sayTRUST UZE Post-Zero-Trust Secure Access
and Dedicated Communication

Universal Zero Trust Exchange: controlled access to applications, data, machines and sites –
without general network access

The solution at a glance

sayTRUST UZE connects the central UZE server with hardware- or software-based UZE clients. Only the authorised communication relationship with a specific application, service, machine or defined site is enabled. Users are never given general access to the corporate network.

The security chain begins with the unambiguous identification of the user at the computer. Only then is the protected client environment activated, policies and security status checked and the specifically permitted communication established. Post Zero Trust shapes the entire SAYTEC architecture model; sayTRUST UZE is the technical platform that puts this principle into practice.

VPN connects. Zero Trust controls. Post Zero Trust isolates the authorised communication relationship and consistently moves the security decision ahead of connection set-up.

Conventional VPN solutions technically couple a remote computer to a network or network segment, despite encryption. If the client is compromised, this connection can itself become an attack path. Zero Trust and ZTNA improve control; sayTRUST UZE takes the idea further: rather than opening the network, it opens only the authorised relationship and one specific application.

Security stages and their effect

1. Identification: the authorised user is uniquely verified before communication and the security environment are activated.
2. UZE client: the personal client or the device-bound software client is activated in a controlled manner and monitored.
3. Protected RAM context: session, policy, communication and routing information is processed temporarily and in protected form.
4. Policy and posture: permissions, certificates, policies and security status are checked before any communication takes place.
5. Authorised exchange: the UZE server brokers only the explicitly approved application or communication relationship.

Internal and external workstations are protected according to the same principle

sayTRUST UZE is not designed solely for home offices and mobile users. Internal workstations, personal devices, service-provider access and separate network segments can also be handled according to the same security logic. What matters is the interplay of several security layers. As a result, servers and critical resources remain shielded from end devices to the greatest possible extent. Unauthorised systems are not visible, not freely addressable and not reachable.

Hardware and software clients

Hardware-based and software-based UZE clients can be used within the same environment. Hardware clients are portable and particularly suitable for high protection requirements; the software client is permanently tied to one defined device.

High availability without duplicate client licensing

For high-availability installations, a separate HA appliance with an integrated HA server operating system is available. It takes over the licence scope and connection capacity of the assigned UZE master, so client licences do not have to be purchased again for the redundant system.

UZE Plus for machines, servers and sites

UZE Plus extends the platform with dedicated machine-to-machine and site-to-site communication. Up to twelve machines or defined networks or subnets can be connected. Here, too, no remote network is connected wholesale; only the authorised systems and relationships communicate with the respective networks.

The UZE Plus Appliance Enterprise combines personal UZE client access with dedicated communication between machines, servers, networks and sites.

Benefits and typical areas of use

• Unique identity as the starting point of the security chain.
• Policy, posture and communication checks before any communication or relationship is established.
• Application-specific access without general network access.
• Zero-footprint principle and a protected, temporary RAM context.
• A uniform security model for internal and external workstations.
• Controlled access for users, partners and service providers.
• Dedicated communication for machines, servers, networks and sites.
• Reduced visibility of internal structures and a significantly smaller attack surface.

Conclusion

sayTRUST UZE combines identity, client activation, a protected memory context, policy enforcement, posture checks, the UZE server, communication control and zero footprint into an end-to-end Post-Zero-Trust security architecture.

It is not the network that is opened – only the approved communication relationship with a specific application.