Your Tailscale Tailnet vs Public mTLS

Agents connect to your isolated environment one of two ways. Both keep engagement traffic between your hosts and your environment, never through a shared proxy.

Choose your transport

• Your own tailnet (default): agents reach you over your firm's own Tailscale tailnet — a private WireGuard mesh. We auto-provision a dedicated ingress node onto your mesh per firm; no public exposure, no inbound ports.
• Public mTLS edge: a hardened public path for hosts you can't put on the mesh, secured with per-tenant certificates that rotate automatically.

Every firm's mesh is its own

Your tailnet is separate from every other firm's and from ours. One firm's mesh cannot see another's, cannot reach StrikeOps's own network, and gets no path into the platform's cloud — the ingress node only forwards to your app. Isolation holds at the network layer, not just the database.