Every static credential is a copy that outlives the reason it was made. Ankayma replaces them with identity that is bound to a device, expires on its own, and lands in a signed record.
This page is the architecture. If you want the specific credential you're trying to kill, start at Solutions instead.
Ankayma layers a sovereign zero-trust path on top of what you already run — you choose what joins the mesh; everything else stays exactly as it is.
No app-by-app migration, no 3–6 month cutover. Running side-by-side isn't a phase you endure — it's how Ankayma is built.
| Component | Role | Who controls it |
|---|---|---|
| Direct path (P2P) | The default path between two nodes | No third party on it, including us |
| Relay | Fallback when P2P can't be established — strict NAT, restrictive firewall | Open source. You can run it on your own infrastructure, in which case fallback traffic never leaves systems you operate |
| Control plane | Coordinates connection setup, identity and policy. Never on the data path | We operate it in the standard configuration. Region-pinned or on-premises is an Enterprise option |
Most access vendors won't draw this table, because the honest version of it is their business model. Ours is: your traffic doesn't traverse infrastructure we operate — by architecture on the direct path, and by your own deployment on the fallback. Connection coordination still runs on our side unless you pin it.
The control plane participates in establishing a connection. It isn't in the path of one. When it's slow or unavailable, sessions already running continue normally. What's affected is establishing new connections and issuing new policy.
Two boundaries, because the people who ask this question ask both:
Fail-static has a duration. Node certificates have a finite lifetime. An outage longer than that ends sessions, because certificates can't renew. Certificate lifetime is a parameter, and it decides how long an outage you can absorb.
There's a trade-off on the other side. The same mechanism that keeps sessions alive means a new revocation doesn't reach running sessions during an outage. Maximum revocation latency equals certificate lifetime.
One parameter moves both. Shorter means faster revocation and less outage tolerance. Longer means the reverse. It's a designed trade-off, not an accident, and where you sit on it is your call.
NoSecret, NoKey, NoVPN, NoPass and NoAPIKey aren't five products. They're five surfaces of one access model, and they write to the same ledger.
That's the part that only matters at organizational scale — and it's why there's a separate Enterprise line rather than a bigger plan.
The mesh agent, CLI, and the app are open source on GitHub. Read every line before you install — review the code, build it yourself, and audit exactly what runs on your infrastructure. Releases are Cosign-signed, so you can verify what you run matches what we published. We keep it open because trust should be verifiable, not asked for.
Review the source on GitHub →