Key concepts

This page defines the vocabulary used throughout the how-to guides. Read it once and the rest of the documentation will move faster.

Provider and customer

Customer Connect has two kinds of organization:

• A provider operates the platform and serves many customers.
• A customer is one organization the provider serves.

The provider can see and configure every customer's resources. A Customer Admin sees only one customer's — but is still provider staff, scoped to that account rather than employed by it. Provider admins can use the View as customer preview to see the console exactly as a Customer Admin would. The one role held by someone outside the provider is Member, an employee of the end customer who uses the access granted to them; see Roles and grants.

Locations

A location is a site where connector software runs. A location has a name, an address, and a type: Physical Site or Virtual / Cloud. Latitude and longitude are derived from the address to place the location on the network map used in monitoring.

Locations are owned by either the provider (shared infrastructure) or a specific customer.

Connectors

A connector is the software deployed at a location that carries traffic onto the zero trust network. Every connector has a type that determines how it reaches the applications behind it:

Type	Color	Description
Device	Blue	Runs on a device to expose local services.
Gateway	Green	Forwards to any network-reachable target you configure.
SDK Embedded	Orange	The application embeds the zero trust client directly, so no separate app configuration is needed.

note

A connector's type and model are locked after it is created. Choose them carefully. Changing the type later means creating a new connector.

Applications

An application is a resource a connector makes reachable: a web app, database, API, or other service. Depending on the connector type, an application defines a protocol (TCP/UDP), addresses, and ports. A connector can expose several applications.

Enrollment

A newly created connector is not yet trusted by the network. To activate it you enroll it using a one-time enrollment token (a JWT) downloaded from the console and applied where the connector software runs. If a token is lost or expires, use Reissue to generate a new one.

A new Gateway has a second option: a short-lived registration token, minted via the API, that its install script exchanges for the credential and router configuration together. See Registration tokens for gateways.

Connector models

A connector model is a reusable connector blueprint (a type plus a set of applications) that the provider defines once and reuses across many customers and connectors. When a connector is created from a model, it inherits the model's applications; you can add custom applications on top.

Models keep deployments consistent and make onboarding faster.

Access policies

An access policy grants a set of source connectors permission to reach a set of destination connectors. Until an access policy links them, two connectors cannot communicate. This is the heart of zero trust access.

Each side of an access policy is built by adding the connectors it covers. You can add them by:

• Locations: Every connector at a location.
• Connectors: Specific connectors by name.
• Models: Every connector built from a connector model.
• All: Every connector.

The console expands these into concrete source-to-destination connector pairs that you review before saving.

Templates

Templates capture configuration so it can be reapplied:

• A customer template snapshots a full customer setup (locations, connectors, access policies) to use as a starting point when creating new customers.
• A location template snapshots one location's setup to deploy at another customer or site.
• A connector template is a named blueprint for a single connector — the type or model, overrides and applications — that location templates reference and reuse.

Templates differ from connector models: a model is a single connector blueprint, while a template is a larger snapshot of locations, connectors, and access policies.

Custom variables

A custom variable is a named value defined at the provider, customer, or location scope. Connector-model and template fields can reference it as a {{...}} placeholder (like {{customer.custom.dns_suffix}}) that's filled in with the right value when the model or template is deployed, so one blueprint fits every customer and site. Built-in variables such as {{customer.name}} work the same way with no setup. See Manage custom variables for details.

Monitoring

Live Audit is the real-time view of your network: provider and customer locations on a geographic map, the access policies between them, alerts, and usage. View it as a map, a table, or both, scoped provider-wide or to a single customer. See Live Audit for details.

More info

For detailed field definitions, behavioral rules, and edge cases, see the Learn section.