Everyone gets the access they need. Nobody gets more.
Fowlguard decides every connection on the device, against one identity and one set of rules. People reach their own systems, the web stays safe on any network, and every AI agent has an owner.
What changes on the day you switch it on.
Each group reaches its own systems and nothing else, decided when they connect. A stolen laptop reaches two subnets, not the whole network.
Replace your VPNRules live on the laptop, so they hold at home, on hotel wifi and on mobile data. Every rule can run report-only before it stops anyone.
Safe web on every deviceCrawlers, scripts, CI runners and AI agents each get a row and an owner. An agent nobody will claim is the finding.
Govern AI agentsAccess is granted for a stated time. The approval writes the grant, and the clock removes it. Nobody has to remember to close it.
Just-in-time accessPeople outside your organisation get what the project needs, for as long as it runs, with a record of who approved it.
Contractor access| Group | Can Reach | Action |
|---|---|---|
ENEngineering | 10.20.0.0/16 | Allow |
FIFinance | ledger.internal | Allow |
COContractors | git.internal | Approve |
*Everyone Else | anything | Deny |
| Time | Person | Site | Result |
|---|---|---|---|
| 09:41 | Sam Reyes | share.example.net | Would Block |
| 09:38 | Sam Reyes | files.example.org | Would Block |
| Caller | Kind | Owner | Status |
|---|---|---|---|
| build-runner-7 | CI Runner | Priya Nair | Owned |
| report-bot | AI Agent | Lena Park | Owned |
| sync-script.py | Script | — | No Owner |
- Who
- Sam Reyes · Contractors
- Wants
- git.internal
- For
- 4 hours
- Reason
- Release branch review
| Person | Group | Access Ends |
|---|---|---|
SRSam Reyes | Contractors | in 4 hours |
JOJo Okafor | Contractors | 31 Oct |
MCMaya Chen | Engineering | — |
Set the rules. See every decision.
Every product resolves against the same identity and the same rules, so there is one place to look when something is blocked.
Who can reach which of your systems.
| Group | Resource | Expires | Action |
|---|---|---|---|
| Engineering | 10.20.0.0/16 | — | Allow |
| Finance | ledger.internal | — | Allow |
| Contractors | git.internal | 4 hours | Approve |
What leaves a device, and which rule decided it.
| Rule | Applies To | Category | Action |
|---|---|---|---|
| Personal File Sharing | Contractors | File Sharing | Block |
| Artificial Intelligence | Everyone | Artificial Intelligence | Report |
| Gambling | Everyone | Gambling | Block |
| Default | Everyone | Any | Allow |
Every caller that is not a person, and who owns it.
| Caller | Kind | Direction | Owner | Status |
|---|---|---|---|---|
| build-runner-7 | CI Runner | Outbound | Priya Nair | Owned |
| report-bot | AI Agent | Outbound | Lena Park | Owned |
| sync-script.py | Script | Outbound | — | No Owner |
| unknown crawler | Crawler | Inbound | — | Block |
Brokered RDP, SSH and WinRM, tied to a person and a grant.
| Person | Machine | Protocol | Grant Ends |
|---|---|---|---|
| Maya Chen | build-01 | SSH | — |
| Sam Reyes | win-app-03 | RDP | in 4 hours |
| Priya Nair | db-02 | WinRM | in 1 hour |
For 4 hours · Release branch review
Sam Reyes · share.example.net
Seen calling out from build-02
Sam Reyes · grant ends in 4 hours
Private Access
Zero-trust access to your own servers and subnets.
Internet Access
Web filtering and routing, decided on the device.
Application Control
Crawlers, scripts, CI runners and AI agents, named and owned.
Fowlguard Remote
RDP, SSH and WinRM with no open port.
Your first rule is running in minutes.
No appliance to rack, no deployment programme, no call with sales.
Create your organisation
Sign up, verify your domain and connect the sign-in your people already use: Google, Microsoft or your own SSO.
identity.fowlguard.comInstall Fowlguard Connect
One app on Windows, macOS and Linux. People sign in once and it does the rest.
Windows · macOS · LinuxWatch, then enforce
Write a rule in report-only, see who it would affect in the log, then switch it on.
Off → Report → Block
The café, the hotel, the kitchen table.
The rules live on the laptop, so they hold on whatever network it joins. No office, no gateway, no exceptions.
What the design adds up to.
Facts about how the product is built. No projections and no borrowed industry figures.
Internet, SaaS and blocked traffic are decided and sent from the device. Private traffic is relayed only if a network refuses a direct path.
Filtering happens on the laptop. There is no proxy in the middle, so there is nothing of ours to be down.
Private Access, Internet Access, Application Control and Remote read the same answer to who someone is.
Private Access Personal, with unlimited devices. No card and no trial clock.
Built for the people who answer for access.
Pick the one that sounds like you.
Roll it out in an afternoon.
No appliances and nothing to scale. People sign in with the account they already have, and each machine counts once, so the fleet list stays clean.
- SSO and SCIM keep users and groups in step with your directory
- Works alongside MDM tools for install and configuration
- People request access from the Connect app, and you approve it with one click
Least privilege you can prove.
Every decision has a rule behind it and a log line after it. Who had access to that box in March is a query, not an archaeology project.
- Access decided per person and per group, at the moment they connect
- Device posture reported before a session opens
- Access, audit and endpoint logs, streamed where you need them
Big-company controls, no IT department needed.
Start free for up to 10 users, and move up a plan when you need SSO or device checks.
- Free for up to 10 users, with unlimited devices
- Private access and web filtering in one console
- Priced per person, with no per-gigabyte charge
Filtering that goes where the device goes.
A router filters the house. A child on school wifi or a phone on mobile data is past it. These rules live on the device.
- The same rules at home, at school and on the move
- Your family's browsing is not a dataset we hold
- Free for 15 days, then $2 per person per month
Sign up today. No sales call.
Per person, per month. Someone with a laptop and a phone counts once, and servers behind the tunnel are free.
SSO, SCIM, device posture and Application Control.
Start with SmallInternet Access is free for 15 days, then from $2 per user per month. Compare every plan
Guides to go from sign-up to enforced.
Get startedFrom sign-up to your first rule.
Get startedWhat your network needs to allow.
Set policyDecide who reaches which systems.
Set policyCategories, hostnames and keywords.
ManageApprove access that closes itself.
Set policyConnect Google, Microsoft or your SSO.
See what happenedSend logs where you already look.
Get startedFowlguard Connect for Windows, macOS and Linux.
Is the free plan really free?
Private Access Personal is free for up to 10 users with unlimited devices. There is no card and no trial clock.
Does my traffic go through your servers?
No. Rules run on the device, and traffic goes straight to where it was going. Our service holds identity and policy, and it relays a private connection only when the network refuses a direct one.
Can I try a rule without breaking anything?
Yes. Any rule can run report-only first. You see in the logs who it would have stopped, and then you switch it to enforce.
Which sign-in providers work?
Google, Microsoft, and any provider that speaks OIDC or SAML 2.0. SCIM keeps users and groups in step, and people can add an authenticator app for a second factor.
What does it run on?
Fowlguard Connect runs on Windows, macOS and Linux. The console runs in any modern browser.