The internal tool that never touched the corporate network

Publishing an internal app has meant choosing between two discomforts: open an inbound hole in the corporate firewall, or run a connector inside the network that dials out to somebody's edge and lets their infrastructure front yours.

There is a third shape: the app doesn't live on the corporate network at all. It runs in a container on metal you rent. Employees reach it at its URL, gated by proxy permission groups: an IP range, passwords, identity claims: validated on your rented server, where TLS also terminates. The office firewall keeps zero inbound rules and hosts zero appliances. The corporate network holds nothing to reach.

No hole in the firewall, because there's nothing behind the firewall to reach.