Nothing on your side listens.

The trust boundary, stated plainly: what is exposed, how a node is admitted, where the data sits, and what ControlIT does not claim to do.

Written for the engineer who has to sign off on it, not for a brochure.

Book an architecture reviewPlan a pilot

One outbound path, every product.

Endpoint management, remote connectivity, identity and support all start with a connection from your side. Whichever of the five products you run, none of them asks you to open an inbound port.

Connect, Control, Extend.

One path for every kind of traffic. With Secure Access & AD Anywhere, private traffic reaches your applications and the Active Directory you run over one private network. With Web Gateway, internet traffic leaves through the gateway, where policy decides.

What is exposed to the internet

Nothing on your side. Endpoints and site nodes establish outbound connections only.

No inbound firewall rule, no port forward, no published service, no public IP requirement.
Domain Controllers are never published, never placed in a DMZ, and never reachable from the internet.
There is no concentrator on a public address to attack, because there is no concentrator.

Every connection starts on your side.

How a node is admitted

Every node proves its own identity before it is allowed to carry traffic.

Traffic between nodes is encrypted peer-to-peer, with NAT traversal, so the common path needs no relay.
Access is granted to named services for named identities, not by dropping a session onto a subnet.
Removing a node revokes it centrally.
No credential left on a laptop keeps working.

Internet decided by who is asking.

With Web Gateway, every request is matched to a user and a group before it leaves. The same rules apply at head office, at a branch and on a laptop at home, by group and by time of day.

Illustrative ControlIT Web Gateway policy: four groups, Finance, Remote Staff, Vendors and IT Administrators, against five kinds of internet destination, each marked allowed, blocked or allowed outside working hours.
Group	Business SaaS	Banking	Social Media	Streaming	Known Malicious
	Internet, through Web Gateway
Finance	Allowed	Allowed	Outside working hours	Blocked	Blocked
Remote Staff	Allowed	Blocked	Outside working hours	Outside working hours	Blocked
Vendors	Allowed	Blocked	Blocked	Blocked	Blocked
IT Administrators	Allowed	Blocked	Outside working hours	Blocked	Blocked

Where the data sits

The directory stays yours. The control plane runs wherever you want it: hosted by Computer Port, or on infrastructure you nominate, as part of the deployment we configure with you.

Directory objects, password hashes, endpoint telemetry and audit logs stay inside your estate.
There is no vendor-cloud copy of your directory, because there is no directory synchronisation.
Access events, admin actions and session records are written where your auditors can reach them.

What it does not claim to do

The honest limits, because you will find them anyway during a pilot.

It is not a firewall and it is not endpoint protection. It changes who can reach what, not what a compromised endpoint can then do.
A user with a stolen password and a stolen second factor is still that user. Identity hygiene stays your job.
A branch with no local Domain Controller loses remote directory resources when its link drops, exactly as it would behind a site-to-site VPN.
It does not replace your backup platform, and it does not change your Microsoft 365 licensing.

The questions engineering asks.

Architecture questions about the ControlIT overlay, Active Directory, identity and audit, with answers
Number	Question	Answer
01	Kerberos and LDAP Over the Overlay	Kerberos, LDAP and SMB travel from the client to your Domain Controller inside the encrypted overlay, as if both were on the same LAN. Nothing is published and nothing goes to a cloud identity provider.
02	Site Replication	ControlIT doesn't replace AD Sites and Services. It replaces the VPN that carried replication. Keep your hub-and-spoke or mesh design; you still own schedules, costs and site links.
03	Offline Domain Controller	The overlay is a path, not the source of identity. A Domain Controller on the local LAN still authenticates when the WAN is down, and cached credentials behave as they do at any AD site.
04	RODC at the Branch	Standard AD patterns still apply, for example a read-only DC in the plant and a writable DC at head office. Replication and logon ride the overlay, and neither DC needs a public IP or inbound port.
05	When the Internet Drops	Local users keep local AD, local shares and cached logon. Remote access over the overlay waits for the path to return. It has the same failure domain as a WAN today, without a concentrator to fail first.
06	Isolated Networks	With the on-prem option, the control plane, overlay and agents run on your own infrastructure, so they can sit inside networks you isolate. Talk to us about your specific air-gap requirements.
07	Who Holds the Keys	You do. On-prem, the control plane runs on your own infrastructure and device identity and overlay trust stay there. However you run it, the directory is never synced to a vendor.
08	CERT-In Logging	Access events, admin actions, sessions and configuration changes are logged on your side, with retention you control and CERT-In-aligned reporting.
09	Web Filtering for Remote Users	Policy follows the laptop through the Web Gateway over the overlay, so a remote user at home is filtered by the same URL, category and group policy as a desk in the office, not by a separate, looser rule for off-network traffic.
10	HTTPS Inspection	HTTPS inspection is optional and configured per customer, not switched on by default. Turning it on is a certificate-management decision as much as a security one, and we discuss the privacy and compliance trade-offs with you before it is enabled anywhere.
11	Vendor Access Without a VPN	A zero-trust use of ControlIT Secure Access & AD Anywhere. Every connection is decided by user, device and group, so a vendor reaches only what policy allows, not the whole network it happens to sit on. Nothing is published to the internet, and access can be removed the day the engagement ends.
12	Remote Domain Join of a New Laptop	A new Windows laptop joins the domain over the internet, without a trip to the office. The overlay comes up as a machine-level service, so the domain controller is reachable before anyone has signed in, and Group Policy applies from the first logon.
13	Is ControlIT SaaS or On-Prem	Either, for every product. Computer Port can host it as SaaS, or it can run on infrastructure you nominate. It is the same product either way, and Computer Port configures it around your sites, users and rules.
14	Core or 24x7 ITOps	ControlIT Core is the RMM on its own. ControlIT 24x7 ITOps is Core's RMM plus the zero-trust private network over the internet, operated 24x7 by Computer Port as SaaS or by your team on-prem. Pick Core to run endpoints yourself, and 24x7 ITOps when you want the round-the-clock operation as well.
13	LDAP, DNS and time sync	Ordinary traffic on a reachable path. DNS matters most: the client has to resolve your internal domain and its SRV records rather than a public resolver, so DNS is part of every deployment conversation. Time skew is the other classic Kerberos failure, so domain-joined machines keep syncing against your domain time source.
14	Peer-to-peer, or a hairpin through a relay	The design is peer-to-peer with NAT traversal, so the common case is a direct path between two nodes rather than a round trip through head office. Where a particular NAT combination prevents a direct path, connectivity is maintained rather than dropped. Which case your topology falls into is part of the overlay design step.
15	How this differs from a plain overlay network	Other overlay networks exist, and if an overlay is all you need they are reasonable tools. ControlIT is an overlay plus the directory work that keeps on-premises Active Directory usable across it, plus single sign-on and enforced MFA, plus endpoint operations, on one console with Indian engineering support behind it.
16	What you need to provide	Somewhere to run the control plane, outbound internet access from the endpoints, an Active Directory administrator for a few hours, and a decision on which site goes first. No inbound firewall rules, no schema changes, no new forest or domain, and no trust relationships.

01Kerberos and LDAP Over the Overlay

Kerberos, LDAP and SMB travel from the client to your Domain Controller inside the encrypted overlay, as if both were on the same LAN. Nothing is published and nothing goes to a cloud identity provider.

02Site Replication

ControlIT doesn't replace AD Sites and Services. It replaces the VPN that carried replication. Keep your hub-and-spoke or mesh design; you still own schedules, costs and site links.

03Offline Domain Controller

The overlay is a path, not the source of identity. A Domain Controller on the local LAN still authenticates when the WAN is down, and cached credentials behave as they do at any AD site.

04RODC at the Branch

Standard AD patterns still apply, for example a read-only DC in the plant and a writable DC at head office. Replication and logon ride the overlay, and neither DC needs a public IP or inbound port.

05When the Internet Drops

Local users keep local AD, local shares and cached logon. Remote access over the overlay waits for the path to return. It has the same failure domain as a WAN today, without a concentrator to fail first.

06Isolated Networks

With the on-prem option, the control plane, overlay and agents run on your own infrastructure, so they can sit inside networks you isolate. Talk to us about your specific air-gap requirements.

07Who Holds the Keys

You do. On-prem, the control plane runs on your own infrastructure and device identity and overlay trust stay there. However you run it, the directory is never synced to a vendor.

08CERT-In Logging

Access events, admin actions, sessions and configuration changes are logged on your side, with retention you control and CERT-In-aligned reporting.

09Web Filtering for Remote Users

Policy follows the laptop through the Web Gateway over the overlay, so a remote user at home is filtered by the same URL, category and group policy as a desk in the office, not by a separate, looser rule for off-network traffic.

10HTTPS Inspection

HTTPS inspection is optional and configured per customer, not switched on by default. Turning it on is a certificate-management decision as much as a security one, and we discuss the privacy and compliance trade-offs with you before it is enabled anywhere.

11Vendor Access Without a VPN

A zero-trust use of ControlIT Secure Access & AD Anywhere. Every connection is decided by user, device and group, so a vendor reaches only what policy allows, not the whole network it happens to sit on. Nothing is published to the internet, and access can be removed the day the engagement ends.

12Remote Domain Join of a New Laptop

A new Windows laptop joins the domain over the internet, without a trip to the office. The overlay comes up as a machine-level service, so the domain controller is reachable before anyone has signed in, and Group Policy applies from the first logon.

13Is ControlIT SaaS or On-Prem

Either, for every product. Computer Port can host it as SaaS, or it can run on infrastructure you nominate. It is the same product either way, and Computer Port configures it around your sites, users and rules.

14Core or 24x7 ITOps

ControlIT Core is the RMM on its own. ControlIT 24x7 ITOps is Core's RMM plus the zero-trust private network over the internet, operated 24x7 by Computer Port as SaaS or by your team on-prem. Pick Core to run endpoints yourself, and 24x7 ITOps when you want the round-the-clock operation as well.

13LDAP, DNS and time sync

Ordinary traffic on a reachable path. DNS matters most: the client has to resolve your internal domain and its SRV records rather than a public resolver, so DNS is part of every deployment conversation. Time skew is the other classic Kerberos failure, so domain-joined machines keep syncing against your domain time source.

14Peer-to-peer, or a hairpin through a relay

The design is peer-to-peer with NAT traversal, so the common case is a direct path between two nodes rather than a round trip through head office. Where a particular NAT combination prevents a direct path, connectivity is maintained rather than dropped. Which case your topology falls into is part of the overlay design step.

15How this differs from a plain overlay network

Other overlay networks exist, and if an overlay is all you need they are reasonable tools. ControlIT is an overlay plus the directory work that keeps on-premises Active Directory usable across it, plus single sign-on and enforced MFA, plus endpoint operations, on one console with Indian engineering support behind it.

16What you need to provide

Somewhere to run the control plane, outbound internet access from the endpoints, an Active Directory administrator for a few hours, and a decision on which site goes first. No inbound firewall rules, no schema changes, no new forest or domain, and no trust relationships.