# CanMe — full product description

## Identity

- Product name: CanMe
- Vendor: CanMe GmbH, founded in April 2024 with its first customer
- Headquarters: Albert-Einstein-Straße 1, 95028 Hof, Germany
- Website: https://canme.cloud
- Email: hello@canme.cloud
- Languages of the public site: English, German
- Category: private dark network for enterprises; identity-first Cloud Area Network (CAN); zero-trust network access
- Signature: Advancing without firewalls.
- BSI-built · GDPR-native · Made in Germany

## One-paragraph description

CanMe is a private dark network for enterprises. In the age of AI, anything you expose gets found. CanMe connects people, sites, clouds and machines by identity, so nothing you run has to be exposed: there are no open ports and no public IPs on anything you run. Only the CanMe Core and Mesh face the internet — hardened, and run by the customer. Inside CanMe, services have no IP address at all; they are reached by identity, and only by the identities the customer allows. CanMe runs where the customer chooses — their own premises, a C5-audited data centre, AWS, Azure, Google Cloud, a sovereign cloud or bare metal — and CanMe never hosts it. A customer can set it up themselves in an afternoon.

## The five pieces

Start with one Core and grow from there.

- **Core** — the brain. Every identity, every rule, every key, in one place the customer runs. High availability: deploy two more Cores (three in all) and it fails over by itself. Minimum sizing: 4 cores · 16 GB RAM · 80 GB disk.
- **Mesh** — the backbone. Encrypted reach between people, sites and clouds. Need reach somewhere new? Add a Mesh there. Minimum sizing: 2 cores · 8 GB RAM · 60 GB disk.
- **Gate** — the guard. For machines that can't run software and sites without a firewall. Everything behind it gets an identity and stays dark. Minimum sizing: 2 cores · 8 GB RAM · 60 GB disk.
- **Cannector** — the identity on every device. Apps for every major OS (Windows, macOS, Linux, iOS, Android), plus a command-line client for headless Linux servers. Sign in once, or join the device, and it is part of the network, wherever it is.
- **LINK** — a hardware Cannector: a small device that is one identity. Plug it in front of anything (a camera, a turbine, a machine) and the thing behind it goes dark. It works like a check valve: only what you allow gets through.

Forms: Core, Mesh and Gate each come as an appliance (recommended hardware plus software), as an ISO for your own supported hardware (the CAN Live ISO), as a VM, or as an AWS, Azure or GCP image.

## Inbound ports (from the internet)

- Core: 53, 80, 443, 8440, 9000
- Mesh: 443, 9000
- Gate, Cannector, LINK: none — they only connect outbound
- Port 8443 opens for the first setup only, then closes itself.
- The Cansole is not on the internet; admins reach it through Cannector.

## Where it runs

Runs where the customer chooses. Never with CanMe.

- The customer's own premises: their racks, their power, their keys.
- C5-audited data centres: the provider the customer chooses.
- AWS, Azure and Google Cloud: ready images, in the region the customer picks.
- Sovereign clouds: STACKIT, IONOS, OVHcloud and others, with the CAN Live ISO as a VM.
- Bare metal: the CAN Live ISO on any supported hardware.
- Air-gapped ready: CanMe calls out only to the CanMe license server and update server, plus the support channel when the customer turns it on. A fully offline delivery is possible under a separate contract.

CanMe never hosts it. Customers who would rather not run it themselves can have a certified CanMe partner host it for them. Wherever it runs, no one can look inside the customer's network — not even CanMe.

## The CanMe Cansole: six apps, live today

- **Dashboard** — Your whole network, live. Every identity, every node, at one glance.
- **Access** — A global firewall you run in three clicks. Who reaches what, for every person, device and service, with no IP rules to write.
- **Infrastructure** — Build your network piece by piece. Place a Core, Mesh or Gate on the map, roll it out, and watch it come online.
- **Network monitor** — The deep health check of your network. Latency, throughput and outages, each one traceable, so you decide on facts.
- **Logs & audit** — The proof your auditor asks for. Every move and every action, recorded in CanMe and in your SIEM.
- **Apps** — Grow the console as you need it. New apps, like CAN MCP when it arrives, install from here in one click, and just work.

Roles: Administrator, Operator, Reader.

## Coming next (not yet available)

CanMe already runs these internally. No release dates.

- **CAN MCP** — An identity-aware MCP gateway, hidden inside your Cloud Area Network. One address for every MCP server, and each agent sees only the tools its identity allows.
- **CAN Agents** — Zero-trust agents inside your Cloud Area Network. They work for your team and reach only what you allow.

## Day one

- The admin, one afternoon: name the network and add the DNS records → install the Core → add a Mesh → connect and grant the first access. Deploy guide: https://canme.cloud/en/install
- Everyone else, one sign-in: install Cannector → sign in → connected. Guide: https://canme.cloud/en/join

## A normal week, without a firewall ticket

- A new colleague: HR adds her to a group in Entra ID, and her access is there — exactly what her team needs, nothing more.
- A machine stops: the machine maker's technician gets exactly the one controller he needs (behind a Gate), nothing else in the plant; afterwards his access is gone.
- A new site: a Gate goes in, and every machine, printer and server there is part of the network. Their IP addresses are irrelevant — CanMe only knows identities.
- Every step is logged.

## Pricing

Billed per identity: monthly, or with a 1, 3 or 5 year commitment, mixed as you like. You pay for the identities you connect.

## Compliance and sovereignty

CanMe is built for the strictest rules and is just as easy for every company that simply wants its network to be simple. It helps customers with frameworks such as NIS2, GDPR and ISO 27001 (frameworks the customer works towards; CanMe makes the network side provable):

- Who reaches what: documented, per identity.
- Every change: logged, and sent to the customer's SIEM.
- Where data lives: the customer's data centre, or a C5-audited one they choose.
- Who may change what: Administrator, Operator, Reader.

## Company

- CanMe GmbH, Hof, Bavaria, Germany. Founded in April 2024 with its first customer, after two years of building.
- Origin: years of consulting and IT architecture, always hitting the same bottleneck — the network. The idea sparked while moving global operations to the cloud.
- Principle: no one should be able to look inside your network — not even CanMe. Wherever CanMe runs, what is inside stays with the customer.
- Its first customers came from demanding places — critical infrastructure and regulated industries; CanMe was built with them.
- "We run CanMe on CanMe": its own compliance, operations and AI agents run on it.
- BSI-built · GDPR-native · Made in Germany. Made in Hof.

## What CanMe is not

- Not a hosted SaaS in the vendor's cloud: the customer runs it, or a certified CanMe partner hosts it.
- Not another VPN or firewall vendor: access is decided per identity, not by VPN accounts and internal firewall rules. Internet egress firewalls usually stay.

## How to evaluate

- Book a 30-minute live demo: https://canme.cloud/en/contact
- Create a myCanMe account: https://canme.cloud/en/signup

## FAQ

### What is a Cloud Area Network (CAN)?

A Cloud Area Network is an identity-first overlay network that connects people, devices, servers, cloud services, machines and whole sites without relying on public IPs, NAT or routing tables. CanMe builds it on top of any underlay — internet, MPLS, mobile — and every connection is made between identities, not addresses.

### How is CanMe different from a VPN or a ZTNA service?

A VPN trusts whoever is inside the network. Most ZTNA services run their control plane in the vendor's cloud. With CanMe every identity reaches only the services it is allowed to, applications have no open ports and no public IPs, whole sites and machines join through a Gate — and the control plane runs in your environment, not ours.

### Where does CanMe run?

Where you choose: in your own data centre, in a C5-audited data centre, on AWS, Azure or Google Cloud, in a sovereign cloud such as STACKIT, IONOS or OVHcloud, on bare metal, or air-gapped ready. CanMe never hosts it, and we never see your traffic, identities or certificates.

### Does CanMe replace my firewall and VPN?

For remote access and access between your sites, clouds and machines, yes: access is decided per identity instead of by VPN accounts and internal firewall rules. Internet egress firewalls usually stay.

### How quickly can we start, and how is it billed?

You can install a Core and a Mesh and make the first connection yourself in an afternoon. CanMe is billed per identity, pay as you go, or with a 1, 3 or 5 year commitment — mixed as you like within one tenant.

## Häufige Fragen (Deutsch)

### Was ist ein Cloud Area Network (CAN)?

Ein Cloud Area Network ist ein identitätsbasiertes Overlay-Netzwerk, das Menschen, Geräte, Server, Cloud-Dienste, Maschinen und ganze Standorte verbindet — ohne öffentliche IPs, NAT oder Routing-Tabellen. CanMe baut es auf jedem Underlay auf — Internet, MPLS, Mobilfunk — und jede Verbindung entsteht zwischen Identitäten, nicht zwischen Adressen.

### Was unterscheidet CanMe von einem VPN oder einem ZTNA-Dienst?

Ein VPN vertraut jedem, der im Netzwerk ist. Die meisten ZTNA-Dienste betreiben ihre Steuerung in der Cloud des Anbieters. Bei CanMe erreicht jede Identität nur die Dienste, die sie erreichen darf, Anwendungen haben keine offenen Ports und keine öffentlichen IPs, ganze Standorte und Maschinen kommen über ein Gate dazu — und die Steuerung läuft in Ihrer Umgebung, nicht in unserer.

### Wo läuft CanMe?

Wo Sie wollen: im eigenen Rechenzentrum, in einem C5-testierten Rechenzentrum, bei AWS, Azure oder Google Cloud, in einer souveränen Cloud wie STACKIT, IONOS oder OVHcloud, auf eigener Hardware oder air-gapped-fähig. CanMe wird nie von uns betrieben, und wir sehen weder Ihren Traffic noch Ihre Identitäten oder Zertifikate.

### Ersetzt CanMe Firewall und VPN?

Für den Fernzugriff und den Zugriff zwischen Standorten, Clouds und Maschinen ja: Zugriff wird pro Identität entschieden statt über VPN-Konten und interne Firewall-Regeln. Firewalls für den Internetausgang bleiben in der Regel.

### Wie schnell können wir starten, und wie wird abgerechnet?

Core und Mesh installieren und die erste Verbindung herstellen schaffen Sie an einem Nachmittag selbst. Abgerechnet wird pro Identität, nach Nutzung oder mit 1, 3 oder 5 Jahren Laufzeit — beliebig gemischt in einem Mandanten.

## Authoritative URLs

- https://canme.cloud/en — Home (German: https://canme.cloud/de)
- https://canme.cloud/en/platform — Platform (German: https://canme.cloud/de/platform)
- https://canme.cloud/en/use-cases — Use cases (German: https://canme.cloud/de/use-cases)
- https://canme.cloud/en/about — Company (German: https://canme.cloud/de/about)
- https://canme.cloud/en/install — Admin deploy guide
- https://canme.cloud/en/join — End-user guide (install Cannector, join a network)
- https://canme.cloud/en/contact — Contact and demo booking
- https://canme.cloud/en/signup — Create a myCanMe account
- https://canme.cloud/en/articles — Articles
- https://canme.cloud/en/jobs — Careers
- https://canme.cloud/sitemap.xml — Machine-readable URL index