Can this client reach this server?

Seven hops stand between a computer and a SpanDock server’s API. Pick who is knocking, send the packet, and open any hop to see what it exposes and what protects it.

1 · Who is knocking?

Unlicensed strangerSomeone with a node key they generated themselves, no SpanDock license, and no secret of Server A's.Licensed Tenant B, no tunnel secretA computer paired to another company's live SpanDock server. Its node key is registered, so managed relays admit it, but it has never seen Server A's address and pre-shared key.Licensed Tenant B, leaked tunnel secretThe same Tenant B computer, after Server A's address and pre-shared key leaked to it (a pasted pairing code, say). It still has no client token for Server A.Authorized Client AA computer paired with Server A: its key comes from the pairing code, it holds the address and pre-shared key, and its own client token. It connected a minute ago.

2 · Relay

3 · Server A’s peer gate

Unlicensed strangerServer A

The packet is on its way…

2. DERP relay admission

Blocked

Exposure: SpanDock's managed relays admit any node key registered by an active installation on a live license, whichever server that installation is. Admission isn't scoped to the destination.
Protection: Managed relays ask spandock.com before admitting a key; unknown keys and keys of lapsed licenses are refused. The relay only forwards encrypted packets.
This connection: No live installation registered this key, so the managed relays refuse it.
Required: To get past this hop: a node key registered by a live installation, or the public relay fallback.

What this shows

Layered isolation, not an air gap. SpanDock servers share relay infrastructure. What keeps one company’s computers away from another’s server is a stack of logical and cryptographic checks, each independent of the others.
Relay admission is global. SpanDock’s managed relays admit any node key that an active installation on a live license registered. A computer from another company passes this hop, and the public relay fallback checks nothing at all.
Each server takes only its own computers. Without the server’s address and pre-shared key, a computer can’t even address it. From v0.46, the server also keeps an allowed list of its own computers’ keys, so even with a leaked secret another company’s computer is ignored before it becomes a peer.
The client token still stands. Every route through the tunnel asks for a credential that only the server issues, so a leaked tunnel secret alone never reaches the API.
Releases before v0.46 start the tunnel without that list, so a leaked secret gets a computer through the peer gate, and the client token stops it. Switch the peer gate to see that path.

More in the security whitepaper. Administrators see their own servers’ paths, with live evidence, in the SpanDock dashboard under Infrastructure → Reachability.