The Platform
Built on identity,
not addresses.
CanMe is a complete networking platform — clients, mesh, core, routers, and gateways — engineered around one principle: every connection is mutually authenticated, end-to-end encrypted, and policy-driven.
Book a Demo →Building Blocks
Five components. Infinite topology.
Five real building blocks — combined however your network needs them. No add-ons, no extra licenses.
Hover any node to highlight its connections.
Core
The brain of the network. Identity decisions, policy evaluation, audit — running inside your environment, never ours.
Mesh
Your data routes through the internet — on top of the internet. Identity-aware path selection, end-to-end encrypted, never decrypted in transit.
Gate
The clientless connector. Bring entire networks, proxies, or whole locations onto the identity fabric. Replaces MPLS, IPsec, and SD-WAN with one box.
Clients
Software on any OS — the identity for every user, every device, every workload. Windows, macOS, Linux, iOS, Android, headless containers.
LINK
Plug-and-play identity for machines. As easy as flipping a light switch on. PoE-capable, zero-touch, no public IP needed.
How It Works
Identity to identity.
Through services, never through a public IP.
We connect any identity — user, device, OT machine, app, even an entire location — to any other identity. When middleware sits between them (bastion, proxy, MCP server, gateway), CanMe hosts it inside the network. Both sides connect to the service. Neither side ever needs a public IP.
Identity in. Any kind.
Users, devices, OT machines, applications, entire networks — every endpoint gets a cryptographic identity. That's the only thing CanMe talks to. IPs don't matter.
Service in between.
When you need middleware — a bastion, a proxy, an MCP server, an AI assistant — CanMe hosts it inside the network. Both identities connect to the service. Never to each other directly. Never to a public IP.
Overlay, not underlay.
Rides on top of whatever underlay you already have. Use the same address space in every location. No NAT, no routing tables, no public IPs at endpoints. Microsegmented by default — identity decides what reaches what, not an IP rule.
What your users will see
Meet the Cannector.
One client for every identity you have.
The Cannector is the single piece of software your users actually touch. Install it once, join one network or twenty, and you're on the fabric — without VPN clients, per-tunnel configuration, or helpdesk tickets.
Cannector on macOS — one window, every network you belong to.
One client, every identity
User, device, workload — a single Cannector speaks for all of them. No second agent, no second login.
Easy to install
Download, sign in, done. No certificates to copy around, no admin walk-through, no manual config files.
Join one or many networks
Switch between networks the same way you switch Wi-Fi. Be on a customer's Cloud Area Network, your own, and a partner's — at the same time.
Every OS, every form factor
Windows, macOS, Linux, iOS, Android. Headless containers supported as well.
For Linux & servers
Cannector CLI.
Same identity model, no GUI dependency. Deploy the CLI to a Linux server, assign it an identity, and it joins the network. Built for headless workloads, edge appliances, and CI runners.
$ cannector join prod-eu --identity workload-apiFrom building blocks to outcomes
See what teams actually do with CanMe.
Commercials
Become your own SaaS.
Pay-as-you-go by default. Lock 1, 3, or 5 years per identity — mixable in the same tenant. Run CanMe the way the cloud runs you.
Your monthly invoice · one tenant
billed monthly · mix any time
No onboarding calls. No stranded seats. Sell access the way the cloud sells compute.
Ready to advance without firewalls?
Book a 30-minute demo. See how CanMe transforms your network security posture — without a rip-and-replace.
Book a Demo →Or write to us at hello@canme.cloud
Are you an MSP? Partner discounts available — say hi at hello@canme.cloud.