Freedom251 › Business VPN Software
Smallstep ZTNA
What Smallstep ZTNA is
Smallstep Enterprise Relay provides device-level controls for access to SaaS apps, internal networks, and AI-initiated workflows. It operates as a transparent VPN using standards-based private MASQUE relays, mutual TLS, and hardware-bound device certificates. Administrators can define domains to send through the relay with match and exclude rules, then apply IP allow lists and mutual TLS. Network-level enforcement applies across the device, and approved traffic uses a dedicated outbound IP range. A valid attested certificate allows authentication without login screens or user prompts. The product supports Windows, macOS, Linux, and iOS. Apple devices can use the Managed Relay MDM payload on iOS 17+, iPadOS 17+, macOS 14+, and tvOS 17+; Windows and Linux use the Smallstep agent for hardware-bound mutual TLS authentication. Deployment can be in the cloud or on premises. Smallstep identifies security engineers, platform teams, CISOs, and enterprises pursuing device-level Zero Trust enforcement as audiences. Featured integrations include AWS, Stripe, Google Cloud Platform, Slack, Intune, Salesforce, GitHub, Okta, Jamf, and ServiceNow. Pricing is provided on request, and there is no free plan.
Who it suits
Smallstep Enterprise Relay suits security engineers, platform teams, CISOs, and enterprises seeking device-level Zero Trust enforcement. It is relevant to organizations that need to control access to SaaS, internal networks, and AI-initiated workflows across supported desktop and mobile platforms.
What it does well
- Routes approved traffic through a dedicated outbound IP range.
- Uses hardware-bound device certificates and mutual TLS.
- Supports cloud or on-premises deployment.
- Apple devices can use the Managed Relay MDM payload.
- Includes SSO, SCIM, and advanced admin controls.
What to know first
- There is no free plan.
- Pricing is provided on request.
- Apple Managed Relay requires specified OS versions.
- Windows and Linux use the Smallstep agent.
Limits
There is no free plan, and pricing is available by demo request. Apple Managed Relay support applies to iOS 17+, iPadOS 17+, macOS 14+, and tvOS 17+; Windows and Linux authentication uses the Smallstep agent.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Smallstep Enterprise Relay | Pricing provided by demo request | On request |
As smallstep.com lists them, read 8 Oct 2026. The maker's own page has the final word.
Getting started
- Visit https://smallstep.com/product/ztna/.
- Request pricing for Smallstep Enterprise Relay.
- Choose cloud or on-premises deployment.
- For Apple devices, use the Managed Relay MDM payload on supported versions.
- For Windows and Linux, use the Smallstep agent.
Verdict
Consider Smallstep Enterprise Relay if your organization needs device-level network enforcement with certificate-based access controls and cloud or on-premises deployment. It supports multiple operating systems and administrative workflows, but pricing requires a request and there is no free plan.
Questions
How is Smallstep Enterprise Relay priced?
Pricing is provided on request through a demo request.
Is there a free plan?
No, the product is paid and has no free plan.
Which platforms does it support?
It supports Windows, macOS, Linux, and iOS. Native Apple Managed Relay support also covers iPadOS 17+, macOS 14+, and tvOS 17+.
Can it be deployed on premises?
Yes. Smallstep says its device-identity-based ZTNA can be deployed in the cloud or on premises.
What integrations are featured?
Featured integrations include AWS, Stripe, Google Cloud Platform, Slack, Intune, Salesforce, GitHub, Okta, Jamf, and ServiceNow.
What access controls does it use?
It uses private MASQUE relays, mutual TLS, hardware-bound device certificates, domain match and exclude rules, and IP allow lists.
Facts from Smallstep ZTNA's own pages
- Access model
- ztna · smallstep.com, 22 Sept 2026
- Admin control level
- advanced · smallstep.com, 22 Sept 2026
- Apple platforms
- Smallstep Enterprise Relay natively supports Apple devices through the Managed Relay MDM payload on iOS 17+, iPadOS 17+, macOS 14+, and tvOS 17+. · smallstep.com, 8 Oct 2026
- Authentication
- Authentication happens silently without popups, login screens, or user prompts when a device has a valid attested certificate. · smallstep.com, 8 Oct 2026
- Company
- Smallstep’s about page describes a globally distributed team; its 2024 company blog says its founder started Smallstep about six years earlier. · smallstep.com, 8 Oct 2026
- Compliance
- Smallstep’s support article says its SaaS platform has SOC 2 Type II certification and that customers can request the audit report by emailing support. · support.smallstep.com, 8 Oct 2026
- Deployment
- Smallstep says its device identity based ZTNA can be deployed in the cloud or on-premises. · smallstep.com, 8 Oct 2026
- Device-wide enforcement
- The product provides network-level protection across the entire device and routes approved traffic through a dedicated outbound IP range. · smallstep.com, 8 Oct 2026
- Free plan
- No · smallstep.com, 22 Sept 2026
- Integrations
- Smallstep’s featured integrations include AWS, Stripe, Google Cloud Platform, Slack, Intune, Salesforce, GitHub, Okta, Jamf, and ServiceNow. · smallstep.com, 8 Oct 2026
- Intended users
- Smallstep identifies security engineers, platform teams, CISOs, and enterprises pursuing device-level Zero Trust enforcement as audiences for its products. · smallstep.com, 8 Oct 2026
- Key protection
- Smallstep says its CA signing keys are held in a hardware security module and that every HSM interaction is logged. · smallstep.com, 8 Oct 2026
- Security architecture
- Smallstep says it uses end-to-end encryption, single sign-on, mutual TLS, and multiple layers of access controls in its service delivery. · smallstep.com, 8 Oct 2026
- SSO / SCIM
- Yes · smallstep.com, 22 Sept 2026
- Supported platforms
- Windows,macOS,Linux,iOS · smallstep.com, 22 Sept 2026
- Traffic controls
- Administrators can specify domains to route through the relay with match and exclude rules, then enforce access through IP allow lists and mutual TLS. · smallstep.com, 8 Oct 2026
- What it does
- Smallstep Enterprise Relay is a transparent VPN that uses standards-based private MASQUE relays, mutual TLS, and hardware-bound device certificates to control access to SaaS apps, internal networks, and AI initiated workflows. · smallstep.com, 8 Oct 2026
- Windows and Linux
- For Windows and Linux, the Smallstep agent provides hardware-bound mutual TLS authentication. · smallstep.com, 8 Oct 2026
Where Smallstep ZTNA stands on Freedom251
- Business VPN Software#71 of 94