about

We built it because nobody else would.

It started with Starlink, a Minecraft server, and a lot of frustration.

We were running a Minecraft server from home. Starlink. CGNAT. Double-NAT behind a satellite dish bolted to a roof. No public IP. No port-forwarding. No way to tell your friends to just type in an address and connect.

So we tried everything. ngrok — dropped UDP, so no Minecraft. Cloudflare Tunnels — same problem, HTTP/TCP only. Tailscale — beautiful software, wrong answer: it makes a private mesh, not a public address. frp, chisel, rathole — the self-managed path means you already have a public VPS, which is the thing you were trying to avoid needing.

There was no product that said: here is a public IPv6 (and IPv4 when you need it), inject it into your Docker container, every protocol works, unlimited bandwidth — speed-tiered, never data-capped — cancel any time.

So we built it. One container, one IP, no NAT, no proxy. The thing we actually wanted to buy.

We are not a venture-backed startup. We are not trying to be the next Cloudflare. We are two people who got tired of explaining why Minecraft from home requires a side server, and the founding community that funded us to ship it.

why we built this

alternatives we tried first

ngrok No UDP. ngrok proxies at the application layer — TCP and HTTP only. You cannot run a game server, MQTT broker, STUN endpoint, or anything that speaks UDP. Personal plan caps at 10 GB/month; Business is $30/mo for 1 TB/seat. If you move data, you pay per gigabyte. Cloudflare Tunnels No UDP. Cloudflare is your MITM. Tunnels support HTTP, HTTPS, and SSH only — raw TCP requires their paid Zero Trust product and still no UDP. More importantly, Cloudflare terminates TLS at their edge: they decrypt your traffic, inspect it, re-encrypt it. That makes Cloudflare a party to every request. No dedicated IP per customer — you share Cloudflare's IP space. Tailscale Private mesh, not a public IP. Tailscale is excellent software for connecting machines you control. It is not for exposing a service to the public internet. Exit nodes exist but give you no static routable public IPv4. UDP works within the mesh but there is no path to "my game server has a stable IP my friends can type". DIY VPS You become the ops team. frp, chisel, rathole — all solid tools. But they assume you already have a public VPS, which means you manage the server, the OS upgrades, network rules, abuse complaints, Let's Encrypt, DDoS response, and the 3am kernel panic. That is the thing most people are trying to avoid. Sidecar One label. All protocols. Managed for you. Dedicated IPv6 on every plan; dedicated IPv4 on Pulse+IPv4 and above. UDP + TCP + ICMP, all ports. Unlimited bandwidth — no GB caps, no overages. End-to-end encrypted — we are not a MITM, we never see your plaintext. Post-quantum encryption mandatory since initial release. 6 relay POPs across 5 regions. ~5 second cold-start. Starts free, paid from $0.99/mo.

founders

team

Andrew — infrastructure, networking

Mira — DMCA, ops, abuse policy

commitments

COMMITMENTS

+ no metered bandwidth, ever — speed-tiered, never data-capped

+ no per-container fees, ever

+ Free plan + paid plans from $0.99/mo

+ 14-day money-back guarantee on all paid plans

+ warrant canary signed monthly · forever

+ RAM-only DB · no traffic logs · architecturally

+ pay by card, PayPal, or Bitcoin Lightning

technology

how it actually works

→ Container-level network injection — not a userspace proxy; each container gets a dedicated interface and a real public IP

→ Per-peer isolation — every container gets its own private network segment; peers cannot reach each other at the relay

→ Post-quantum encryption — mandatory on all connections since initial release; connections without post-quantum negotiation are rejected

→ Unlimited bandwidth — no GB caps, no data overage charges; all tiers unmetered

→ UDP fully supported — ngrok and Cloudflare Tunnels cannot route UDP; we solve this problem

→ 6 relay POPs across 5 regions — US-East · US-West · US-West1 · CA-East · EU-West · EU-Central

→ Automatic agent updates — the sidecar agent self-updates via systemd; no manual intervention required

→ Dispute-triggered teardown — confirmed chargebacks automatically revoke peer access; no manual ops step

→ Bitcoin Lightning payments — annual billing via BTCPay; no payment processor middleman

timeline

git log --oneline --since=2025-01-01

may 2025 first prototype Proof of concept. One container, one IP, no NAT. aug 2025 agent + ctrl service Full rewrite. Multi-peer support. jan 2026 per-peer isolation Complete network isolation per container. mar 2026 runtime security Proactive threat detection and traffic protection. apr 2026 post-quantum encryption Post-quantum encryption mandatory on all tunnels. may 2026 v1.0 GA 5 regions, 6 relays live. Founding program opens. may 2026 v1.16 payments Bitcoin Lightning added. Auto-update agent. Dispute teardown wired.

See pricing Warrant canary →