Protected · post-quantum encrypted · every device · post-quantum

Every device in the firm,
checked before it connects.

Walltunnel stands between your Macs and iPhones and the internet. Every link, every download, every connection is checked against the world's largest threat map before it reaches the device. If it's dangerous, it never loads.

Get WalltunnelSee it stop a phishing link
For firms of 5 to 50 · Installed in a minute · Nothing for staff to learn
Built on the network that sits in front of roughly a fifth of all websites.
330+cities, checks happen nearby
~1 minto install on a Mac
ML-KEMpost-quantum tunnel
0settings for staff
How it works

One tunnel. Three checks. Then the internet.

Every connection leaves the device through a post-quantum tunnel to the nearest Cloudflare data center. It is checked there, in milliseconds, before it goes anywhere.

One click, four seconds

Here is the click that would have cost the firm.

A paralegal gets an email: "Signed retainer attached." It looks exactly like the real thing. This is what happens next.

9:41

The link is clicked.

Safari asks for docusign-review-secure.com. Without Walltunnel, the fake sign-in loads.

+3 ms

The name is checked.

Before Safari even learns the address, the lookup is matched: phishing, registered 48 hours ago.

+12 ms

The page never loads.

A plain page with the firm's name explains what happened. No password typed, no file downloaded.

+4 s

The right person knows.

The block is logged with the device and the time, and a named person at the firm is told.

What it stops

On from day one. The same rules on every device.

Refused before they load

The attacks small firms actually get.

Matched against Cloudflare's threat intelligence, which sees new attack domains within minutes of their first use anywhere.

  • Phishing and fake sign-in pages
  • Malware and spyware hosts
  • Scams and fake invoices
  • Botnet command servers
  • Brand-new and parked domains
  • Lookalikes of your own login
  • Cryptomining
  • Apps that hide their own DNS
Files

Downloads scanned in flight.

Every file is checked for malware before the last byte lands. Installers and scripts from untrusted sites don't arrive at all.

Encryption

Traffic recorded today stays private tomorrow.

Every tunnel uses post-quantum key agreement with no fallback. Case files keep their value for decades; so should their protection.

tunnel MASQUE · HTTP/3
key ML-KEM-768 + P-256 (hybrid)
cipher AES-256-GCM
fallback none
Phones included

The iPhone with the firm's email on it.

Staff read client mail on personal phones. Antivirus never reached those. Walltunnel applies the same rules there.

Every five minutes

Each laptop proves it's healthy.

A Mac that slips can be kept out of the case system until it's fixed.

Disk encrypted (FileVault)Passing
Firewall onPassing
macOS currentPassing
Stays on

It can't be switched off by accident.

The switch is locked for staff. If the connection drops, it comes back on its own within a minute. A device can't leave the firm's protection without an administrator.

Compare

More than DNS filtering.

DNS filtering checks the name of a site and nothing else. A VPN encrypts the pipe and checks nothing. Walltunnel checks every connection three times.

1

The name

Before the device learns where a site lives, the name is matched against threat intelligence. This is all DNS filtering does.

2

The connection

Apps that carry their own DNS or connect around the rules are refused at the network. DNS filters never see them.

3

The content

The exact page and every file are inspected. A phishing page hosted on a trusted file-sharing site, or malware inside a real download, is stopped here.

Tailscale and WireGuard connect your devices to each other. Walltunnel checks what they connect to. A firm can use both.

Walltunnel compared with antivirus, DNS filtering, a WireGuard VPN, and Tailscale
AntivirusDNS filteringWireGuard VPNTailscaleWalltunnel
Refuses phishing and malware sites before they loadsometimesby name onlyNoadd-on, by nameYes
Checks the full address, not just the domainsometimesNoNoNoYes
Scans downloads before they reach the diskafterNoNoNoYes
Blocks installers and scripts from untrusted sitesvariesNoNoNoYes
Can't be dodged by an app with its own DNSNoeasily dodgedNoNoYes
Encrypts traffic on hotel and café Wi‑FiNolookups onlyYeswith exit nodeYes
Post-quantum encryption, no fallbackNoNoextra key, by handnot by defaultYes
Covers staff iPhonesNoYesif switched onif switched onYes
Staff can't switch it offvariesvariesNoNoYes
One set of rules for every devicevariesYesNoaccess rulesYes
Reaches office machines from anywhereNoNoset up by handYeslater
Straight answers

What it isn't.

You should know where the edges are before you buy.

Not antivirus.

It watches the network, not the disk. A file on a USB stick is invisible to it. Pair it with endpoint protection.

Not reading your work.

It sees where connections go and whether files are dangerous. It doesn't keep page contents or keystrokes.

Not hiding you.

It encrypts traffic on hotel Wi‑Fi, but its job is to check connections, not to make you anonymous.

Not for 500 people.

It's built for offices of five to fifty without an IT team. Larger firms need a security team.

Pricing

One price. Per person, not per device.

$15 / person / month
  • Every Mac, iPhone and iPad each person uses
  • Setup, enrollment and the firm's rules, done for you
  • Post-quantum encrypted tunnels
  • Alerts to a named person when something is caught
  • A person to call, not a ticket queue
Get Walltunnel
Monthly. Cancel any time. A lawyer with a laptop, a phone and an iPad is one person.
Already on AAi

Firms running AAi case software get Walltunnel set up alongside their next release, by the same people who already run their system.

One vendor, one invoice, one number to call when something looks wrong.

Questions

Will it slow anything down?

No. The tunnel ends at the nearest Cloudflare data center, usually a few milliseconds away, and the checks happen there. Most sites load as fast or faster.

What does staff see when something is blocked?

A plain page with the firm's name, "Blocked for your protection", and the reason in one sentence, with a button to email support if they think it's wrong. Nothing was downloaded.

Does it work with our bank, Zoom and Apple services?

Yes. Apps that refuse to be inspected are recognised from a list Cloudflare maintains and are passed through, while still being checked by name. We never use broad exceptions; each is an exact host.

Can staff turn it off?

Not on their own. The switch is locked, it reconnects by itself, and a device can't leave the firm's protection without an administrator. On iPhones this depends on how the phone is managed, and we'll tell you exactly what applies.

Who is Cloudflare in this?

Cloudflare runs the network and the threat intelligence. Walltunnel is the rules, the enrollment, the alerts, and the people you call. The app says "Powered by Cloudflare" because it's true.

What do you keep?

Log lines: time, device, destination, which rule matched. Not page contents, not files, not keystrokes. The logs live in the firm's own account.

Close the door before
someone walks through it.

Tell us the firm and roughly how many people. Setup takes an afternoon, and most of it is us.

Get WalltunnelAsk a question