We are building Managed Network-as-a-Service for multi-cloud: one control plane for data-plane and transport-layer policy, above whatever underlay you run. Today it runs on GCP, with gateways in your own network enforcing host-level policy in the kernel and your packet content never leaving your infrastructure. Cross-cloud transit, AWS, and circuits we provision for you — including AWS Interconnect’s free tier — are coming.
The short version, up front. The architecture behind each one comes later on this page — scroll when you're ready.
The established platforms in this category are built and priced for the Fortune 500, and they earn it there. Telaron is calibrated for the mid-market: no per-spoke gateway VM bill, and — once cross-cloud transit lands — no CSP transit data-processing tax (TGW, Virtual WAN, NCC) layered underneath.
One control plane across every cloud you use. No Kubernetes required. No agents to roll out to every workload. Your team manages intent in Terraform or the REST API, with Pulumi coming; the fabric handles the plumbing consistently — on GCP today, with AWS in progress and Azure and on-premises planned.
Your packet content stays in your infrastructure — this is an architectural property, not a policy promise. Microsegment by service or application, not just VPC boundary — CSP-native tag discovery is coming. Policy names hosts today; identity drawn from service metadata is coming.
Managed NaaS across every cloud is the goal: one control plane above whatever underlay you run. Coming: bringing your own private circuits or having Telaron provision them (including AWS Interconnect’s free tier), unified eBGP routing, and CSP-native spoke integration — together they make a new region or a new CSP a config change, not a reorg.
Multi-cloud networking touches a lot of teams. Here is how the same fabric answers each of them.
their pain
Separate networking ops for every cloud, every region, every team.
our answer
One fabric, one control plane, one configuration story — GCP available now, AWS in progress, Azure and on-premises planned. Terraform or the REST API today, Pulumi coming. Your platform team stops being a cross-cloud integration team.
their pain
Multi-cloud makes policy, inspection, and data residency harder to prove.
our answer
Microsegment host to host with eBPF in the kernel today; by service or application, with CSP-native tag discovery, is coming. Keep packet content in your own infrastructure by architecture. Give auditors a one-page story instead of a deposition.
their pain
Multi-cloud networking bills scale faster than the business does.
our answer
Predictable per-gateway cost that tracks the fabric you run, not the traffic you push through it. Free Community tier to prove it out, and no sales call required to start.
their pain
IPSec ceilings, spoke VM sprawl, and Kubernetes-everything.
our answer
Kernel WireGuard. eBPF policy. Familiar BGP primitives are coming. Gateways run on VMs today, bare metal is coming, and your workloads need nothing installed, however they're packaged.
No console clicks. No ticket-driven network changes. Describe your fabric in the IaC tool your team already uses, and apply it. Adding a cloud will be adding a few lines.
terraform · rest — same fabric, pick your tool · pulumi coming
Here is the architecture behind each outcome above, and which parts of it run today.
Gateways carry traffic over kernel WireGuard with ChaCha20-Poly1305 — no IPsec, and none of its ESP MTU headaches. Multi-tunnel WireGuard with CPU affinity is coming. Throughput figures will be published once they are measured.
Your workload spoke VPCs stay untouched — not an agent, not a VM, not a sidecar. The fabric runs in a separate edge tier of gateways in your own central VPCs. Orchestrating that tier for you, and attaching workload spokes through native CSP constructs, are coming.
An XDP program sheds abusive traffic at the NIC and a TC program enforces policy after decryption, both in the kernel with the networking stack intact. No DPDK NIC takeover, no fragile userspace packet paths.
Infrastructure-grade, not pod-grade. Gateways run as a service on a VM and work at the VPC and subnet level, so your workloads run however they run. Bare-metal gateways are coming.
Telaron is the control plane above the wire — not the wire itself. Gateways reach each other over WireGuard between routable addresses, so any path that carries IP will do. Coming: an orchestrator that provisions the underlay for you, including a managed cloud exchange (Equinix Fabric, Megaport) or AWS Interconnect’s free multi-cloud tier; spoke attachment through CSP-native constructs, GCP first; and replacing the cross-charging transit layers (AWS TGW, Azure Virtual WAN, GCP NCC) with no per-GB transit tax.
Everything Command Center does goes through a public REST API, and a Terraform provider covers clusters and spokes. Wider Terraform coverage, a Pulumi SDK and GitOps reconciliation are coming. No ClickOps traps, no console-only configuration.
The SaaS control plane handles configuration metadata and telemetry only — never customer packet content. An architectural property, not a policy promise. Documentable for compliance.
Community is free. Pro and Enterprise are priced per gateway for the mid-market. No per-spoke gateway VM compute today; removing CSP transit data-processing fees (AWS TGW, Azure Virtual WAN, GCP NCC) comes with cross-cloud transit.
Three rows, three platforms. The full matrix covers what each one leads on, and where several of them work alongside Telaron rather than against it.
Community is free forever. Pro scales per-gateway. Enterprise unlocks single-tenant control and contractual data residency.
For startups and home labs finding their feet.
The mid-market multi-cloud fabric, no sales call needed.
SOC 2 path, dedicated SLA, architectural partnership.
all tiers include the apache-2.0 gateway data plane · switch or cancel anytime
The v1 platform ships now. These are the near-term and horizon deliveries building on it — directional, not date-bound. Detail-level feature lists live in the docs.
GitOps CI via OIDC workload identity
Native GitHub Actions & GitLab CI integration through our own OIDC IdP. Short-lived tokens minted per-run — no long-lived secrets in your pipeline.
Unified policy plane
Read policy from Cisco Multicloud Defense and Palo Alto Panorama into one normalised view. Keep your source of truth; let Telaron enforce it at the fabric edge.
SOC 2 Type II attestation
Closing out the attestation cycle. Report available under NDA for regulated customers on the Enterprise tier.
L7 deep packet inspection
Protocol-aware policy evaluated at the eBPF fast path. HTTP / gRPC / TLS SNI awareness without a proxy detour or userspace retransmit.
Policy federation — more sources
Expanding beyond Cisco MCD and Panorama. Prisma Cloud, Illumio, CrowdStrike Falcon. Wherever your policy of record lives, we will read it.
ML-assisted anomaly detection
Baseline flow patterns at the LGW, surface drift, stream to your SIEM. Detection-as-a-property of the fabric, not a bolted-on appliance.
roadmap is indicative · ships live in the docs · no dates, directions
08 · start shipping
Ask for a Community account and stand up a cluster on GCP. Script it through the API or Terraform, and keep your packet content on your own infrastructure.
no credit card required · community tier is free, forever
