{"rid":"egress/openziti","card":{"rid":"egress/openziti","eid":"openziti","topic":"egress","slug":"openziti","provider":"OpenZiti","url":"https://openziti.io/docs/learn/introduction/","domain":"openziti.io","category":"zero trust overlay (private only)","tier":"free","verdict":"fails-egress","vorder":5,"grp":"rejected","confidence":"documented","binding":"none","identity_kind":"anonymous","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli,rest","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":1,"usd_month":null,"usd_per_tb_month":null,"summary":"'OpenZiti is a free, open-source zero trust networking platform that makes network services invisible to unauthorized users.' Self-hosted; the software impos...","duplicate_of":null,"n_unknown":3},"record":{"topic":"egress","slug":"openziti","provider":"OpenZiti","url":"https://openziti.io/docs/learn/introduction/","category":"zero trust overlay (private only)","tier":"free","free_tier":{"stated":"'OpenZiti is a free, open-source zero trust networking platform that makes network services invisible to unauthorized users.' Self-hosted; the software imposes no quota.","unit":"unlimited","metered_on":"none","source_url":"https://openziti.io/docs/learn/introduction/","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://openziti.io/docs/learn/introduction/","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://openziti.io/docs/learn/introduction/","notes":""},"egress":{"terms":"ingress: none","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://openziti.io/docs/learn/introduction/"},"interface":["cli","rest"],"interface_detail":"ziti CLI and SDKs, plus the controller's REST API","tooling":"ziti CLI, controller, routers, tunnelers, SDKs","chaining":"a private fabric under zrok; it composes with a public ingress and adds none","limits":[],"limits_note":"","binding":"none","binding_note":"Nothing counts bytes and every service is reachable only by an enrolled identity, so a public reader cannot start a transfer at all.","identity_cost":{"kind":"anonymous","detail":"self-hosted; every endpoint is an identity with a certificate issued by the operator's controller","country":"None"},"reliability_note":"the controller is a single point of failure the operator must run","confidence":"documented","confidence_note":"A public-router configuration read would confirm that no unauthenticated listener exists; the introduction page states the model but not the router options.","evidence":[{"url":"https://openziti.io/docs/learn/introduction/","date":"2026-10-23","proved":"'a free, open-source zero trust networking platform that makes network services invisible to unauthorized users'; 'Every identity requires a certificate'"}],"verdict":"fails-egress","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"USD 0","notes":"Recorded separately from zrok, which is OpenZiti's hosted share front end and already has two records. The distinction that matters: zrok's 5 GB/day is NetFoundry's controller policy, while OpenZiti itself has no meter and no public listener.","extras":{"wg_path":"none","wg_detail":"No WireGuard: 'controllers, routers, tunnelers, and SDKs', with 'Every identity requires a certificate'. No .conf exists.","ingress":"none","volume_tib_month":null,"volume_stated":null,"bytes_transit":"overlay-only","transit_note":"routers relay between authenticated identities"}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":0,"unit":"TB","per":"month","currency":"USD","usd":0,"fx_date":null,"parse":"ok"}],"unknown":[["$.extras.volume_stated","withheld"],["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}