Remote appliance management with no inbound firewall ports
Run your whole fleet from one login. Open no ports to do it.
ShadowCradle, VCradle and Firecradle appliances reach out to the cloud, so you never open an inbound hole in a customer firewall. Support can step in only when your own admin says yes, and only for a set time. Start free*.
One cloud login for every paired appliance.
Why teams choose it
No inbound holes in the firewall
Each appliance opens an outbound connection to the cloud. Cloud management needs no port forward and no inbound rule at the customer site.
Support only with your approval
A support session needs a yes from an owner or admin of your own organization. Nobody can approve their own request.
Access that ends on time
Sessions last 60 minutes by default and never more than 4 hours. A request nobody answers lapses after 24 hours.
Your rules still apply
The cloud link is a transport, not a back door. The appliance keeps its own login and roles, and it checks with the cloud again before it lets support in.
Every step on the record
Requests, approvals and support actions are audited. You can also ban support access for your organization.
Easy to start, affordable by design
Pair an appliance and it shows up in the console. No VPN to build for cloud management. Start free*, and grow at an affordable price.
What you can do
Cloud management relay
- Outbound WebSocket. The appliance dials out to the cloud over TLS. The cloud never connects in.
- Token-authenticated. The appliance proves itself with a token from pairing. The connection retries by itself after a drop.
- Drive the appliance from the console. Open the appliance's own web interface and API from the cloud console, with no port open at the site.
- Local roles still decide. The relay carries the call. The appliance still applies its own login and roles.
- Remote shell blocked by default. On ShadowCradle, shell access over the cloud link stays refused unless you turn it on.
- Backup data stays off the relay. The relay carries management calls. Backups go between your agents and your appliance.
What is on by default
- ShadowCradle. The relay runs whenever the appliance is paired with the cloud. Pairing is the consent.
- VCradle (optional). The relay runs only when the appliance is paired and you switch the relay on. It is off by default.
- Firecradle (optional). The relay runs only when the appliance is paired and you switch the relay on. It is off by default.
- Airgap and unpaired. An appliance that is not paired opens no cloud connection at all. It keeps working fully on its own.
Support sessions you approve
- Approved by your owner or admin. An owner or admin of your organization decides. Platform staff cannot approve their own access.
- The appliance re-checks. Before support gets in, the appliance verifies the session with the cloud itself.
- Time-boxed. Default 60 minutes, at most 4 hours. An unanswered request stays open up to 24 hours, then lapses.
- One org, one device. A session covers one organization and one device. The support login is never a super-admin.
- Ticket-scoped unattended consent. If you agree on a ticket, support can work unattended for up to 72 hours. You can withdraw it.
- Ban support access. Your administrators can set standing bans on support access for your organization.
- Audited. Requests, approvals and support actions are recorded.
- Sensitive actions denied. On ShadowCradle, support cannot destroy backups, run vacuum, change legal hold or create API keys.
VCradle guest tunnel
- RDP or SSH into a VM with no network port. The connection rides the channel between the VM and its host, not your network.
- Off for each VM by default. You enable it per VM, so nothing opens until you decide.
- Allow-lists and limits. Set which services and ports are allowed, how many sessions, and the longest session. Idle sessions end.
- Works with no cloud. It is local to the host and the VM. It does not need the cloud link.
Firecradle endpoint tunnel
- WireGuard from the agent to the firewall. A roaming device opens a tunnel straight to your Firecradle firewall.
- 5-minute, posture-checked grants. The cloud brokers a short grant after a posture check. It does not carry your traffic.
- No private keys in the cloud. The cloud brokers access and holds no tunnel private keys.
- One WireGuard port on the firewall. Unlike cloud management, roaming access means the firewall listens on a WireGuard UDP port. That is the design.
How it works
Pair the appliance
Link the appliance to your cloud organization. It then dials out over TLS and shows up in the console. ShadowCradle starts the relay on pairing. For VCradle and Firecradle you switch the relay on yourself.
Manage from one place
Open the appliance from the cloud console. Your own roles still apply on the appliance, and no inbound port is needed.
Ask for support only when you need it
Support requests a session for one device. An owner or admin of your organization approves it, and the appliance checks with the cloud once more.
The window closes by itself
The session counts down from 60 minutes by default and cannot pass 4 hours. When it ends, the access is gone and the steps stay in the audit trail.
See how it works
Outbound only
A support session you approve
Endpoint tunnel
Who it is for
A new client with a locked-down firewall
The client will not open a port. You pair the appliance, it dials out, and it appears in your console the same day. No change request to their network team.
A vendor needs to look at one appliance
Support asks to join one device. Your admin approves for an hour and sees it end on its own. Afterward the audit trail shows who asked and who agreed.
An office with no IT staff
Pair the box once. Whoever looks after it can manage it from the cloud, and your router stays untouched.
A site that must stay fully offline
Leave the appliance unpaired, or use the Airgap licence. It opens no cloud connection and keeps running on its own.
Works with
VCradle
Virtualization appliance. Cloud relay is optional and off until you enable it. Guest tunnel is off per VM by default.
Firecradle
Firewall appliance. Cloud relay is optional. It also offers a roaming endpoint tunnel over WireGuard.
Security and trust
- Cloud management is outbound only: the appliance dials out and the cloud never connects in.
- Support sessions need approval from an owner or admin of your organization. Platform staff cannot approve themselves.
- The appliance re-checks each session with the cloud and clamps it to 4 hours itself.
- Sessions cover one organization and one device. The support login is never a super-admin.
- The relay is a transport. The appliance still applies its own login and roles.
- The cloud terminates TLS on the relay and handles the management calls it forwards. It is not an end-to-end encrypted channel.
- The relay does not carry backup data.
- Roaming access runs over WireGuard. The firewall listens on one WireGuard port, and the cloud holds no private keys.
Affordable by design
Affordable by design. Cloud management for your Cradle fleet starts free* within platform limits, with no VPN to build or run for it.
*Free within platform limits. Usage beyond limits may be charged to maintain the platform.
See pricingCommon questions
How do I manage appliances without opening firewall ports?
Pair the appliance with the cloud. It opens an outbound TLS WebSocket and stays connected, so you can manage it from the console. Your firewall needs no inbound rule or port forward for this.
Is the cloud relay on by default?
It depends on the product. ShadowCradle runs it whenever the appliance is paired. VCradle and Firecradle run it only when the appliance is paired and you switch the relay on. It is optional and off by default.
Who can approve a support session on my appliance?
An owner or admin of your own organization. Platform staff cannot approve their own request. The appliance also re-checks the session with the cloud.
How long does a support session last?
Sixty minutes by default and four hours at most. A request nobody answers stays open up to 24 hours and then lapses. That 24 hours is how long the request waits, not how long access lasts.
What is ticket-scoped unattended consent?
It lets you agree, on a support ticket, that work can go ahead without someone watching. It lasts up to 72 hours and you can withdraw it.
Can I stop support from ever connecting?
You can ban support access. Your administrators set standing bans for your organization. Pairing and relay settings are also yours to control.
Can I run an appliance with no cloud connection at all?
Yes. An unpaired appliance, including one on the Airgap tier, opens no cloud connection. It keeps working on its own.
Does backup data go through the cloud relay?
No. The relay carries management calls. Backups go directly between your agents and your appliance.
How do I open RDP or SSH to a VM without opening a port?
On VCradle, turn on the guest tunnel for that VM. The session runs over the channel between the VM and its host, not your network. It is off by default and limited by allow-lists and time.
Is the Firecradle roaming tunnel available?
Yes. The agent connects with WireGuard to your firewall after a posture check, using 5-minute grants brokered by the cloud, which holds no private keys.
Is this the same as Takelan Tunnels?
No. Takelan Tunnels (Omnigate) is a separate product for putting your own apps on a public URL. It is not part of how the Cradle products connect.
Need the same idea for your own apps? Takelan Tunnels is a separate product.
The connections above are built into the Cradle products. To put your own web, TCP or UDP services on a public URL, look at Takelan Tunnels (Omnigate), a separate product, in the platform cards above.