TotalHealZeroGateZero Trust Network Access (ZTNA)
Access to named apps and servers only, re-checked continuously — not the whole subnet.
Trial: 30 days. You sign in to the TotalHeal console with a Sttiz account and activate ZeroGate ZTNA. No card.
A classic VPN puts a user on the whole subnet and checks the device once, at login. A compromised laptop keeps its access until someone notices.
Each user and device gets access only to the applications and servers a policy allows, and device health and risk are re-evaluated continuously. When a device’s risk rises, its access shrinks or is cut within seconds.
ZeroGate ZTNA, feature by feature.
Grants, deny by default
Who (user, group, tag, device, profile) may reach what (app, tag, device, subnet, host), with which capabilities (protocol, ports, HTTP verbs, SSH logins) and under which conditions (posture, risk, MFA age, time, country). Validate and simulate before you save.
A private encrypted network per organisation
Each organisation has its own overlay network; a device only sees the peers and routes it is granted.
Device posture
OS supported, patch age, critical CVEs, rooted, EDR and AV healthy, disk encryption, firewall, Secure Boot, UEM enrolment, certificate and MFA give a healthy, risky or compromised verdict.
Risk-adaptive access
Full, restricted, sensitive apps blocked, isolated or quarantined as risk rises. In our tests a high-risk device lost its connections in under a second.
Enrolment profiles and approval
Nine profile kinds, one-time or reusable keys, a manual approval queue and automatic rejection on bad posture.
Just-in-time access
Request, automated risk analysis, human approval (never your own), a time-boxed grant (default up to 8 hours) and automatic expiry.
Gateways for private apps
A Linux node as subnet router, exit node or app connector for private HTTP/TCP apps; routes approved by an admin.
Secure SSH
Identity-based SSH and SFTP with no distributed keys, per-session authorisation, recordings (always on for root) and a searchable command audit.
Micro-segmentation and response
Deny guards between tags, environments and departments. XDR can revoke access or quarantine a device while a forensic channel stays open.
How ZeroGate ZTNA works.
A VPN checks a device once and then trusts it with a whole subnet. ZeroGate grants each user and device access to named applications and servers only, re-evaluates device health and risk continuously, and cuts or narrows access within seconds when a device turns risky — with no inbound port on your network.
- EnrolUsers install the TotalHeal app and enrol with a profile key; devices can wait for manual approval and are refused on bad posture.
- GrantWrite who may reach which app or server, with which ports, verbs and logins, under which conditions — validate and simulate before saving.
- ConnectThe client gets only the peers and routes it is granted, over an encrypted overlay, direct or relayed.
- Re-checkPosture and risk are re-evaluated continuously; access narrows, isolates or ends as risk rises.
- AuditEvery grant, session, SSH command and just-in-time approval lands in the tamper-evident audit.
Platforms and deployment
Platforms
| Platform | How it is covered |
|---|---|
| macOS and Windows | Desktop client in the TotalHeal app (per-app mode) |
| Linux (amd64, arm64) | Node for gateway roles and Secure SSH |
| Controller | SaaS, India region |
Deployment
| Profile | Status |
|---|---|
| SaaS (controller and India relay run by TotalHeal) | Available |
| Hybrid (your Linux node as router, connector or exit node) | PartialAvailable as a binary; no package or appliance image yet. |
| On-premises controller | AvailableDelivered with our team from the on-premises kit. |
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. |
Essential, Professional or Elite.
Priced per user per year. Counted: distinct users with an access client or session in 30 days.
| Feature | EssentialUS$72per user per year | ProfessionalUS$108per user per year | EliteUS$156per user per year |
|---|---|---|---|
| Grants with deny by default, a private encrypted network per organisation, gateways for private apps, policy simulation | |||
| Enrolment profiles and approval, device posture, risk-adaptive access, quarantine and release, network map, audit log | |||
| Just-in-time access: request, risk analysis, human approval (never your own), time-boxed grant | |||
| Step-up MFA, device risk and location set by your team | |||
| Secure SSH and SFTP with per-session authorisation, recordings and command audit | |||
| Revoke a device at every gateway and restore it; audit-chain verification |
List prices per user per year; minimum 25 users. Each tier includes everything in the tier before it. Volume, multi-product and partner pricing on request.
Organisations that have ZeroGate today through Enterprise or the Secure Access add-on keep every tier.
Government profile. Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks.
What you need
- TotalHeal desktop app on macOS or Windows for users
- A Linux host for each gateway or connector
- Outbound HTTPS and UDP 3479 to the relay
- A Sttiz account per user
Procurement documents for ZeroGate ZTNA
The datasheet is public. The full dossier is sent on request, so we can match it to your tender.
- Datasheet. What the product does, platforms, deployment profiles, tiers and honest limits.
- Compliance matrix. Each requirement marked comply, partial or no, with an evidence reference — CERT-In directions, DPDP, ISO 27001 controls touched, accessibility of the console, data residency.
- Bill of materials. SKUs per sizing, the unit and quantity formula, customer-side components and services.
- Architecture and hardening. How the product is deployed and the hardening guidance for each component.
- SLA. Support tiers, response targets the team can meet, update cadence and end-of-life policy.
- OEM authorisation letter. A MAF template for resellers and system integrators, with product names exactly as on the SKU.
Works well with
Part of TotalHeal Secure Access suite and of Complete — each product is still licensed on its own.
TotalHealPrivilegeVault
Privileged Access Management (PAM)
Vault admin passwords, broker sessions without revealing them, record everything and rotate afterwards.
TotalHealDNSGuard
DNS Firewall & Security
Stop malware, phishing and DNS tunnelling at the lookup — for every device, on site or on the road.
TotalHealDeviceSphere
Unified Endpoint Management (UEM)
Enrol, configure, update and secure every laptop, phone and tablet from one console.
Get a quote for ZeroGate ZTNA.
Tell us how many users you need and how you want to deploy. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.