How SXAccess works
An agent on every machine, a handful of services behind it, and a tunnel that starts on a relay and moves to a direct path as soon as one is found.
Every machine on an SXAccess network runs the agent: the SXAccess app, or the CLI agent on Linux and macOS. The agent owns the local tunnel interface, holds the machine's private key, and is the only component that ever sees decrypted traffic. Everything else exists to tell the agent which other devices it may reach and to help it reach them.
The services behind the agent
Two addresses are built into the agent: the management service and the sign-in host. The management service hands the agent every other endpoint it needs. None of these services can read your traffic.
| Service | Role | Sees your traffic? |
|---|---|---|
| Management | Holds network state, assigns overlay addresses, evaluates access rules and device requirements, and pushes each device its network map. It also tells the agent which Discovery, relay, STUN and TURN endpoints to use. | No - it distributes public keys and access rules, never payload |
| Discovery | Passes negotiation messages between two agents while they set up a tunnel. Each message is sealed to the far device's key. | No - it forwards messages it cannot open |
| Relay | Carries the tunnel until a direct path is found, and for as long as none can be found. | No - it forwards ciphertext it cannot open |
| STUN and TURN | STUN tells the agent which public address and port the outside world sees. TURN is a standard relay, used only when one of the two devices has no SXAccess relay. | No - TURN, like the relay, only carries ciphertext |
| Sign-in | Where members sign in - in a browser, in the apps, or through sxaccess start. The dashboard and the REST API are served from the same host, app.sxaccess.com. | No - it handles accounts, not traffic |
How two machines connect
A tunnel starts on the path that always works and moves to the fastest one it can find.
- The two agents exchange an offer and an answer over Discovery, sealed end to end.
- The tunnel comes up over the relay straight away, so traffic can flow while the agents look for something better.
- In parallel, each agent gathers candidate addresses using ICE, with STUN to learn how the outside world sees it, and both sides test the candidate pairs.
- When a direct device-to-device path answers, the tunnel moves onto it, and from then on the traffic never touches our infrastructure. If that path is lost later, the tunnel drops back to the relay until a new one is found.
Behind a strict NAT - carrier-grade NAT on a mobile network, for instance - there may be no direct path, and the tunnel stays on the relay. Either way the payload stays encrypted, and only the two endpoints hold the keys. A relayed connection is slower, not less private.
Where identity comes from
Members and groups live in one place. A member signs in with Google, with an email address and password, or with a passkey where the organization allows passkeys. Each member carries the groups set on their member record, so access rules are written against groups rather than against people.
The management service reads a member's role, and whether they are blocked, on every request, so a role change or a block takes effect at once. While group propagation is on, as it is by default, changing a member's groups also moves their existing devices. Sign-in covers the ways members sign in.
The network map
The management service keeps a long-lived stream open to every connected agent. When anything changes - a new device, an edited access rule, a revoked key, a new route - it recomputes the network map for each affected device and pushes it.
A network map is deliberately narrow. An agent is told only about the devices an access rule connects its device with, in either direction, together with their public keys, overlay addresses, routes and DNS configuration. The agent on a routing device of a network is also told about every device an access rule lets reach one of its resources. Other devices are not in the map at all, so they cannot be probed, scanned or discovered from a machine that has no business reaching them. Until an access rule allows it, no device reaches another.