Services
Corporate VPN and secure remote access
A private service for your staff: security for confidential corporate data.
- Timeline
- from 1 week
What it is for
Give employees, contractors and branch offices secure access to the company's internal systems — ERP, CRM, databases, admin panels, file storage — without exposing any of them to the public internet.
The task is wider than "set up a VPN": the perimeter has to close, access has to be scoped, revocation on termination has to be immediate, and a connection log has to exist for internal audit and regulatory requirements.
This is a corporate information-security service: we build a closed channel between an employee and their own company's internal systems. It is not concerned with access to external resources and does not involve circumventing any restrictions.
How we do it
We start with an inventory: which resources must be reachable, by whom, and from where. On that basis we design a segmented topology instead of a flat network where one compromised laptop opens the whole estate.
We deploy a WireGuard gateway — faster and far easier to audit than IPsec. Where a venue's network passes only standard web ports, we raise a fallback channel over 443 so someone travelling is not locked out. Access follows least privilege: routing and firewall rules describe exactly which group sees which subnets and ports.
We connect access management to your user directory, configure connection logging, gateway monitoring and a key rotation policy, then hand over the documentation and train your administrator.
The classic mistake is treating a corporate VPN as an evening's work out of a box. Standing up a tunnel really is quick; the value is in everything around it — the access matrix, segmentation, revocation and logging. That is what an audit asks about, not which protocol you chose.
<1 min
Access revocation on termination
0
Internal systems exposed to the public internet
N+1
Gateway redundancy with automatic failover
What you get
What you get
- Resource inventory and a who-where-why access matrix
- Network segmentation and routing rule design
- WireGuard gateway, with a fallback channel over port 443 where needed
- Group-based permissions on a least-privilege basis
- Integration with the corporate user directory (LDAP / Active Directory)
- Issuing and instant revocation of access, per-employee device limits
- Connection log for internal audit
- Resilience: standby gateway with automatic failover
- Monitoring, alerting and a key rotation policy
- Employee instructions for iOS, Android, Windows, macOS and Linux
- Documentation and handover to your administrator
Technology
- WireGuard
- OpenVPN
- IPsec
- nftables / iptables
- LDAP / Active Directory
- Prometheus
- Grafana
- Ansible
- Docker
Stages
Stages
Audit and threat model
We establish what is being protected and from what: contractor access to internal systems, work from public and hotel networks, leakage through a departed employee. The threat model drives the topology, not the other way round.
Access matrix
A table of group — resource — protocol — port. This is the most valuable artefact of the project: it outlives any change of contractor and stays with you.
Network design
Segmentation instead of a flat network, gateway placement, routing rules, a fallback channel and the failover scenario.
Deployment
Gateway installation via Ansible, key generation, firewall, disabling SSH password auth, and connection logging.
Employee onboarding
Directory integration, profile issuance, instructions for every platform, and a pilot with a small group before the general rollout.
Handover and support
Documentation, training for your administrator, and policies for key rotation and access revocation. Then either an SLA with us or independent operation.
FAQ
How is this different from a commercial VPN service?
In purpose. We do not build or offer consumer VPN services for routing a user out through a third-party server. A corporate VPN solves the opposite problem: it lets an employee inside their own company's perimeter and tightly limits what they can see. It is an internal security tool, not a means of reaching external resources.
WireGuard or IPsec?
WireGuard in most cases: an order of magnitude smaller codebase and therefore far easier to audit, faster to establish a connection, and noticeably lighter on mobile battery. We keep IPsec where the client's existing hardware already speaks it and replacing that costs more than keeping it.
What happens if the gateway fails?
We design a standby gateway with automatic failover, so losing one node does not stop work. Client configurations carry both endpoints and switch over without the employee doing anything.
Will you have access to our internal systems?
Not unless you want us to. We can design and deploy the estate while the administrative keys live only with your administrator from the outset. We work in an agreed window and retain no access after handover.
Does anything have to be installed on employee devices?
The official WireGuard client — free and available on every platform. The connection profile is delivered as a file or QR code, and setup takes under a minute with no administrator involved.
DEKART — DIGITAL
Interested in: Corporate VPN
We reply within 15 minutes during business hours. The first consultation and estimate are free.