Remote Everything. Without the complexity.
Mesh VPN for teams — works with the Tailscale app on every device you already own. Use our cloud or run the entire control plane on your own infrastructure.
WireGuard® at the core. Mesh orchestration, mTLS pinning, perfect forward secrecy.
curl -fsSL https://netiium.com/install | sh- 1. Run netiium pair on the device.
- 2. Scan the QR in Console.
- 3. Assign policy, access, and update rings.
Demo UI — replace with your real console data.
Everything you need for remote ops.
Netiium combines secure connectivity, policy controls, and fleet workflows — tuned for measurement, automation, and industrial control.
Console-first workflow
One place to pair devices, assign policies, and reach remote UIs — with full audit context.
Remote GUIs that feel local
Stream instrument interfaces and control channels with adaptive shaping for high-latency links.
- Low-latency control channels
- Adaptive bitrate & bandwidth caps
- Privacy guards for input capture
OTA Fleet Ops
Atomic updates with checksum verification and instant rollback across hundreds of devices.
- Phased rollout and ring fencing
- Signed artifacts, immutable logs
- Realtime progress & alerts
Policy & Access
Zero-trust defaults with per-device policies, least privilege, and session accountability.
- RBAC, scoped roles, approvals
- mTLS pinning and ephemeral keys
- SSO-ready (SAML/SCIM)
Audit-ready logging
Cryptographic logs built for traceability and compliance workflows.
- Signed events and export
- Device & session history
- ISO 17025 & 21 CFR Part 11 friendly
From install to access in minutes.
A simple flow that scales from one bench to a global fleet — without re-architecting your network.
-
01
Install the agent
Drop Netiium onto a device or gateway (ARM/x86) and enroll it securely.
netiium install -
02
Pair
Pair devices in seconds using QR or enrollment codes — no inbound ports required.
netiium pair -
03
Policy
Enforce least privilege with scoped roles, time windows, and approvals.
RBAC mTLS Audit -
04
Operate & automate
Reach remote GUIs, APIs, and tunnels — then keep fleets healthy with updates and alerts.
Remote UI • SSH • Protocol tunnels • OTA
Use offline bundles and signed artifacts.
Deploy the control plane behind your firewall.
NAT traversal with identity-bound tunnels.
Zero‑trust by default.
Netiium assumes hostile networks and proves identity at every hop — with clear audit trails for regulated environments.
- mTLS pinned sessions with short-lived keys.
- Least privilege via scoped roles and policies.
- Tamper-evident logs for traceability and exports.
- PFS encryption (WireGuard® core, ChaCha20-Poly1305).
Identity & access
Manage teams and devices with clear scopes and approvals.
- RBAC and custom roles
- Time-bound access
- SAML/SCIM ready
Compliance workflows
Built for regulated labs and safety critical operations.
- Signed session logs
- Export & retention controls
- ISO 17025 & 21 CFR Part 11
Hardware-backed trust
Optional device attestation and secure key storage.
- TPM / Secure Enclave support
- Ephemeral session material
- Key rotation policies
Safe operations
Guardrails for remote control and updates at scale.
- Phased update rings
- Rollback and health checks
- Alerting hooks
Global performance. Local feel.
Our user-space WireGuard® core minimizes handshake overhead and traverses NATs with ease — anywhere on Earth.
Simple pricing, no surprises.
Free forever for individuals. Pay per active user when you scale. Enterprise customers can self-host the full control plane under a commercial license.
Free
For individuals and personal use.
- 3 users
- 100 devices
- 1 network
- MagicDNS & internal hostnames
- NAT traversal
Plus
For small teams getting connected.
- Unlimited users
- 100 devices + 10 per user
- 3 networks
- MagicDNS & internal hostnames
- Split DNS
Team
For growing teams and labs.
- Unlimited users
- Unlimited devices
- Unlimited networks
- Split DNS & custom records
- Audit logs & flow logging
- Full ACL policies
- Priority support
Enterprise
For regulated, security-critical, and air-gapped deployments.
- Unlimited users & devices
- Self-host the full control plane
- Commercial license — perpetual or annual
- SAML/SCIM & RBAC
- Air-gapped & on-prem deployments
- Dedicated support & SLA
An active user is anyone who connected to a network that month. Device limits are pooled across the account. Annual billing saves ~25%. Volume discounts and on‑prem licensing available for Enterprise — contact us.
Frequently asked questions.
Quick answers for security teams, operators, and engineers.
What counts as a device?
Any machine running the Netiium agent — a laptop, server, cloud VM, or gateway router. Each enrolled device counts as one toward your plan.
Do I need to open inbound ports?
No. Devices enroll outbound, then you reach them through identity and policy. NAT traversal is built in.
Can we run Netiium on‑prem or air‑gapped?
Yes. Enterprise customers can self-host the complete Netiium control plane — coordination server, relay nodes, identity provider, and admin console — entirely inside their own infrastructure under a commercial license. No data ever reaches our servers. Air-gapped and offline bundle deployments are supported. Contact sales for licensing details.
Can I use the Tailscale app with Netiium?
Yes. Netiium is compatible with Tailscale clients on iOS, Android, macOS, and Windows. Point the Tailscale app at your Netiium network coordinator URL and it connects just like Tailscale's own service — except your coordination server is Netiium. Linux servers use our native sidecar agent, installed with a single curl | sh.
How does Netiium compare to Tailscale?
Netiium and Tailscale are both WireGuard-based mesh VPNs with similar feature sets. The key differences: Netiium is priced at $6–$15/user vs Tailscale's $6–$18/user; Netiium lets enterprise customers self-host the entire control plane (Tailscale does not); and your private keys never leave your devices — our coordination server never sees them. If you already use the Tailscale app, you can point it at Netiium without installing anything new.
How do audit trails work?
Netiium records signed events for enrollments, access sessions, policy changes, and updates — with exports suitable for compliance workflows.
What can I access remotely?
Secure tunnels for device UIs and protocols (e.g., web consoles, SSH, RDP/VNC-style remote desktops), plus fleet operations like OTA updates and health checks.
Still have questions? Talk to us.
Ready to connect your devices?
Start free — no credit card required. 100 devices on the free plan. Upgrade to Plus at $6/user/month or Team at $15/user/month when you scale. Need to self-host everything? Ask about Enterprise licensing.
- Works with the Tailscale app on iOS, Android, macOS & Windows.
- Policies, RBAC, and full audit history.
- Self-host the full control plane under an Enterprise license.
Account creation starts in the control login. Registration is available from the sign-in screen when enabled for your realm.