Skip to content

Corporate VPN for iOS, Android, macOS, Windows and Linux

For your team.
Only your team.

Employees scan one invite. The app takes on your organization’s name, logo and colour, opens your internal systems, and stays connected on hotel Wi-Fi, mobile data and restrictive networks.

Book a demoSee how it works

Built on Xray-core · Works with your identity provider · Self-hosted or managed

Before an inviteThe same app for everyone, in graphite
After joining Parom LogisticsIts logo, colour and systems

Four promises

  • Connects anywhere

    Several routes per location and entry points inside the country. When a network drops one route, the app moves to the next.

  • Looks like your company

    Your name, logo, colour and systems, applied the moment someone joins.

  • Lets in only your team

    Invites, your sign-in, keys for each device and offboarding in one click.

  • Runs on your terms

    On your servers or ours, with fixed exit addresses and an API for everything.

How it works

From invite to connected in four steps

IT sends an invite as a QR code or a link. Nobody copies config files or keys, and the app checks who sent the invite before it adds anything.

  1. Scan the invite

    The QR code comes in the invite email, scans from a laptop screen too, and opens the app.

  2. Check who sent it

    The organization, its server and what its IT team can see, before anything is added.

  3. Sign in

    With a work account or an email code. From here on, the app wears your brand.

  4. Allow the VPN

    One iOS permission, explained in plain words before iOS asks.

Runtime branding

One app in the store, your organization inside it

There’s no app to build or publish for each customer. When a person joins, the app loads your theme and workspace and keeps a copy, so it stays branded offline too.

  • Name, logo and welcome text

    Logos for light and dark mode, and a short welcome in English and Russian.

  • Resources and announcements

    Your portal, internal systems and SaaS links on Home, and messages for everyone or for one group.

  • A brand colour that stays readable

    The contrast guard adjusts it for text and buttons in light and dark mode, and the console shows each adjustment.

  • Security screens that never change

    Connection state, the address bar and the organization check look the same everywhere, so no configuration can imitate them.

Parom Logistics theme

Brand colour #6E56FF

  • ButtonsWhite label · 4.7:1
  • Text and links#684EF6 · 4.8:1 on the background
  • TintsAnnouncements and monograms
  • Background#F5F3FF · secondary text 6.0:1

The contrast guard derived the first three from one colour and checked the background against every text colour.

Mayak Clinics theme

Brand colour #E8590C

  • ButtonsDarkened to #CD4C00 for a white label · 4.5:1
  • Text and links#BC4500 · 4.9:1 on the background
  • TintsAnnouncements and monograms
  • Background#FFF4EF · secondary text 6.1:1

The contrast guard derived the first three from one colour and checked the background against every text colour.

Kolos Agro theme

Brand colour #F5C400

  • ButtonsBlack label · 12.8:1
  • Text and links#846900 · 4.9:1 on the background
  • TintsAnnouncements and monograms
  • Background#FBF7EB · secondary text 6.1:1

The contrast guard derived the first three from one colour and checked the background against every text colour.

Bereg Hotels theme

Brand colour #D6336C

  • ButtonsWhite label · 4.6:1
  • Text and links#CB2563 · 4.9:1 on the background
  • TintsAnnouncements and monograms
  • Background#FFF3F5 · secondary text 6.0:1

The contrast guard derived the first three from one colour and checked the background against every text colour.

4 examples

Every day

Connect, then get straight to work

Home shows the connection and the systems people use most. You decide what goes through the VPN, so other apps keep working as usual.

  • A switch that tells the truth

    Every state has a word, a reason and a next step. “Connected” appears only after a real check.

  • Your systems in one list

    Grouped the way IT set them up. People see only what they’re allowed to open.

  • Internal sites in a secure browser

    The address bar shows the real domain and that the page came through the VPN.

  • Access and help in one place

    Access dates, devices and routes, one-tap diagnostics and a direct line to IT.

For IT

One console for people, devices and routes

Invite people, decide what goes through the VPN and see every change in the audit log. Everything in the console is in the API too.

  • Your identity provider

    Sign-in through Entra ID, Okta, Google Workspace, Keycloak, Authentik, JumpCloud, Yandex 360 or any OIDC provider. Local accounts for contractors.

  • People and devices

    Invites by email, link or QR code, access end dates and device limits. Offboarding revokes every device and drops live connections at once.

  • Routes you decide

    Company resources only, everything except domestic sites, or all traffic. Split DNS for internal zones, and a tester that shows where an address goes.

  • Fixed exit addresses

    Dedicated exit IPs for a team, for SaaS vendors, partners and banks that allow access by IP address.

  • Roles and audit log

    Owner, Admin, Network admin, Helpdesk and Auditor roles, or your own. Every change is logged with who made it, when and what changed.

  • Workspace builder

    Logo, colour, welcome text, resources and announcements, with a live preview of the app before you publish.

  • Monitoring and alerts

    Traffic, live sessions and server health, with Prometheus metrics and Grafana dashboards. Alerts go to Telegram, email or a webhook.

  • Helpdesk tools

    A helpdesk role with no access to keys, a connection doctor for any user, and diagnostics that arrive with an ID.

  • An API for everything

    A complete REST API with an OpenAPI spec, and SDKs for TypeScript, Python and Go.

The connection

A connection that holds on any network

The data plane is Xray-core: VLESS with REALITY on port 443, and XHTTP through a CDN. When a network drops the usual route, the app moves to the next one and says so.

  • Several routes per location

    Each location offers more than one protocol, and the apps fall back on their own.

  • Entry points inside the country

    Connections enter through servers in the country and exit abroad, which keeps them steady when cross-border traffic slows down.

  • Problems found before people notice

    Probes on real mobile and home networks spot a failing route. The platform moves it to a new address and updates every app.

  • Keeps working if the console is down

    Servers keep their last configuration, and apps keep a cached copy.

What people see when a network drops the route in use. Connection state never takes a brand colour.

Security by default

  • A closed circle of users

    People join only by invite and through your sign-in, with no public sign-up. That’s the closed user base Russia’s corporate-VPN exemption describes (149-FZ, art. 15.8).

  • Keys for each device

    Each device has its own credentials, kept in the Keychain or Keystore, so you can revoke one without touching the rest.

  • No leaks

    DNS goes through the tunnel, IPv6 is tunnelled or blocked, and the kill switch keeps traffic in when the connection drops.

Deployment

Your servers or ours

Both editions use the same apps, console and data plane. You choose where they run.

Self-hosted

The console, the database and the VPN servers run on your infrastructure, so user data stays in your country.

  • Docker Compose for small installs, Kubernetes and Helm for large ones
  • Servers join with one command and a one-time token
  • Apps find your server from the invite
  • Upgrades without downtime

Managed

We run the VPN servers and keep routes healthy. Your IT team manages people, routes and branding in the console.

  • Shared servers, or dedicated ones for your organization
  • Several hosting providers in every region
  • Routes checked from real mobile and home networks
  • Failing addresses replaced automatically

FAQ

Questions IT teams ask

Do we need our own app in the App Store?
No. Everyone installs the same app, and it takes on your name, logo and colour when a person joins. The home-screen icon stays the product’s own: iOS and Android don’t let apps change it at runtime.
Can everything stay on our own servers?
Yes. In the self-hosted edition the console, the database and the VPN servers all run on your infrastructure.
What happens when someone leaves?
Offboard them in one click. Their devices, credentials and sessions are revoked, and live connections drop at once.
Does all traffic go through the VPN?
Only if you want it to. For each group, choose company resources only, everything except domestic sites, or all traffic.
What if we don’t have an identity provider?
People sign in with a one-time email code, and contractors can have local accounts.
Can people use Xray apps they already have?
If you allow it. Happ, v2RayTun, Hiddify, Streisand and other Xray apps connect through standard subscription links. Or keep configurations inside the vpn4.team app only.

See the app with your logo

Send us your logo and brand colour, and we’ll show you the app the way your employees will see it.

Book a demo

or write to [email protected]