NaaS – Isolated Virtual Networks and Secure Tenant Segmentation

Deploy Logically Isolated Networks from a Centralized Infrastructure and Allow Only Explicitly Authorized Connections.

sayFUSE Network as a Service provides logically isolated networks, tenant networks and security zones on a shared infrastructure. Data centers, service providers and large enterprise environments can centrally operate multiple separated and isolated networks without having to build a dedicated physical network infrastructure for each tenant.

The shared infrastructure simplifies operations and scaling, while communication environments remain strictly separated. Each tenant, application or security zone is granted only explicitly authorized connections to designated services, networks or access points.

NaaS, VPN and sayTRUST UZE – Different Roles

NaaS separates and manages virtual infrastructure and tenant networks. VPN remains suitable for clearly defined site-to-site connections and legacy systems. sayTRUST UZE, on the other hand, provides identity- and application-based access without granting users general access to the network.

Together, these three capabilities form a comprehensive security and access architecture. They complement one another rather than replace each other.

Typical Use Cases

Data centers and managed service providers operating multiple customer environments
Large enterprises with separate business units or subsidiaries
Government agencies and project environments with specific security requirements
Development, testing and production environments running on a shared platform
Infrastructure consolidation projects that require strict separation within a shared environment

Physically Unified. Logically Isolated.

Secure, Isolated Tenant Networks

Virtual routers, DHCP, NAT, floating IPs, firewalls, VPN connections and load balancers can be provisioned for each tenant on a per-project basis and adjusted as needed.

Address spaces, security rules and administrative permissions remain separate, even though the underlying compute, storage and network resources are shared.

No Unrestricted Network Interconnections

Network connections are not established automatically. Interconnections between tenants, security zones, locations or external services are explicitly planned, monitored, approved according to defined permissions and technically enforced.

This reduces the risk of a security breach spreading uncontrollably into adjacent environments.

Encapsulated NaaS

The sayTEC security architecture is organized into three vault layers. The innermost vault contains the physical infrastructure, while Secure Cloud operates within the outer vault layer.

The middle vault layer contains the encapsulated Network as a Service (NaaS) environment. It ensures strict isolation and segmentation of tenants, applications and security zones.

Tenant networks for customers, locations, departments or projects
Separate production, development, testing and administration zones
Centralized administration or delegated management within clearly defined boundaries
Controlled connections to the internet, legacy networks and external cloud services
Scalability through the existing sayFUSE HCI platform and additional nodes

Operational and Economic Benefits

Standardized, centrally managed network services provide maximum flexibility and transparency. New tenants, security zones and configuration changes can be integrated quickly without having to deploy redundant router, firewall and load balancer infrastructures for each environment.

This reduces complexity and operational overhead while ensuring that responsibilities, communication relationships and security boundaries remain transparent and traceable at all times.

Centrally Managed. Strictly Isolated

NaaS combines the efficiency of centralized infrastructure with strict tenant isolation — without shared tenant network structures.