SecKav
Product · Zero-Trust Access

NEXUS Connect

Reach private resources without exposing a network. Every connection is identity-aware, device-aware, least-privilege, post-quantum-encrypted, time-bound, and instantly revocable — for people and for machines.

How it works

A user's device completes a hybrid post-quantum handshake (X25519 + ML-KEM-768, Ed25519-signed and pinnable) with the control plane. If device posture passes, the client is handed a least-privilege WireGuard tunnel to only the resources it's authorized for — enforced at a per-identity ACL in the sidecar, so a broad tunnel can never be used for lateral movement.

The session key is derived on both ends and never transmitted. Post-quantum by default protects private-app traffic against harvest-now-decrypt-later.

Set up access

  1. 1
    Deploy a connector (sidecar)
    Run the SecKav sidecar next to your private resource. It dials out — no inbound ports needed in inbound-less mode.
  2. 2
    Define resources + policy
    Register resources and scope them to IdP groups (via SCIM). A user only ever receives routes their groups grant.
  3. 3
    Set device-trust sources
    Wire Intune / Jamf / mTLS / CrowdStrike / SentinelOne — an attested-noncompliant device is downgraded or refused.

Human → server

Users connect with the NEXUS client. Guest/contractor access is a time-boxed, single-resource, instantly-revocable link.

bash
# The control plane provisions a tunnel after posture + identity check
POST /v1/connect/auth   →  201  { wireguard, sealedTunnelSecret, keyRotation, connectorPath }

Server → server (M2M)

Machines authenticate with OAuth2 client-credentials and receive a short-lived, port-scoped JWT — service-to-service access with no long-lived secrets.

bash
curl -X POST https://api.seckav.tech/v1/auth/machine-token \
  -d '{ "client_id": "mach_…", "client_secret": "…" }'
# → { access_token, expires_in }   (type=machine, allowedPorts, allowedSidecars)

Access governance

Every access decision is recorded as DPDP-shaped evidence (who reached which personal-data category, from what device posture, in-region), with per-identity activity and access↔DLP↔breach risk correlation in the dashboard.

WAF & Edge Security →
Protect the public side of your apps and APIs.