Open-source Secure Service Edge · ZTNA
There is no inside to be inside of.
Ransomware does not succeed at the moment of intrusion. It succeeds in the hours afterwards, moving sideways from the first machine to the ones that matter. Lantern DSSE makes that movement hard.
The decryption point is yours
TLS is terminated on hardware you own, in the jurisdiction you chose, with no hyperscaler in the path and nothing of ours in it.
The code that decrypts is published
Interception, policy evaluation, default-deny, device admission — Apache-2.0. The part you would otherwise take on trust.
Same-LAN traffic is mediated
Including the machine next to yours on the local segment — the path lateral movement actually uses, and the one most products leave alone.
What it does
Every flow from a managed endpoint is decided against policy, audited, and re-authenticated where the policy says it must be. A compromised laptop does not come with a flat network behind it. The attacker's next move is a request that gets denied and logged, rather than a connection that just works.
It is not a claim that breaches stop. It is a claim about one stage of them: lateral movement, which is the stage where an incident becomes a company-wide event. In category terms, this is a Secure Service Edge — zero-trust network access, a secure web gateway, and DNS control — enforced at edges the operator runs rather than at a vendor's decryption point in someone else's cloud.
The code that decrypts your traffic is open source
A Secure Service Edge is the one place where an organisation's encryption is, by design, undone. Today that point is mostly operated as foreign software-as-a-service: your decryption point lives in someone else's cloud, under someone else's jurisdiction.
The enforcement path here is published under Apache-2.0 — TLS interception, policy evaluation, default-deny, DNS control, mTLS device identity, east-west authorisation. Not a client library, not an integration: the part you would otherwise have to take on trust.
Don't trust us; read the code that touches your bytes. The Experimental release opens on 2026-09-01 at github.com/lantern-networks/dsse-core. How to check the claims on this site.
The decryption point can be yours
The Edge is where your traffic is decrypted. That is not a figure of speech — TLS is terminated there, in the clear, deliberately, because inspection and policy cannot happen otherwise. Every other question about an SSE is downstream of one thing: where that point sits, and who operates it.
It can sit on hardware you own, in a rack you control, in the jurisdiction you chose, with no hyperscaler in the path and nothing of ours in it either. The certificate authorities are generated on your machine at install time rather than handed to you. There is no licence server: a deployment that cannot reach us keeps working, because anything else would make "sovereignty" a word rather than a property. What that means for data residency.
Run it in a public cloud if that suits you — many operators will, and nothing here argues against it. The point is that it becomes a decision you make rather than one the product already made for you by having nowhere else to run.
Where this actually is
Experimental
This is an experimental release, and it is not production-ready. Interfaces and defaults may still change, and nothing here has been run at length by anyone who did not write it. Run it in a lab, not in front of a fleet you would mind losing. We would rather say that now than have you discover it during an evaluation.