# Three parts, and only one of them carries your traffic.

Teicho is a control plane that holds your rules, Towers that hand out signed configs, and Gates that carry your team’s traffic to your assets from fixed IPs. In split tunnel, the default, everything else your people do online never touches Teicho.

## The three parts

| Part | What it does | Run by | Sees your traffic |
| --- | --- | --- | --- |
| Control plane | Your console and API: people, groups, assets, access rules, the audit log. | Teicho | Never |
| Tower | Hands each device its signed config, connects your Gates to our control plane, and relays traffic for Gates your devices can’t reach directly. It never sees your traffic in the clear or your DNS lookups. | Teicho, shared or dedicated to you | Never. Relayed traffic stays encrypted end to end |
| Gate | Carries your team’s traffic to your assets from fixed public IPs, and enforces your access rules. | You, on your own Linux server | Only your own team’s, on its way to your assets |

## What happens when someone opens a team site

The app decides mainly by domain name; IP ranges work for destinations without a name. List your team sites once and they work on every device; a site not on the list never enters the tunnel.

1. **Laptop: Look up admin.acme.dev.** The Teicho app sees a team domain and routes it to your Gate.
2. **Laptop: Send it over WireGuard.** The request travels encrypted to your team’s Gate. If the network blocks UDP, the app sends the same tunnel over TLS on port 443.
3. **Gate: Check the rules.** The Gate checks that this person may reach this asset.
4. **Gate: Forward from your fixed IP.** The request leaves from your Gate’s static IP, the only one your asset allows.
5. **Asset: Answer.** admin.acme.dev sees an allowlisted IP and responds; the answer comes back through the tunnel.
6. **Laptop: Everything else goes direct.** news.example.com, video calls and downloads skip Teicho entirely.

## Where your Gates run, and how devices reach them

Every Gate belongs to one team and is never shared. A pool has two Gates in two locations, so losing one doesn’t cut your team off. Each pool has a daily maintenance window you pick, and Gates restart one at a time, after open connections move over.

### On your own server

Any Linux server in your cloud account or office, joined with one command.

### Behind NAT

No inbound port needed: devices reach your Gate through a Tower relay, still encrypted end to end.

### On networks that block UDP

Devices connect with WireGuard. Where UDP is blocked, the Teicho app carries the same tunnel over TLS 1.3 on port 443, looking like ordinary HTTPS, and returns to UDP when it can. On by default for each pool.

### Without the app

Turn on IKEv2 for a pool, off by default, and devices that can’t run the app connect with a per-device certificate profile for Apple, Windows, Android or Linux. On the Business plan, IKEv2 also links an office or cloud network to your Gate.

## Who sees what

|  | Control plane | Tower | Gate | Your device |
| --- | --- | --- | --- | --- |
| Your team’s traffic | No | No, only encrypted packets when relaying | Yes, its own team’s only | Yes |
| Device private keys | No, only public keys | No | No | Its own only |
| Team domain lookups | No | No, Towers run no DNS resolver | Yes, your own Gate, inside the tunnel | Yes |
| Everything else you browse | No | No | No | Yes |
| Connection logs | Stores them for your audits | No | Start, end, destination and bytes; never contents or URLs | No |

Configs are signed with your team’s own key. A Tower can delay a config but can’t forge one, and a modified client gains nothing, because the Gate enforces the rules.

## If something goes wrong

A Teicho outage never opens your assets to anyone else. Team sites wait until a Gate is back, and everything else keeps working.

| If this is down | Your team sites | Everything else |
| --- | --- | --- |
| Control plane | Keep working on the last config | Unaffected |
| One Tower | The app switches to the next Tower | Unaffected |
| UDP, on a network that blocks it | The app switches to WireGuard over TLS on port 443 | Unaffected |
| One Gate of your pool | The app moves to the other Gate | Unaffected |
| Both Gates | Wait until a Gate is back | Unaffected |

## Dedicated Towers

Towers are shared by default: they never carry anyone’s traffic in the clear, and each team’s configs are kept apart. If your policies require it, a dedicated Tower pair serves only your team, in the regions you choose, with its own IPs and your own hostname. It is a paid add-on; ask us for a quote.

## Put a wall around what matters.

Teicho is in early access. Tell us what you want to protect and we’ll be in touch. [Request early access](https://teicho.io/early-access)