Network automationBuilt for air-gapped estates
Discover everything.
Automate anything.
Trust the record.
ArchiFlow logs into your network read-only, rebuilds every device and cable from independent evidence, lets an engineer approve it, then drives configuration across 25+ vendors — on-prem, in the cloud, or fully air-gapped.
- Vendor-neutral
- Cloud, on-prem & air-gapped
- Read-only discovery
- SOC 2 · ISO 27001 control mapping
Measured on our 28-device multi-vendor lab · Oct 2026
Measured on live gear. Not on a slide.
Internal 28-device lab · Cisco IOS, IOS-XE, NX-OS · Juniper · Arista · Fortinet · October 2026 runs
devices identified by serial, each matched to exactly one record
links discovered in a single deep scan
cables recovered on the three-site reference topology
deep scan of a /24 at depth 2, auto-pivot on
configuration changes made on any device
network operating systems through one agentless engine
Scan any network. Get back the truth — and the drawing.
Point ArchiFlow at an estate — any vendor — and it rebuilds every device and every cable from independent evidence, lets an engineer approve it, saves it as the source of truth, and draws it.
Evidence fusion
Built for dark networks.
Most tools stop when neighbour protocols are off. ArchiFlow merges CDP/LLDP, forwarding tables, ARP, routes, spanning tree and LACP into de-duplicated links, each carrying a confidence tier. Only links both ends agree on are saved as connected cables; everything weaker is saved as planned, so the operator can always see which are proven.
In the October 2026 lab run — where the WAN links and a whole branch site run no neighbour protocols at all — it recovered all 23 cables of the three-site reference topology.
- 01
Sweep
ICMP plus SSH/Telnet probes find every live host
- 02
Crawl
Follows neighbours, tables and routes — hop by hop
- 03
Fuse
Five kinds of evidence become confidence-tiered links
- 04
Approve
Matches, conflicts and a dry-run save plan
- 05
Draw
A labelled, multi-page topology in one click
Links nobody advertises
Works with CDP and LLDP switched off. Triangulates layer-2 links from a router's ARP table and a switch's MAC table, and rebuilds WAN links from routing evidence alone.
Reaches gear you can't route to
Auto-pivot opens a session from inside a device it has already discovered and keeps going — over SSH or Telnet — so segmented and management-only networks get documented without new firewall holes.
Knows a device by its serial
Every device is matched on hostname, IP, topology position and serial. A renamed switch is still the same switch; a same-name device with a new serial is flagged as a possible hardware swap.
An engineer approves every change
Nothing is written when a scan ends. The operator sees matches, conflicts and a dry-run plan of every create, change and cable — and only then saves. Every write lands in the audit trail.
One system of record. Three layers, always in sync.
Every layer reads and writes the same source of truth — so a discovered cable, a designed prefix and a deployed template never disagree.
01
Physical — Discovery
Devices, interfaces, IPs, cables, serials and stacks, collected read-only and matched to the inventory you already have.
02
Logical — Design & IPAM
ArchiDraw diagrams where devices, cables and IPs are first-class objects, with Infoblox-style prefix management and one-click generated topologies.
03
Control — Automation
Templates bound to real device fields, config backup and versioning, candidate-vs-running diffs, scheduled canary deployments.
One platform. 40+ modules.
A unified system spanning discovery, design, configuration, AI and enterprise controls. These are the modules teams reach for first.
Discover & document
04Network Discovery & Documentation
Agentless SSH, SNMP, CDP and LLDP crawl into living documentation.
Network Scanning
Sweep subnets to find every reachable device, its vendor and open services.
Discovery-to-Design
Turn a finished scan into a tiered, cabled diagram in one click.
Network Diagrams & Topology
Diagrams where devices, cables and IPs are live objects, synced both ways.
Plan & track
04IPAM & Prefix Manager
Next-available allocation, bulk operations and utilization at a glance.
Inventory & Spare Parts
Spares, SFPs and power supplies tracked against live diagrams.
Data Migration & Import
Bulk-import devices, IPs, cables, sites and VLANs from Excel.
Device Replacement & RMA
Swap a model and carry over interfaces, IPs and cables.
Automate change
05Multi-Vendor Connectivity
One interface for SSH and Telnet across 25+ vendors.
Configuration Templates
Jinja2 templates bound to real device fields, fully versioned.
Config Backup & Versioning
Running-config captured with every deploy, kept as immutable versions.
Config Diff & Drift
Candidate vs running, clustered by difference across the fleet.
Scheduled Deployments
Recurring, canary-first rollouts with full run history.
Secure & govern
03Encrypted Credential Pools
AES-256 pools scoped by site and device, never written to logs.
RBAC & Access Control
Admin, editor and viewer roles enforced on every write.
Audit & Event Stream
An append-only record of every deploy, diff and discovery.
Work together
02AI Copilot & Wingman
Ask in plain language; it proposes changes you confirm.
Real-Time Collaboration
Live cursors, presence, team chat and an activity changelog.
Push change with a safety net.
Multi-vendor configuration automation built the way change boards wish it worked: backup first, diff everything, approve per device, save with the right command, and record it all.
Back up first
Running-config is captured in the same session as the deploy, hashed and de-duplicated into immutable versions. Nothing is ever lost.
Render from templates
CLI and Jinja2 templates with variables bound to real device fields, full version history, and shipped golden templates for Catalyst 9200/9300.
Review per device
A canonical candidate-vs-running diff shows exactly what will change. Nothing is pushed without an editor's approval.
Save the right way
write memory on IOS, copy run start on NX-OS and IOS-XE, commit on Junos and IOS-XR — the correct persistence semantics for every platform.
Catch what the transport hides
A deploy-time classifier detects % Invalid, % Incomplete and % Ambiguous responses — including their NX-OS and IOS-XR forms — even when the session reports success.
Schedule and canary
Recurring deployments against device sets with canary-first rollout and full run history, so a change proves itself on one device before it reaches the fleet.
- ▸Scope · 12 devices match sw-acc-* · site DC-EAST · credential pool dc-east-ops
- ▸Pre-deploy backup · running-config captured 12/12 · 3 new versions, 9 unchanged (de-duplicated)
- ▸Render · golden-ios-xe → 12 device-specific candidates (Jinja2, fields bound to inventory)
- ▸Diff · 38 lines added · 0 removed · 12 devices awaiting review
- ▸Review · approved per device by an editor · canary first
- ✓sw-acc-01 IOS-XE applied · save: write memory
- ✓sw-acc-02 IOS-XE applied · save: write memory
- ✓sw-agg-01 NX-OS applied · save: copy run start
- ✓rtr-edge-02 Junos applied · commit
- ▸CLI classifier · 0 errors (% Invalid · % Incomplete · % Ambiguous)
- ✔12/12 deployed · audit events written · post-deploy diff: no drift
Illustrative run · the sequence every deploy follows
One engine. Every major platform.
ArchiFlow speaks to 25+ network operating systems through a single agentless engine — so documentation, automation and backups never depend on any one manufacturer. Deep, first-class support everywhere; lock-in nowhere.
Every platform's semantics, done right
“Save the config” is a different command on every operating system. ArchiFlow knows each one — so backups, deploys and persistence behave correctly no matter what's in the rack.
write memorycopy run startcommitcommitexecute backupwrite memoryDepth, not just reachability
Golden configuration templates and hard-coded platform fingerprinting across the major families — Catalyst, Nexus, Junos, EOS and more — so a device is identified precisely, not just pinged.
CDP + LLDP topology
Native neighbour discovery over both CDP and LLDP with capability decoding, so links are mapped and graded by confidence regardless of who built the switch on either end.
Guardrails on every deploy
A deploy-time classifier catches platform-specific CLI errors — % Invalid / Incomplete / Ambiguous and their NX-OS and IOS-XR equivalents — even when the transport reports success.
Tuned for real hardware
Generation-aware disambiguation means a Nexus is never mislabeled as IOS, with pager-aware probes engineered for the platforms you actually run in production.
Zero outbound. Read-only in. Every write audited.
A posture designed for the estates that can't use cloud tools at all — defence, government, healthcare, finance and industrial networks — and verified in the code and the installer.
Security posture
Air-gapped edition- Outbound connections
- none
- Config changes by discovery
- 0
- Credential storage
- AES-256, per-install key
- Package integrity
- SHA-256 · SBOM
- Transport
- TLS 1.2 / 1.3 · HSTS
- Write authorisation
- RBAC · same-origin
Control mapping available for SOC 2, ISO 27001 and NIST frameworks. See the Trust Center for data residency and sub-processor detail.
Read-only discovery
Discovery makes no configuration changes. It issues read-only show and display commands plus session setup; its only writes go to the ArchiFlow database, after an operator saves.
Zero outbound, air-gapped
The air-gapped edition makes no outbound connections from any component, ships without the AI agent, and installs from a single self-contained package.
Per-install secrets
Every stack secret is generated on the customer's server — none is baked into an image — and can be rotated on a running install with one command.
Verified supply chain
SHA-256 checksums are verified for every package file before anything changes, and a CycloneDX SBOM can be produced for every image.
Encrypted credential pools
Device credentials are AES-256 encrypted at rest with a per-install key, never returned in clear text, and redacted from transcripts, events and backups.
RBAC on every write
Admin, editor and viewer roles enforced on every write route; state-changing requests accepted only from the application's own origin; real-time connections require a session.
Hardened web tier
TLS 1.2/1.3 on by default with the customer's certificate, HSTS and security headers, Secure cookies, rate-limited sign-in and an 8-hour idle timeout.
Complete audit trail
Every discovery write is recorded per scan; an activity log is filterable by user, object, action, site and date; the database changelog covers change control.
The gold standard for running a network.
Ten principles that separate a well-run network from a lucky one. Most teams keep them in a policy document. ArchiFlow builds them into every scan, change and save.
Enforced, not recommended
- Identify2
- Protect5
- Detect2
- Recover1
Each principle maps to a capability you can see in a demo — not a slide.
Function labels follow the NIST Cybersecurity Framework. The mapping is ArchiFlow's own, not a certification.
Know every device before you touch one
Read-only discovery rebuilds the inventory from five kinds of evidence and matches every device by serial, so each change is planned against what is really there.
Evidence over assumptions
Every discovered link carries a confidence tier. Only links both ends confirm become connected cables; anything weaker is saved as planned, in plain sight.
Read-only by default
Discovery makes no configuration changes. Its only writes go to the ArchiFlow database, and only after an engineer reviews a dry-run plan and saves.
Least privilege, encrypted secrets
Admin, editor and viewer roles on every write. Credential pools scoped by site and device, AES-256 encrypted at rest and redacted from logs and backups.
Sovereign by design
The air-gapped edition installs from one checksum-verified package, generates its own secrets and makes no outbound connections. Network data stays inside your walls.
Back up before every change
Running-config is captured in the same session as each deploy and kept as an immutable, de-duplicated version, before anything is pushed.
Golden configurations, not hand-typed ones
Templates bound to real inventory fields render device-specific configs, with full version history and shipped golden templates for Catalyst 9200/9300.
Review every diff, catch every error
Each candidate-vs-running diff is approved per device, and a CLI classifier catches % Invalid, % Incomplete and % Ambiguous even when the session reports success.
Find drift before it finds you
Config diffs cluster what differs across the fleet, and discovery can re-run on a schedule so the record keeps matching the network as it changes.
Every change attributable, every version kept
An append-only event stream records who changed what, where and when, and every earlier running-config remains on hand as a known-good reference.
An AI copilot that knows your network.
Grounded in your real inventory — ask in plain language and it proposes changes you review and confirm. Powered by Anthropic Claude with retrieval over your own data, as an optional cloud add-on.
4 devices match, from your inventory:
- • sw-acc-07 — last backup 31 days ago
- • sw-acc-11 — last backup 33 days ago
- • sw-acc-19 — last backup 40 days ago
- • sw-acc-23 — last backup 44 days ago
Want me to propose a backup task for these four? Nothing runs until you confirm.
Proposal · awaiting your confirmationDesigned to work with the best.
Built in close collaboration with the vendors leading the network industry — deep, native integrations, not surface-level connectors.
Juniper
MX, SRX, EX, ACX series JunOS device support
Arista
EOS-based data center switch automation and management
Fortinet
FortiGate firewall and FortiOS security fabric integration
Palo Alto Networks
PAN-OS firewall configuration and security policy management
Cisco
Catalyst 9200/9300 IOS-XE configuration and management
NetBox
Two-way sync with an open inventory core — one integration among many
SolarWinds
Network monitoring and performance management integration
Check Point
Gaia OS security gateway policy and rule management
F5
BIG-IP load balancer and application delivery configuration
NVIDIA
Cumulus Linux and Spectrum switch configuration support
Open, extensible architecture
An open plugin architecture with a documented API — integrate additional vendors, monitoring systems, and automation platforms without being locked to any single stack.
Built for organisations that can't afford downtime.
Deploy on your terms — with the security, resilience and operational control that critical-infrastructure teams require.
The standard operators run on
Multi-site enterprises, data centres and critical-infrastructure teams standardise on ArchiFlow — turning a sprawling, multi-vendor network into one source of truth. When the system holds the truth, every engineer operates like your best one.
On-premises & cloud
Deploy anywhere — single-server Docker, distributed APP + DATA architecture, or AWS RDS. Ubuntu 22.04 and the RHEL 9 family, from the same installer.
Air-gapped by design
One self-contained package installs on a server with zero internet access — its own Docker binaries and images included. Per-install TLS, no outbound connections, SHA-256-verified before anything changes.
Security-first operations
Rate-limited sign-in, encrypted transport and credentials, RBAC on every write, CLI-error detection on every deploy, and control mapping for SOC 2, ISO 27001 and NIST frameworks.
Built to scale
From a single site to multi-site estates with a bundled monitoring stack (Prometheus, Grafana, Loki). A minimal 16 GB footprint to start.
Deployment options
See ArchiFlow in action.
From site creation to team collaboration — every step flows into the next.
Create a site
Request a demo
See your own network come back as a record you can trust.
A personalised walkthrough with our engineering team — discovery, automation and the air-gapped edition, on your use case.
- Free personalised demo
- See your use case in action
- Talk to our engineering team
- No commitment required
Request a demo
We'll get back to you within one business day. No spam, ever.