# Teicho

> Teicho is a team access network for small and medium businesses. A team’s protected assets (MCP servers, bastions, admin panels, cloud consoles, Kubernetes APIs) accept traffic only from the team’s own dedicated Gates, and every access is tied to a person or a machine identity.

Only team destinations go through the Gate (split tunneling by domain); everything else stays direct. Teicho helps teams produce evidence for SOC 2 and ISO 27001 controls; it is not a certification.

## Pages

- [Home](https://teicho.io/index.md): Teicho gives your team dedicated Gates with static IPs. Lock admin panels, dashboards, bastions and MCP servers to your team, with split tunneling and audit-ready access history.
- [How it works](https://teicho.io/how-it-works.md): Teicho has three parts: a control plane for your rules, Towers that hand out signed configs and relay traffic, and dedicated Gates that carry your team’s traffic from fixed IPs. Who sees what, and what happens when something fails.
- [Split tunneling](https://teicho.io/split-tunneling.md): Teicho sends only your team’s destinations through your dedicated Gate, resolves internal names over private DNS, and leaves everything else on the direct internet path.
- [Security](https://teicho.io/security.md): How Teicho handles identity, device keys, signed configs, fail-open split tunneling, the tunnel protocols, dedicated Gates, private DNS and audit logs, in plain words.
- [Early access](https://teicho.io/early-access.md): Teicho is in early access. Email us about your team and what you want to protect, and we’ll get back to you.
- [IP allowlist for HubSpot](https://teicho.io/allowlist/hubspot.md): How to limit HubSpot logins to your team’s IP addresses (an IP whitelist): the plan it needs, the steps in Settings, what it doesn’t cover, and how to avoid locking yourself out.
- [IP allowlist for the Kubernetes API](https://teicho.io/allowlist/kubernetes-api.md): How to allowlist (whitelist) your team’s IPs on the Kubernetes API server in EKS, GKE and AKS: public access CIDRs, authorized networks and authorized IP ranges, their limits, and the traps that cut off your own nodes and CI.
- [IP allowlist for AWS](https://teicho.io/allowlist/aws.md): How to allowlist (whitelist) your team’s IPs on AWS: security group rules and prefix lists for bastions and admin panels, and an IAM aws:SourceIp deny for human roles, with the VPC-endpoint trap that breaks it.
- [IP allowlist for nginx and wp-admin](https://teicho.io/allowlist/nginx.md): How to allowlist (whitelist) your team’s IPs on an nginx admin panel or WordPress wp-admin: allow and deny rules, keeping admin-ajax.php open, the real-IP trap behind a load balancer or Cloudflare, and how to test it.

## Optional

- [Full text](https://teicho.io/llms-full.txt): every page above in one Markdown file