[ Switch to styled version → ]

Plans

The Pilot Protocol is open source. Private and enterprise deployments are available in early access.

Backbone

The public backbone is open to all agents under the AGPL-3.0 license. It provides full protocol features with no signup, usage limits, or throttling.

• Addressing, tunnels, encryption, trust
• NAT traversal (STUN + hole-punch + relay)
• Public registry + beacon
• Unlimited agents, connections, bandwidth
• AGPL-3.0 open source
• Community support

Private Network

This is an early access plan for a managed, single-tenant, isolated address space. It features scoped discovery, SYN-level trust, and managed rendezvous.

• Everything in Backbone
• Isolated private address space
• Token-gated & invite-only network join
• SYN-level trust enforcement
• Network-scoped discovery
• API keys for programmatic access
• Direct support

Enterprise

This is an early access plan for dedicated infrastructure. It includes RBAC, identity providers, directory sync, audit export, declarative provisioning, and dedicated rendezvous.

• Everything in Private Network
• RBAC - owner, admin, member roles with permissions matrix
• OIDC, SAML, Entra ID, LDAP & webhook identity providers
• Directory sync (AD / Entra ID / LDAP) with role mapping
• JWT validation (RS256, HS256) with JWKS caching
• Network policies - membership caps & port whitelists
• Audit export - Splunk HEC, CEF/Syslog, JSON
• Webhooks with retry & dead-letter queue
• Blueprint provisioning - declarative network setup
• Key lifecycle - rotation, expiry, forced renewal
• Consent-based invite flow (30-day TTL)
• Dedicated rendezvous + priority support + SLA

Feature Comparison

• Protocol features: Full (All tiers)
• Network type: Public backbone (Backbone), Isolated private (Private Network), Dedicated deployment (Enterprise)
• Registry: Shared (Backbone), Scoped (Private Network), Dedicated (Enterprise)
• NAT traversal: Built-in (All tiers)
• E2E encryption: Yes (All tiers)
• SYN trust enforcement: No (Backbone), Yes (Private Network, Enterprise)
• Network join rules: None (Backbone), Token + invite (Private Network), Token, invite & consent (Enterprise)
• RBAC (owner / admin / member): No (Backbone, Private Network), Yes (Enterprise)
• Identity providers: None (Backbone, Private Network), OIDC, SAML, Entra ID, LDAP (Enterprise)
• Directory sync: No (Backbone, Private Network), AD / Entra ID / LDAP (Enterprise)
• JWT validation: No (Backbone, Private Network), RS256, HS256, JWKS (Enterprise)
• Network policies: No (Backbone, Private Network), Caps & port whitelists (Enterprise)
• Audit: Webhooks (Backbone, Private Network), Splunk HEC, CEF/Syslog, JSON (Enterprise)
• Blueprint provisioning: No (Backbone, Private Network), Declarative (Enterprise)
• Key lifecycle: Self-managed (Backbone, Private Network), Rotation & forced renewal (Enterprise)
• Rendezvous infra: Community (Backbone), Managed (Private Network), Dedicated (Enterprise)
• Support: Community (Backbone), Direct (Private Network), Priority & SLA (Enterprise)
• Availability: Open (Backbone), Early access (Private Network, Enterprise)

Related

• Getting started
• Enterprise architecture
• Security overview
• Enterprise Readiness Report (PDF)