# Teicho

> Your team’s tools, closed to everyone else. Teicho gives your team its own Gate with a fixed IP. Allowlist it on admin panels, dashboards, bastions and MCP servers, and keep databases behind the bastion: only your people and machines get in, every access is tied to a name, and everyday browsing still goes straight to the internet.

- Dedicated Gates with static IPs
- Split tunneling by domain
- Sign-in with your identity provider

## Small teams run important systems behind very thin walls.

### Admin panels on the open internet

Dashboards, back offices and new MCP servers sit behind a login page that anyone on earth can find, probe and try passwords on.

### A VPN that slows everyone down

A classic full-tunnel VPN routes every call and download through one server, and puts everyone behind the same IP, so allowlisting it proves little.

### No answer when someone asks

A customer’s security review, an auditor or your own incident asks who had access to what. The answer is scattered across tools, or nowhere.

## A wall around your team’s assets, with one gate in it.

A Gate is a small server dedicated to your team. It carries your team’s traffic out from fixed IPs. You run it on your own Linux server, in your cloud account or your office, joined with one command.

1. **Sign in once.** People sign in to the Teicho app with your identity provider. Servers and CI runners get their own per-device profiles. Tower hands each device a signed config.
2. **Team traffic goes through your Gate.** Only destinations on your team’s domains take the tunnel, and their names are answered privately by the app or your own Gate. Everything else, DNS included, goes straight to the internet as before.
3. **Assets accept only your Gates.** Your assets allow the Gate’s static IPs and nobody else. The Gate enforces who may reach what, and every connection is recorded.

## Fast for everything else, closed for everyone else.

A full-tunnel VPN makes the whole internet slower to protect a handful of systems. By default Teicho tunnels only what belongs to your team, and full tunnel is there if your team needs it.

| | Teicho split tunnel | Classic full-tunnel VPN |
| --- | --- | --- |
| What goes through the tunnel | Only your team’s destinations | Everything, from video calls to updates |
| Everyday browsing and calls | Unchanged, on the direct path | Every packet detours through the VPN server |
| Exit IP | Your team’s own static IPs, never shared | One server IP for everyone behind it |
| Allowlisting that IP | Lets in your team and nobody else | Lets in everyone who shares the server |
| When the VPN is down | Only team destinations wait; the rest keeps working | Often the whole connection stops |

[How split tunneling works](https://teicho.io/split-tunneling)

## Access you can explain, and prove.

### Dedicated Gates, static IPs

Each Gate belongs to one team and is never shared. It runs on your own Linux server; behind NAT works through Tower’s relay.

### Two Gates, and a way through

Each Gate pool has two Gates in two locations. If one goes down, the Teicho app moves to the other on its own. On networks that block WireGuard’s UDP, the app carries the same tunnel over TLS 1.3 on port 443, where it looks like ordinary HTTPS.

### Allowlists that mean something

Restrict admin panels, dashboards, bastions and cloud consoles to your Gate IPs. Playbooks cover nginx, AWS security groups, IAM source-IP conditions, bastions and MCP servers.

### Private DNS

Internal names are answered only by the app and your own Gate, inside the tunnel. They never reach a public resolver, or Teicho’s shared servers.

### One console for the team

Bring people in from your identity provider and group them. New assets are open to everyone in the team; restrict any asset to groups, people or machines. Owners, admins, members and auditors each get the access they need.

### No passwords, fast offboarding

People sign in with Google or Microsoft, with MFA from your provider, or with a one-time code sent by email. Google Workspace, Entra ID and GitHub organizations keep people and groups in sync, so removing someone there ends their access on every device within minutes.

### Rules enforced at the Gate

Configs are signed, and the Gate decides who reaches what. A modified client gains nothing.

### Audit-ready history

Who connected from which device to what, and when. The audit log, with every change, and the access review export as CSV.

### Checks and rollout help

External checks confirm your assets stay closed to everyone except your Gates. During early access, the team building Teicho helps you plan your first Gates and allowlists.

## Every device your team uses, people and machines.

**Teicho app.** For people. Split tunneling by domain and automatic failover between your Gates. macOS, Windows, Linux, iOS, Android, ChromeOS.

**Standard clients.** For managed fleets, servers, CI runners and devices that can’t run the app. Teicho generates a profile per device, each with its own machine identity: WireGuard always, and IKEv2 for Gate pools where you turn it on. WireGuard, IKEv2.

## Your allowlist updates itself.

Point security groups at the Gate instead of copying IPs around. When your Gates change, the next plan shows it.

### Terraform & OpenTofu provider

Manage Teicho next to the rest of your infrastructure. Gate egress IPs are a data source you feed straight into your security groups.

### CLI

For terminals, scripts and pipelines.

### MCP server

AI agents can list assets, check who can reach what and why, look up Gate egress IPs and export the access review. Read-only, with a Teicho API token.

```hcl
data "teicho_gate_egress_ips" "prod" {
  team = "platform"
}

resource "aws_security_group_rule" "bastion_ssh" {
  type              = "ingress"
  protocol          = "tcp"
  from_port         = 22
  to_port           = 22
  security_group_id = aws_security_group.bastion.id
  cidr_blocks       = data.teicho_gate_egress_ips.prod.ipv4_cidrs
}
```

## FAQ

### Is Teicho a VPN?

It uses VPN tunnels, but it is not a privacy VPN. It is an access network for your team: only traffic to your team’s destinations goes through your Gate, so your assets can trust the Gate’s IPs and know who is behind every connection.

### Does all of our internet traffic go through Teicho?

Not by default. Tunneling is split by domain: only team destinations go through your Gate and everything else goes direct, so if Teicho is unavailable your people can still browse, call and work. Full tunnel is available per Gate pool, and your team decides whether each person turns it on, it is always on, or it is never used.

### What happens if Teicho is down?

A Teicho outage never opens your assets to anyone else. Team sites wait until a Gate is back, and everything else keeps working. Devices keep their last signed config, and the app moves to your other Gate or the next Tower on its own.

### Where does the Gate run?

On your own Linux server, in your cloud account or your office, joined with one command. It is dedicated to your team and never shared. A Gate behind NAT works through Tower’s relay.

### Can Teicho see our traffic?

Only your Gate sees your team’s traffic in the clear, and it runs on your own server. Towers hand out signed configs and relay encrypted traffic, and never see your traffic in the clear or your DNS lookups.

### What about servers, CI runners and devices that can’t run the app?

Use the standard WireGuard client. Teicho generates a profile per device, so every machine has its own identity in the audit log. For devices that can’t run WireGuard either, turn on IKEv2 for a Gate pool: each device gets its own certificate in a profile for Apple, Windows, Android or Linux. An IKEv2 profile connects to one Gate, without the app’s automatic failover. Site-to-site links, which connect an office or cloud network to your Gate over IKEv2, come with the Business plan.

### What about networks that block VPNs?

The Teicho app connects with WireGuard over UDP first. If UDP can’t get through, it carries the same WireGuard tunnel over TLS 1.3 on port 443, which looks like ordinary HTTPS to the network, and moves back to UDP once UDP works again. The fallback is on by default for every Gate pool, and admins can turn it off per pool. Standard WireGuard clients use UDP only.

### Which identity providers do you support?

Google or Microsoft sign-in, or a one-time code sent by email. Nobody creates a Teicho password. People and groups sync from Google Workspace, Entra ID or GitHub organizations, so removing someone there ends their access within minutes. Connecting a company directory needs that provider’s admin to approve it; anyone can start a team and ask their admin.

### Will Teicho make us SOC 2 or ISO 27001 compliant?

No tool can do that for you, and Teicho is not a certification. It helps you produce evidence for SOC 2 and ISO 27001 controls: who had access to what, from which device and when, plus the audit log of every change and access reviews.

### Where does the name come from?

From Greek teichos, a city wall. The wall keeps everyone else out; the Gate is how your team gets in.

## Put a wall around what matters.

Teicho is in early access. Tell us what you want to protect and we’ll be in touch. [Request early access](https://teicho.io/early-access)