One network, everywhere your workloads run
Service mesh
Every workload is connected through a built-in service mesh with mutual TLS, using per-workload client certificates rotated hourly. Service-to-service calls resolve by name across regions and providers. A workload in your data center calls one in Frankfurt the same way it calls one next door.
aws-api→
gcp-events-workermtlsaws-api→
dc-billing-svcmtlsdc-billing-svc→gcp-events-workermtlsFirewalls
Every workload gets its own firewall, denying all ingress and egress by default. Allow specific CIDRs, hostnames, or HTTP headers. Filter by geography. Control east-west traffic between workloads in the same Global Virtual Cloud (GVC™) or across orgs.
Allow rules
Cloud Wormhole
Reach private VPCs, on-prem networks, edge sites, or a developer's laptop through scoped, outbound-only tunnels. No VPN appliances, no peering, no IP allowlisting.
Install a lightweight agent inside the private network.
It connects outward to Control Plane; nothing opens inbound.
On a workload identity, declare the resources that workload may reach (by FQDN or IP, with explicit ports) and bind each to the agent that can see it.
The workload calls the resource by name; traffic is tunneled to that host and port and nothing else. Works from sandboxes too.
Private networking
For cloud-hosted services, native private networking (AWS VPC endpoints, GCP Private Service Connect) keeps traffic off the public internet entirely.
apirdsAWS VPC endpointprivateapicloud sqlGCP Private Service ConnectprivateGeo-routing, failover, and public TLS
Domains are configured once at the org level and routed to workloads. Public TLS certificates for those domains are automatic (Let's Encrypt, renewed every 60 days). Traffic reaches the nearest healthy location by latency-based DNS geo-routing and fails over automatically when a location or provider goes down; priority, latency offsets, and thresholds are tunable per GVC.
