Core concepts

See how organizations, networks, devices, labels, people groups, rules and roles relate to each other on one page.

For:MemberAdminOwnerUpdated September 16, 2026

Seven concepts are enough to understand nixscale. This page shows them together; follow the links for the details.

Concept map

Organization "Acme"                          plan, people and subscription live here
│
├── People                                   Owner · Admin · Member
│
└── Network "Head office"  (k7mp)            its own control server and IP block
    ├── Devices
    │   ├── Personal computer                has an owner → managed with people groups
    │   └── Machine                          no owner → managed with a label
    ├── People group "developers"            covers people's computers
    ├── Label "db"                           covers machines
    └── Rule: developers → db : TCP 5432     a permission; no rule, no access

Organization

Represents your company. The plan, the number of people and the subscription live at the organization level. An organization is created automatically for every user on first sign-in, and that user becomes its owner. You join another organization only by invite.

Details: Organization overview.

Network

Where your devices meet. Every network has its own control server (<network-id>.hs.nixscale.com) and its own IP block; networks are isolated from each other. An organization can have as many networks as its plan allows.

Details: Networks.

Device

Every computer or server that joins the network is a device, and it's one of two kinds:

Kind	Owner	Access comes from
Personal computer	A person	The people groups that person is in
Machine	None	The device's label

Details: Manage devices.

People group

A list of people on the network (developers, ops …). When you pick a group in a rule, the rule covers every personal computer of those people. Joining the group grants that access; leaving removes it for all their devices at once.

Details: People groups.

Label

A machine's identity (db, server, app …). Every machine carrying the same label is managed under one name in rules. Labeling a personal computer turns it into a machine and can't be undone.

Details: Labels.

Rule and policy

A rule defines a single permission: source → destination → protocol/port. All the rules are compiled into a policy that's applied to the network's control server and distributed to devices. With no rules, no traffic is allowed.

Details: Rules.

Roles

Role	Applies to	In short
Owner	Organization	Can do everything; only owners grant the owner role
Admin	Organization	An admin on every network; invites people, creates networks
Member	Organization	Only sees the networks they're assigned to
Admin	Network	Manages that network's devices, labels, groups and rules
Member	Network	Adds their own device; uses the access rules grant

Details: Members and roles.

Other terms

For short definitions of terms like control server, MagicDNS, route and policy version, see the Glossary.