Smallstep ZTNA

Spec sheet

What it does

Smallstep Enterprise Relay is a transparent VPN that uses standards-based private MASQUE relays, mutual TLS, and hardware-bound device certificates to control access to SaaS apps, internal networks, and AI initiated workflows.Read 8 Oct 2026 · smallstep.com

Intended users

Smallstep identifies security engineers, platform teams, CISOs, and enterprises pursuing device-level Zero Trust enforcement as audiences for its products.Read 8 Oct 2026 · smallstep.com

Deployment

Smallstep says its device identity based ZTNA can be deployed in the cloud or on-premises.Read 8 Oct 2026 · smallstep.com

Free plan

NoRead 22 Sep 2026 · smallstep.com

Integrations

Smallstep’s featured integrations include AWS, Stripe, Google Cloud Platform, Slack, Intune, Salesforce, GitHub, Okta, Jamf, and ServiceNow.Read 8 Oct 2026 · smallstep.com

Compliance

Smallstep’s support article says its SaaS platform has SOC 2 Type II certification and that customers can request the audit report by emailing support.Read 8 Oct 2026 · support.smallstep.com

Company

Smallstep’s about page describes a globally distributed team; its 2024 company blog says its founder started Smallstep about six years earlier.Read 8 Oct 2026 · smallstep.com

Access model

ztnaRead 22 Sep 2026 · smallstep.com

Admin control level

advancedRead 22 Sep 2026 · smallstep.com

Apple platforms

Smallstep Enterprise Relay natively supports Apple devices through the Managed Relay MDM payload on iOS 17+, iPadOS 17+, macOS 14+, and tvOS 17+.Read 8 Oct 2026 · smallstep.com

Authentication

Authentication happens silently without popups, login screens, or user prompts when a device has a valid attested certificate.Read 8 Oct 2026 · smallstep.com

Device-wide enforcement

The product provides network-level protection across the entire device and routes approved traffic through a dedicated outbound IP range.Read 8 Oct 2026 · smallstep.com

Key protection

Smallstep says its CA signing keys are held in a hardware security module and that every HSM interaction is logged.Read 8 Oct 2026 · smallstep.com

Security architecture

Smallstep says it uses end-to-end encryption, single sign-on, mutual TLS, and multiple layers of access controls in its service delivery.Read 8 Oct 2026 · smallstep.com

SSO / SCIM

YesRead 22 Sep 2026 · smallstep.com

Supported platforms

Windows,macOS,Linux,iOSRead 22 Sep 2026 · smallstep.com

Traffic controls

Administrators can specify domains to route through the relay with match and exclude rules, then enforce access through IP allow lists and mutual TLS.Read 8 Oct 2026 · smallstep.com

Windows and Linux

For Windows and Linux, the Smallstep agent provides hardware-bound mutual TLS authentication.Read 8 Oct 2026 · smallstep.com

Plans and prices

Every Smallstep ZTNA plan and price →

Where Specifiction places it

• Business VPN Software#58 of 947.8