Managed WireGuard networking, with a control plane of your own
nixscale gives every customer an isolated headscale instance, a disjoint IP block and a zone-based default-deny policy engine. Devices connect with official Tailscale clients; your traffic flows end-to-end encrypted and peer-to-peer — it never touches us.
Zone matrix → compiled policy. No ACL/JSON.
Enterprise segmentation, as easy as filling a table
You never see raw ACLs. Tick a cell in the source × destination matrix; the compiler produces deterministic policy, and nothing unvalidated ever goes live.
Zone matrix
Default-deny microsegmentation: users, server, app, db + external. A cell = permission + named service. Versioning, diffs and one-click rollback.
No server tax
Pay per human. Tagged servers, containers, subnet routers — unlimited on every plan, never billed.
MAU billing
Never pay for users who don't connect. Not seats — monthly active users.
Dedicated control plane
Per-tenant isolated headscale instance, separate database, disjoint CGNAT IP block. A neighbour's mistake can't touch you.
Data sovereignty
Your data-plane traffic never crosses our infrastructure and is never logged; we only see control-plane metadata. Designed for GDPR/KVKK.
An honest escape hatch
Vanilla headscale underneath + config/inventory export. No vendor lock-in — move to self-hosting any day.
Your network in three steps
Create your network
Pick a plan; within minutes your dedicated control plane is live at t{id}.hs.nixscale.com.
Connect devices
Team members sign in through SSO with the official Tailscale client; servers are born into their zone with tagged keys.
Manage from the matrix
Who reaches whom, over which service — tick the cell. The compiler builds the policy and shows you the impact.
Simple, predictable pricing
No server tax on any plan. 15% off with annual billing.
Free / Dev
For trials, hobbyists and dev
- ✓3 users
- ✓15 devices
- ✓1 network
- ✓Top-level zone matrix
- ✓7-day audit view
Team
Small teams and agencies
+ $5 / MAU
- ✓Unlimited users (MAU-billed)
- ✓250 devices
- ✓Sub-zones + service catalog
- ✓Rollback + diffs
- ✓10 subnet routes
Business
Mid-size companies
+ $12 / MAU
- ✓2,000 devices
- ✓SSO with your IdP
- ✓Enforced MFA policy
- ✓Audit export + 1-year retention
- ✓SSH management + impact analysis
- ✓99.5% SLA
Enterprise
Compliance and scale
- ✓Contract limits (up to 65k devices)
- ✓SCIM provisioning
- ✓Log streaming to your SIEM
- ✓Version pinning + maintenance windows
- ✓Data-residency options
- ✓99.9% SLA + dedicated support
Prices are pre-launch drafts; the model and limits are binding.
Join the early-access list
Be one of the first tenants at launch — we'll ping you when your slot is ready.
Request early access