Link Your Sites With the Same Post-Quantum Tunnel Your People Use
AegisWire site-to-site is a turnkey, gateway-to-gateway mesh that federates your locations across regions and clouds. Most SD-WAN and mesh products protect user devices with one protocol and link their own gateways with a weaker, older one. AegisWire does not. Every inter-gateway link runs the identical quantum-resistant cipher suite, handshake, self-healing key ratchet, and tamper-evident audit trail as every client session — one security contract, from the edge to the core, with no vendor lock-in.
No downgraded inter-node link
One Cipher Suite, Edge to Core
The inter-gateway link is not a different, weaker product. It is the same protocol your people connect with.
Identical Post-Quantum Handshake
Site links negotiate keys with the same hybrid quantum-resistant handshake as client sessions — ML-KEM-1024 X25519 with ML-DSA-87 identity. No downgraded inter-node protocol to attack.
Full-Duplex, Bidirectional
Traffic flows both ways over a single peered link with independent, replay-protected streams in each direction — not a one-way forwarder.
One Audit Contract
Inter-gateway forwarding writes to the same chained, tamper-evident audit trail as everything else. No blind spot between your sites.
Turnkey, no flags to flip
How a Federation Edge Comes Up
The unit of configuration is a federation edge — a destination prefix, a direction, and the peer gateway it is reachable through. The control plane mints, registers, and delivers the trust; each gateway then dials its peer with the ordinary post-quantum client handshake.
Authorize the peer
The platform operator pre-authorizes which peer scopes a tenant may federate with. Without that authorization, no edge can be created — federation is deny-by-default.
Define the edge
A tenant admin names the reachable subnet, direction, and peer scope. The control plane compiles it into a signed interdomain_route_set — cross-site forwarding only ever happens for routes inside that signed policy.
Dial the peer
Each gateway hot-loads the delivered trust and dials its peer as a full unified client over the same handshake, pinning the peer's exact server identity. A mismatched or unsigned peer is refused at admission.
Forward, residency-aware
Packets destined for a peer's subnet ride the encrypted inter-gateway tunnel instead of egressing to the internet. The residency zone each gateway will serve is requested and enforced, so traffic stays where policy says it must.
STREAMHEAL key ratchet
Self-Healing Links
A compromised key on a site link cannot become a foothold across your whole network. The link's keys re-derive automatically every few packets over a BLAKE3 STREAMHEAL ratchet, so the window any single key protects is tiny and the link recovers on its own — without an operator, without dropping the tunnel, and without a human in the loop.
-
Continuous key ratchet
Forward-secret rekeying on a fixed packet cadence — past traffic stays protected even if a current key leaks.
-
Recovers without teardown
The link re-synchronizes itself in flight; site-to-site traffic keeps moving through the recovery.
-
Blast-radius contained
If one peer connection is compromised, the ratchet keeps the rest of the federation from being exposed.
Link Properties
Explicit, signed, revocable
Deny-by-Default Federation Trust
A gateway never peers with another just because it can reach it. Every link is explicitly authorized.
Two regions to hundreds of spokes
Where Site-to-Site Fits
The same mechanism scales from a two-region link to a hub with hundreds of branch spokes — each edge is one signed route entry.
Multi-Region Enterprise
A gateway in each region — a London office and a New York data centre, say. Clients behind one reach the private subnet behind the other across the encrypted inter-gateway tunnel, instead of egressing to the public internet. Residency stays under your control.
Hybrid & Multi-Cloud
Peer a gateway in one cloud with a gateway in another — or with on-premises — over one post-quantum mesh. Because every link is the same handshake, the cloud underneath is an implementation detail, not a security boundary you have to reason about.
Branch Interconnect
A head-office gateway with many branch gateways — for example a bank's central site and its branches. Branches reach central services; selected branches reach each other. Each branch edge is one signed, individually-revocable route, so membership is centrally controlled, never standing.
AWS + Vultr, mixable
No Vendor Lock-In
Gateways run across multiple infrastructure providers — AWS and Vultr today — and a single customer can mix them in one mesh. The federation contract is the post-quantum transport, not any one cloud, so a peer link between an AWS region and a Vultr region is the identical handshake as any other. Control planes run on managed Fargate; gateways go where you need the residency and the economics.
- Provider-neutral peering
Every gateway feature is built for both vendor paths — cross-cloud federation is a first-class case, not a workaround.
- Residency-aware placement
Choose the region each gateway serves; the requested residency zone is enforced at the gateway, so data stays where policy requires.
- One operational surface
Provision, authorize, and revoke edges from the same control plane regardless of the cloud underneath each gateway.
- Signed update distribution
Gateway binaries ship through a signed update channel; an unsigned or tampered artifact is rejected before it can run.
Federation Contract
Built for regulated procurement
Commissioned on customer scopeA Federation Your Auditors Can Follow
Site-to-site is built to the controls that SOC 2, ISO 27001, GDPR, and HIPAA-style reviews examine — deny-by-default peer admission, signed and identity-bound links, residency enforcement, and one tamper-evident audit trail spanning client and inter-gateway traffic alike. Cross-site forwarding is never a compliance blind spot.
Watch every link with the Sentinel defense plane
AI Sentinel is a separately-licensed plugin that watches inter-gateway forwarding with the same defense plane that watches client sessions — co-designed with the transport, not a generic UEBA layer bolted on. It fuses entity-graph and temporal detectors with device-posture admission, reasons over a risk lattice, and escalates along a defined action ladder, so a federation link is never a monitoring blind spot.
Talk to engineering
Request an architecture briefing
A technical walkthrough of the transport, trust model, and deployment options — mapped to your environment and procurement requirements.