VaultysHub + ZTNA: the double security barrier

The context

Claire is the CISO at BioLab, a laboratory with 90 employees spread across three sites and remote work. The company hosts critical internal applications — LIMS (laboratory management), ERP, regulatory document database — on its own servers. Claire wants to secure access to these applications without exposing the internal network to the Internet and without imposing a traditional VPN on her teams.

The problem without VaultysHub + ZTNA

With a traditional VPN:

• Once connected to the VPN, the user accesses everything on the internal network (the "castle" model)
• If a workstation is compromised, the attacker has access to the entire network
• The VPN is heavy to maintain, slow, and degrades the user experience
• No granularity: impossible to give access to a single application
• VPN credentials are an additional attack vector to manage

With ZTNA alone (Tailscale/Headscale):

• The network is segmented, but authentication to applications remains traditional (login/password)
• Passwords for internal applications remain a weak link
• No visibility on who accesses what at the application level
• No centralized management of access to applications

The solution: VaultysHub + Tailscale/Headscale

By combining VaultysHub with a Zero Trust network (Tailscale or its open-source alternative Headscale), we obtain two complementary layers of security:

Layer 1 — VaultysHub: controls who can access and under what conditions (identity, device, location)

Layer 2 — ZTNA: controls which machines the user can connect to on the network (micro-segmentation)

With VaultysHub + ZTNA

Step 1 — Deploy the Zero Trust network

Claire installs Headscale (self-hosted to maintain data sovereignty) or activates Tailscale (Business plan). Each server hosting an internal application joins the Zero Trust network.

Step 2 — Connect VaultysHub as an identity provider

Claire configures VaultysHub as an OpenID Connect (OIDC) provider for Tailscale/Headscale. From now on, to join the Zero Trust network, an employee must authenticate via VaultysHub and their VaultysID.

Step 3 — Define ACLs by group

Claire defines network access rules based on VaultysHub groups:

• The "Laboratory" group accesses only the LIMS and the document database
• The "Finance" group accesses only the ERP
• The "Management" group accesses all applications
• No one accesses a server they are not explicitly authorized to

Step 4 — Add VaultysHub policies

Claire strengthens with VaultysHub's Device Access Policies:

• Access to the LIMS requires a biometric VaultysID and a device on the company network or ZTNA
• Access to the ERP requires an up-to-date browser and a supported operating system

Step 5 — The daily user experience

Paul, a researcher working remotely, opens his browser:

1. He authenticates on VaultysHub with his VaultysID (QR scan + fingerprint)
2. The Tailscale/Headscale client automatically authenticates via VaultysHub SSO
3. Paul clicks on the LIMS in his VaultysHub dashboard
4. VaultysHub automatically connects him to the application via the encrypted tunnel

Everything is seamless. Paul did not enter any passwords or manually launch any VPN.

The Zero Trust architecture in detail

What does it protect?

Threat	Traditional VPN	ZTNA alone	VaultysHub + ZTNA
Credential theft	Total network access	Limited network access, but applications exposed	Cryptographic identity (VaultysID) + segmented network
Compromised workstation	Entire network exposed	Exposed network segment	Device policy blocks non-compliant workstations
Lateral movement	Free on the entire network	Micro-segmentation	Micro-segmentation + application control
Application password theft	Access to the application	Access to the application	No known password (vault)
Access after departure	Slow revocation	Network revocation only	Network AND application revocation in 1 click
Compliance audit	Dispersed logs	Network logs only	Centralized logging + ISO 27001 reports in one click

The Zero Trust principle applied

"Never trust, always verify"

1. Verify identity → VaultysID (passwordless cryptographic authentication)
2. Verify device → VaultysHub Device Access Policy (OS, browser, IP)
3. Least privilege access → Tailscale/Headscale ACL (only necessary servers)
4. Controlled application access → VaultysHub SSO (only authorized applications)
5. End-to-end encryption → WireGuard tunnel Tailscale/Headscale
6. Continuous monitoring → VaultysHub logging (Audit Trail) + combined ZTNA logs
7. Compliance reports → CISO, CTO, and ISO 27001 reports generated in one click

Tailscale or Headscale?

Criteria	Tailscale	Headscale
Hosting	Cloud (Tailscale Inc.)	Self-hosted
Data sovereignty	Data with Tailscale	100% under your control
Ease of implementation	Very simple	Requires administrative skills
Cost	Paid (Business plan required for SSO)	Free and open source
Support	Commercial support	Community
VaultysHub integration	OIDC SSO + WebFinger	OIDC SSO

Both options are fully compatible with VaultysHub via OpenID Connect.

What it changes

Without this combination	With VaultysHub + ZTNA
VPN = total network access	Micro-segmentation by user and by application
VPN credentials + application passwords	VaultysID single sign-on
Internal applications exposed on the Internet	Applications invisible from the Internet
Slow and incomplete revocation	Instantaneous network + application revocation
Dispersed and incomplete logs	Centralized logging + compliance reports
Perimeter security (castle)	Zero Trust security (continuous verification)

Features used

• SSO OpenID Connect — VaultysHub as an identity provider
• Tailscale Integration — Tailscale SSO configuration guide
• Headscale Integration — Headscale SSO configuration guide
• Access Policies (DAP) — Device control and access conditions
• Folder Management — Organizing access by group
• VaultysID — Passwordless cryptographic identity
• Logging — Real-time logging of network and application connections
• Reports — CISO, CTO, and ISO 27001 reports for audits