Zen Mesh — Secure webhook delivery for public and private networks
Zen Mesh is building a security-first webhook delivery platform for developer, platform, and security teams. It delivers provider events to public HTTP endpoints or to services behind NAT, firewalls, VPNs, and private Kubernetes networking through outbound-only connectivity.
The business plan opens in a new tab as a downloadable PDF. The page and the PDF are publicly accessible; no account or authentication is required.
Current stage
Technical validation and launch preparation. Core enrollment and Fabric identity paths have been validated in sandbox environments; product packaging and production acceptance are still being completed.
Sandbox validation is not production readiness. Cloud-gated and production-acceptance work is still in progress.
AWS direction
Planned regional deployment using Amazon EKS, EC2, Route 53, Elastic Load Balancing, ECR, KMS, Secrets Manager, S3, CloudWatch, and OpenTelemetry, with explicit regional and data-residency controls.
- Amazon EKS — managed Kubernetes for the control and data planes
- Amazon EC2 — workload hosts for regional edge delivery
- Route 53 — regional DNS and health-checked routing
- Elastic Load Balancing — regional ingress and TLS termination
- Amazon ECR — signed container images
- AWS KMS — regional key management for secrets at rest
- AWS Secrets Manager — operator and workload credentials
- Amazon S3 — durable artifact and evidence storage
- CloudWatch — logs, metrics, and operational alarms
- OpenTelemetry — traces exported to regional backends
Regional deployment is planned, not yet live. This list describes intended building blocks, not a deployed or certified production environment.
How we build
The commitments below guide the architecture. They describe design intent and validated properties, not general production readiness.
- Security-first
- Default-deny data plane, signed payloads, and least-privilege operator access are foundational, not add-ons.
- Private-by-design
- Private targets receive events without opening inbound ports on the customer network.
- Outbound-only
- Connectivity from customer environments is outbound-only; no inbound listener is required on the private side.
- Verified delivery
- Each delivery produces a structured record so teams can reconcile what happened, not just that something was sent.
- Evidence-backed operations
- Operational claims are tied to machine-readable artifacts with explicit scope, not marketing assertions.
What this is — and is not
- Validated in sandbox environments for the paths described above.
- Security-first, private-by-design, outbound-only by architecture.
- Not a claim of general production readiness, compliance certification, guaranteed delivery, zero risk, or prevention of all attacks.
- No customer-specific, revenue, traction, or partnership figures are represented.
Review the pack
Program reviewers: this page is an application-support surface and is intentionally kept out of primary site navigation.