Frequently asked questions

Any machine that runs Ubuntu 24.04 LTS on x86-64 or ARM64 — a small PC, a server, or a cloud instance — with one or two internet connections. You bring the hardware; there is no appliance to buy or ship.

No. Traffic goes directly between your own sites over WireGuard, or through a hub that is also one of your sites. The Weft control plane handles configuration and health, and is never in the path of your packets.

Your network keeps forwarding. Every site holds a complete copy of its configuration and keeps applying it. You cannot make changes until the control plane is back, and nothing that is already working stops.

macOS, Windows and Linux. Each device generates its own WireGuard key and joins with a one-time invitation, so its private key never leaves it. You choose per client whether it sends only company traffic through Weft or everything.

Yes. A site can exchange routes with your existing equipment over OSPF or eBGP, hand off a routed network on a dedicated port, or stretch a layer-2 segment. Internet traffic can leave through your own perimeter firewall rather than from each branch.

Per site and per roaming client, monthly, with every feature on one plan. See pricing.

Thirty days, up to three sites and ten roaming clients, every feature, and no card. If you need longer, ask and we will extend it once.

Your network does not go down. After a 14-day grace period the console becomes read-only — no changes or new devices — while every site keeps forwarding on its last configuration. We will never switch off a running network to collect a bill.

The control plane and its data run in AWS's London region (eu-west-2). It holds your network's configuration, health measurements and device public keys. It never sees your traffic or any private key.

Console sign-in uses single sign-on through OpenID Connect. Connecting your own identity provider is not self-service yet — talk to us.