Atlasmesh
mTLS · identity-aware routing · multi-cluster — one control plane

Atlasmesh is the service mesh for teams that stopped trusting their own network. Every call between two workloads is mutually authenticated, encrypted, and authorized by identity — not by IP, not by a flat VPC, not by a firewall rule someone wrote in 2019. Deploy a sidecar, get a zero-trust dataplane across every cluster you run.

The dataplane under platform teams that stopped trusting the perimeter

DriftpayTollgate BankOrbit LogisticsHelio RoboticsVireo HealthFoundry CloudDriftpayTollgate BankOrbit LogisticsHelio RoboticsVireo HealthFoundry Cloud
The dataplane

Identity on every hop.Encryption you can'tforget to turn on.

A flat network trusts anything that already got inside. Atlasmesh inverts that: every workload gets a cryptographic identity, every connection is authenticated and encrypted, and nothing talks to anything it wasn't explicitly allowed to. The lateral-movement blast radius of a single compromised pod goes to zero — because the next service doesn't recognize it.

mTLS that's on before you ask

Workloads get a SPIFFE identity the moment they start, and every connection between them is mutually authenticated with TLS 1.3. Certificates are issued, rotated, and revoked by the mesh on an hourly clock — there is no static secret to leak, no expiry to page you at 3am, and no developer who has to remember to enable encryption. It's the floor, not a feature flag.

Authorize by who, not by where

Write policy against service identity and request attributes — checkout may POST to payments, refunds may not — instead of brittle CIDR ranges. The IP a workload happens to land on stops being a credential.

Golden signals on every call

Latency, traffic, errors, and saturation for every service-to-service edge, emitted automatically. No SDK, no manual instrumentation — the sidecar already sees every byte, so the request graph draws itself.

Traffic shaping that survives a bad deploy

Canary by percentage, mirror live traffic to a shadow build, retry idempotent calls, and trip a circuit breaker before a slow dependency takes the whole call chain down with it.

One mesh across every runtime

Kubernetes pods, legacy VMs, and bare-metal services join the same identity domain and the same policy plane — so the half of your stack that isn't containerized still gets mTLS and authz.

What changes the day the mesh is enforcing

100%
Of service-to-service traffic mutually encrypted
60m
Maximum certificate lifetime — auto-rotated
<1ms
Median sidecar proxy overhead per call
0
Lines of crypto code your engineers write
Multi-cluster, one plane

One meshthat doesn'tstop at thecluster edge.

Most meshes manage one cluster well and abandon you at the boundary. Atlasmesh federates identity and policy across every cluster, cloud, and region you run — so a service in us-east calls a service in eu-west over mTLS, governed by one policy, with the failover already wired.

Cross-cluster service discovery

A service in any cluster resolves and reaches a service in any other by name. The mesh handles the gateways, the routing, and the identity hand-off — no VPN mesh, no manual peering.

Locality-aware failover

Requests stay in-zone for latency, then spill to the nearest healthy region automatically when a cluster degrades — without an on-call engineer flipping DNS at 3am.

Federated trust, scoped per environment

Prod and staging are separate trust domains that can't talk by accident. Grant a specific cross-domain edge explicitly, and never wider than the one call that needs it.

Sidecar or sidecarless

Run the full-featured proxy per workload, or a lightweight per-node dataplane to shave the last microseconds and the per-pod memory — same identity, same policy, your call.

The blast radius you close

Every way a flat network betrays you — shut at the dataplane.

The breaches that hurt rarely come through the front door. An attacker lands on one pod, finds the network wide open, and walks sideways to the database. Atlasmesh removes the assumption that 'inside the perimeter' means 'trusted,' so the second hop fails even when the first one succeeds.

Deny by default

Lateral movement

A compromised workload can only reach the services its identity is explicitly authorized for. Everything else returns a TLS handshake rejection, not a foothold.

mTLS 1.3

Sniffed east-west traffic

Service-to-service calls are encrypted end to end, so a tap on the pod network or a misconfigured node yields ciphertext, not credentials and PII in the clear.

SPIFFE SVID

Spoofed service identity

Every workload proves who it is with a short-lived, cryptographically attested identity. An attacker can take an IP; they can't forge the certificate that IP is supposed to present.

Hourly rotation

Stolen static secrets

There's no long-lived API token or shared password between services to exfiltrate — identity is issued and rotated by the mesh, and a leaked cert is dead within the hour.

Pinned gateways

Unaudited egress

Calls to external APIs route through a controlled egress gateway with a pinned destination, so a workload can't quietly phone home to an attacker's endpoint.

Live topology

The invisible dependency

The mesh maps every real service-to-service edge from observed traffic, surfacing the undocumented call path nobody knew was load-bearing until it broke.

From the platform teams

Teams that meshed it stopped trusting their VPC.

We turned on enforcement and an old internal admin tool immediately failed to reach the user database — because nothing had ever authorized that edge. It had been an open path for two years. Atlasmesh made the implicit trust explicit, and then it made it a deny.

P
Priya Nair
Principal Platform Engineer, Driftpay

Our auditors wanted proof that every service-to-service call was encrypted. Instead of a spreadsheet of promises, we exported the authz graph and the mTLS status for every edge across four clusters. The control closed itself, and it unblocked two regulated contracts that quarter.

M
Marcus Whitfield
VP Infrastructure, Tollgate Bank

A dependency started timing out and the circuit breaker tripped before it cascaded. We watched the call graph reroute in the dashboard while the on-call engineer slept. With our old hand-rolled retries that's a full outage and a postmortem, not a footnote.

D
Devon Clarke
Head of SRE, Orbit Logistics
Pricing

Free for the dataplane. Priced per node after that.

Per-request and per-sidecar pricing taxes you for routing more of your own traffic. Atlasmesh bills by the worker node the mesh runs on — mesh every namespace, every cluster, as much as you want.

Open Source

The full dataplane, self-managed, for teams running their own control plane.

$0/forever
  • Unlimited workloads & clusters
  • Automatic mTLS & SPIFFE identity
  • Traffic management & retries
  • Golden-signal metrics export
  • Community support
Most popular

Platform

Managed control plane and zero-trust policy for production fleets.

$40/node/mo
  • Managed multi-cluster control plane
  • Identity-aware authz policy engine
  • Cross-cluster discovery & failover
  • Live topology & authz graph export
  • SSO, RBAC & 90-day audit logs
  • Priority support

Enterprise

For regulated, air-gapped, multi-region platform organizations.

Custom
  • Air-gapped & FIPS-validated deploy
  • Custom trust domains & policy
  • Egress governance & SAN pinning
  • SCIM & immutable compliance logs
  • Dedicated mesh architect
  • 99.99% control-plane SLA

Straight answers for platform teams.

Do my applications need to change to get mTLS?

No. The mesh injects a sidecar proxy alongside each workload and intercepts traffic transparently, so your services keep making plain HTTP and gRPC calls while the proxy upgrades every connection to mutually authenticated TLS. Your code doesn't import a crypto library, manage a certificate, or know the mesh is there.

What does the sidecar cost me in latency and memory?

Median proxy overhead is under a millisecond at p50, and the sidecarless per-node mode trims it further for latency-critical paths. You can run the full proxy where you want rich per-request control and the lightweight dataplane where every microsecond and megabyte counts — same identity and policy under both.

How is this different from a network policy or a firewall?

A firewall and a Kubernetes NetworkPolicy authorize by IP and port — addresses that get reassigned and reused constantly, so they prove nothing about who is actually calling. Atlasmesh authorizes by cryptographic workload identity and request attributes, encrypts the call regardless of the network underneath, and enforces the same policy across clusters and clouds where an L3 firewall can't see at all.

Can it cover the services that aren't in Kubernetes yet?

Yes. VMs and bare-metal services join the same trust domain through a host agent, receive the same SPIFFE identity, and fall under the same authz policy as your pods — so the legacy half of your estate gets mTLS and zero-trust authorization instead of staying the soft underbelly.

What happens to traffic if the control plane goes down?

The dataplane keeps running. Proxies cache their certificates, policy, and routing, so existing and new connections continue to authenticate and flow during a control-plane blip — the control plane configures the mesh, it isn't in the request path. We also run a 99.99% SLA on the managed plane with regional failover.

Are you ready for our security and compliance review?

Atlasmesh is SOC 2 Type II and ISO 27001 certified, supports FIPS-validated cryptography and fully air-gapped deployment, and exports the live mTLS and authorization status of every service edge — so you can evidence encryption-in-transit and least-privilege east-west access to an assessor instead of attesting to it on faith.

Stop trustingthe network.Start proving it.

Install the dataplane, watch every service-to-service call light up with mTLS, and trace a real request across two clusters before this tab goes stale. No application rewrite, no static secrets, no sales call to start.