Smallstep ZTNA
Smallstep ZTNA provides device-level access controls for SaaS applications, internal networks, and AI-initiated workflows.
What Smallstep ZTNA is
Smallstep ZTNA provides device-level access controls for SaaS applications, internal networks, and AI-initiated workflows. Its Enterprise Relay is a transparent VPN using private MASQUE relays, mutual TLS, and hardware-bound device certificates. Administrators can route specified domains through the relay with match and exclude rules, then enforce access using IP allow lists and mutual TLS. Network-level enforcement applies across the device, routing approved traffic through a dedicated outbound IP range. When a device has a valid attested certificate, authentication occurs without login screens or user prompts. The product supports Windows, macOS, Linux, and iOS; Apple devices also have native Managed Relay support on iOS 17+, iPadOS 17+, macOS 14+, and tvOS 17+. For Windows and Linux, the Smallstep agent provides hardware-bound mutual TLS authentication. Deployment can be cloud-based or on-premises. Listed administration features include SSO, SCIM, automatic renewal, deployment automation, revocation workflows, and CA integrations. The paid product has no free plan, and pricing is available on request.
Good
- Routes selected domains using match and exclude rules.
- Valid attested certificates enable silent authentication.
- Supports cloud or on-premises deployment.
- Includes SSO, SCIM, and revocation workflows.
Watch out
- There is no free plan.
- Pricing is available on request.
Who it suits
It suits security engineers, platform teams, CISOs, and enterprises seeking device-level Zero Trust enforcement. Organizations can consider it for access control across its supported operating systems and cloud or on-premises deployment.
Verdict
Smallstep ZTNA combines device certificates, traffic routing, and access controls across Windows, macOS, Linux, and iOS. Organizations should weigh its platform and deployment fit and request pricing.
Plans and prices
From Smallstep ZTNA's own pricing page, checked 8 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Smallstep Enterprise Relay | Priced on request | Pricing provided by demo request |
The facts
Each one read from Smallstep ZTNA's own pages, with the date it was checked.
What it does
- Access model
- ztnachecked 22 Sep 2026
- Admin control level
- advancedchecked 22 Sep 2026
- Authentication
- Authentication happens silently without popups, login screens, or user prompts when a device has a valid attested certificate.checked 8 Oct 2026
- Compliance
- Smallstep’s support article says its SaaS platform has SOC 2 Type II certification and that customers can request the audit report by emailing support.checked 8 Oct 2026
- Deployment
- Smallstep says its device identity based ZTNA can be deployed in the cloud or on-premises.checked 8 Oct 2026
- Integrations
- Smallstep’s featured integrations include AWS, Stripe, Google Cloud Platform, Slack, Intune, Salesforce, GitHub, Okta, Jamf, and ServiceNow.checked 8 Oct 2026
- Intended users
- Smallstep identifies security engineers, platform teams, CISOs, and enterprises pursuing device-level Zero Trust enforcement as audiences for its products.checked 8 Oct 2026
- Key protection
- Smallstep says its CA signing keys are held in a hardware security module and that every HSM interaction is logged.checked 8 Oct 2026
- Security architecture
- Smallstep says it uses end-to-end encryption, single sign-on, mutual TLS, and multiple layers of access controls in its service delivery.checked 8 Oct 2026
- SSO / SCIM
- Yeschecked 22 Sep 2026
- Traffic controls
- Administrators can specify domains to route through the relay with match and exclude rules, then enforce access through IP allow lists and mutual TLS.checked 8 Oct 2026
- What it does
- Smallstep Enterprise Relay is a transparent VPN that uses standards-based private MASQUE relays, mutual TLS, and hardware-bound device certificates to control access to SaaS apps, internal networks, and AI initiated workflows.checked 8 Oct 2026
Where it runs
- Apple platforms
- Smallstep Enterprise Relay natively supports Apple devices through the Managed Relay MDM payload on iOS 17+, iPadOS 17+, macOS 14+, and tvOS 17+.checked 8 Oct 2026
- Device-wide enforcement
- The product provides network-level protection across the entire device and routes approved traffic through a dedicated outbound IP range.checked 8 Oct 2026
- Supported platforms
- Windows,macOS,Linux,iOSchecked 22 Sep 2026
- Windows and Linux
- For Windows and Linux, the Smallstep agent provides hardware-bound mutual TLS authentication.checked 8 Oct 2026
The company
- Company
- Smallstep’s about page describes a globally distributed team; its 2024 company blog says its founder started Smallstep about six years earlier.checked 8 Oct 2026
Money
- Free plan
- Nochecked 22 Sep 2026
Alternatives to Smallstep ZTNA
- 1
Tailscale
Free planOpen sourceAndroidiOSWebAPI9.4From $1 a month - 2
Windscribe
Free planOpen sourceAndroidiOSWebExtension9.1From $3 a month - 3
NetBird
Free planAndroidiOSLinuxmacOS9.0From €6 a month - 4
Twingate
Free planAndroidiOSWebAPI8.9From $5 a month - 5
GoodAccess
Free planAndroidiOSWebLinux8.8Free plan - 6
ZeroTier
Free planAndroidiOSWebAPI8.8From $18 a month