Zero Trust Network Access
Modern, identity-based remote access built on Cloudflare Zero Trust and Tailscale, replacing site-to-site and client VPNs for distributed teams.
The Problem
The VPN Was Not Designed for This
A traditional client VPN authenticates once and then places the device on the network, with broad access to everything routable. One compromised laptop or reused password becomes lateral movement across the whole environment.
Operationally it is just as bad: concentrator appliances to patch, licenses per seat, split-tunnel exceptions, and international users routing traffic halfway around the world to reach a file share.
Site-to-site tunnels between offices and cloud VPCs add fragile, hard-to-audit topology that only one person understands, and that person eventually leaves.
The Model
Access per Application, per Identity, per Device
Zero Trust inverts the default. Nothing is reachable because of network location. Each request is authorized against user identity, group membership, device posture and context, for one specific application or resource.
Internal applications, admin interfaces, RDP and SSH targets and cloud consoles are published individually behind identity-aware access policies, so a contractor can reach exactly one system and nothing else.
Device posture checks can require disk encryption, a current OS, and a running EDR agent before access is granted, and access is re-evaluated continuously rather than at connect time.
What We Deploy
Cloudflare Zero Trust and Tailscale
BITS is a Cloudflare Zero Trust partner. We deploy Cloudflare Access and Tunnel to publish internal applications without opening inbound firewall ports, integrated with Microsoft Entra ID or Google Workspace as the identity source, plus Cloudflare Gateway for DNS and web filtering.
For engineering-heavy environments and flat peer-to-peer connectivity needs, we deploy Tailscale with ACL-based authorization, subnet routers for legacy resources and exit nodes where egress control matters.
Both are rolled out alongside the existing VPN first, with a pilot group, then application by application, and the VPN concentrator is decommissioned only once nothing depends on it.
Distributed Teams
International and Remote-First Without the Latency
Traffic egresses from a nearby edge location rather than backhauling to a Boston office, so a developer in Europe or a contractor in Latin America gets local performance on internal tools.
Onboarding and offboarding move to your identity provider. Disabling the account removes access to every published application immediately, with no per-device VPN profile cleanup.
Every access decision is logged per user, per application, which is exactly the evidence auditors ask for during SOC 2, HIPAA and CMMC reviews.
Please note: separate, opt-in engagement
This is a specialized, opt-in service. It is not included as part of your existing managed IT support or cybersecurity plan unless it has been specifically scoped and added to your service agreement. If you're an existing client and want to discuss adding this, contact your account manager or reach out below.