One network. Global. Secure.

The underlay is the physical transport: internet, dedicated lines, 5G or MPLS from whichever carriers serve each site. The overlay is the encrypted, app-aware SD-WAN fabric that runs across it. Most vendors sell you the overlay and leave the underlay to you, which is where the finger-pointing starts. We source and operate both, under one SLA, so there is one team to call when a line in one country misbehaves.

No. Last-mile sourcing is carrier-agnostic: we can take over your existing circuits or source new ones, and a site can bundle several transports at once. Being independent of the physical line is the point of SD-WAN, and it is also what makes a staged migration possible instead of a rip-and-replace.

For long-haul and for regions where the public internet is unpredictable, measurably yes. 500+ points of presence across 121 backbone locations in 32 countries mean traffic enters a managed path close to the site instead of taking whatever route the internet offers that morning, and availability and traffic quality are covered by end-to-end SLAs from site to PoP to PoP.

With in-country connectivity built for exactly that case, which is why China gets its own line in the numbers above. Reliable, compliant access from mainland sites to global applications is a recurring reason customers move to the backbone; the China solution page sets out what is involved.

You do, at the level of app, site and connection. Bandwidth control and path selection enforce those decisions per policy, and application optimization handles the links that are simply slow, with caching, compression and protocol tuning. What we bring is the operational read on what your traffic actually does, because we run the whole path.

Yes. Encryption and authentication for site-to-site traffic are automatic rather than a project: keys and tunnels are managed by the platform, not maintained by hand in a rulebase. That is deliberate, because the encryption people skip is the encryption that was inconvenient to set up.

A SASE edge appliance is the usual deployment, in four sizes plus a server option with RMA included, and it is priced per appliance and month under Foundation on the pricing page. Small and cloud-only locations can be reached without one, and mobile and roaming users come in through the Mobile Entry Point instead.

Because we operate the whole path, every packet is telemetry. Thirty-five years of running networks feeds AI that predicts congestion and reroutes around trouble before users notice, and hands anything consequential to a Level-3 engineer. The network stops being a thing you watch and becomes a thing that reports to you.