Edge is The One Stack's always-on SASE VPN for your clients. Each Edge site gets its own cloud concentrator (a WireGuard gateway) with a static egress IP. Edge is software only: The One Edge client app on the device plus the cloud concentrator. Edge Bridges (the old on-site appliances) are retired. Client devices enrol once, then connect to it automatically. You manage everything in the Hub under /edge.
What Edge gives you
- A dedicated concentrator per site. When you provision a tenant, Edge creates a WireGuard concentrator for it in the region you choose. The concentrator is platform-managed: it is replaced by rebuild rather than patched in place.
- A static egress IP. The tenant page shows the address your client's tunnelled traffic leaves from.
- Policy per tenant. Steering rules, DNS and access lists, plus split tunnelling, geo-blocking and bandwidth/QoS.
- Network-wide controls. Network Groups, Cloud Firewall, DNS Security, Device Posture and Private Apps.
- Visibility. The Dashboard, Gateways health, Analytics, Security Events, Threat Detection, Threat Intel, Compliance, Alerts and the Audit Log.
Edge and Quiet are different products
Quiet does not include an Edge concentrator or a dedicated IP; its VPN egress comes from a shared pool. A dedicated concentrator and static egress IP per site are Edge capabilities only, and nothing in Quiet turns them on.
What Edge does not do
- No Allow-list compatible claim. Edge has no Allow-list page and makes no "Allow-list compatible" claim.
- No Edge Settings page. You configure each tenant from its own tenant page (see below). If the Hub shows a Settings link for Edge, it opens a "not found" page on purpose.
- No self-service gateway rebuild. Gateways are platform-managed. If a gateway looks unhealthy, contact The One Stack support.
- No plan to choose. A tenant's plan shows as read-only in the Hub.
Good to know: fail-open by default
Every tenant page has a Policy card that says what happens if the device can't reach the cloud concentrator:
- Fails closed: traffic stops.
- Fails OPEN: traffic goes out directly, outside the tunnel.
If the policy doesn't say, the platform default is fail open. Check this card for every client and set the policy to match what you've agreed with them.
Who can open Edge
Edge needs the Edge entitlement on your organization. If /edge doesn't load for you, ask your Hub account owner or The One Stack support.