What you control
which app, which people, app-level TTL, workspace-scoped access
Private App AccessBeta
Give a contractor access to one internal app — no VPN
An external contractor needs your internal CRM or admin panel, but you don't want to put a VPN client on their device or expose the network.
What stays outside
They reach the app through an alias; internal hostnames and IPs stay out of their view. The alias path is a Layer-7 reverse proxy — see what it sees.
The alias path operates at Layer 7 — see the visibility disclosure on Private App Access.
Proof points
Backed by implementation
- Access is workspace-scoped, with app-level allowlists and TTLs
- Internal hostnames and private IPs are not shown to external users
- The connector resolves the upstream inside your network
Private App Access is in Beta. It's offered as sales-assisted early access while we complete production hardening — talk to us about a pilot.
Related use cases