5 users and their devices is priced separately, per unit, through our related onboarding and device-addition services.

What's included

Platform selection guidance across Tailscale, Cloudflare Zero Trust, Twingate, or self-hosted Headscale
Deployment of the chosen platform, including Headscale server install if self-hosted
Initial ACL/policy structure (scoped to 3 user groups, 10 internal apps)
Onboarding of up to 5 initial users and their primary devices
Configuration documentation handed over at completion

How it works

1
Book it — pay the fixed price, tell us your target environment
2
We deliver — an experienced specialist runs our standard workflow for this exact task; you can watch progress and ask questions
3
Hand-off — you get the deliverables, documentation, and a walkthrough if you want one

FAQ

How fast is delivery?: Standard delivery is within 100 weekday hours (≈ 7 working days). Express delivery — within 60 weekday hours (≈ 4 working days) — costs 25% more.
What happens once we grow past the initial 5 users?: Additional users go through The Zero Trust User Onboarding (per user, includes their primary device), and additional non-user-tied devices — servers, printers, IoT — go through The Zero Trust Device Addition (per device). This keeps the install fixed-scope and keeps growth priced per unit.
Which platform should we pick?: Customers wanting digital sovereignty (EU, regulated industries, avoiding vendor lock-in) typically choose self-hosted Headscale; customers prioritizing convenience and zero operational burden typically choose a commercial platform like Tailscale. We help you weigh the tradeoff during platform selection.
Do we pay you for platform subscriptions?: No. If you choose a commercial platform, you pay its per-user subscription directly. Headscale itself has no subscription cost; hosting its control plane on your behalf, rather than you running it, is a separate add-on.

Related services

Quick Win

The Zero Trust User Onboarding

US$30/user Fixed price

Onboard one new user, including their primary device, onto a zero-trust network that's already running — account provisioning, ACL assignment, and a connectivity test.

View details

Quick Win

The Zero Trust Device Addition

US$15/device Fixed price

Add a single non-user-tied device — a server, printer, IoT device, or a second device for an existing user — to a zero-trust network that is already running.

View details

Quick Win

The Guacamole & Zero Trust Network

US$1,350 Fixed price

The Guacamole gateway build extended with a zero-trust network layer — Tailscale or Cloudflare Access, device posture checks and session recording for audited environments.

View details