This is part 3 of the Reach launch series. Part 1 introduced Reach; Part 2 went into the engineering behind it. Here we cover everything that's shipped since the first version.

Reach launched in May 2026 as a straightforward private internet gateway. In the two months since, the product has grown substantially — pushed by real usage and the kinds of problems that surface once people start relying on a tool for daily work. Here's what's new in v1.9.

Graceful data-limit handling

The original behaviour when a user hit their data cap: the proxy stopped working. The browser showed a generic connection error. Users didn't know what had happened.

We replaced this with limited mode. When you hit your limit, the Reach gateway stays up — it just returns a clear block page instead of proxying your request. The page explains what happened, shows your usage, and links directly to the top-up flow at reach.tyo.com.au/limit. No mystery errors, no guesswork, no support tickets.

Square payment is integrated directly — top up, and the gateway resumes within seconds.

Reach now works on managed Windows devices

If your team uses company-issued Windows laptops with endpoint protection or group policy restrictions, Reach now installs and runs cleanly — no IT ticket, no admin approval, no elevation required. It installs at the user level and works within whatever security policy your organisation has in place.

This unblocks a significant segment of our Windows users who were previously stuck.

Device visibility for org admins

Organisation admins can now see every device that has been used to access the org's Reach service — what device, when it first connected, and when it was last active.

It's the foundation for tighter access control coming in a future release. For now, it gives you the visibility to know who's using Reach and from where — which is the first thing you need before you can enforce anything.

Access log

Org admins now have a log of connections made through Reach — which sites were accessed, when, and by which user. For businesses that need to demonstrate controlled access to clients or auditors, it's there without any extra setup.

ZTNA: inward access through the relay

This is the most significant capability addition in v1.9.

Zero Trust Network Access (ZTNA) flips the usual direction of a proxy. Instead of your traffic going out through Reach, ZTNA lets authorised members of your organisation reach in to resources on your internal network — without opening any firewall ports.

Here's the practical version: you have a server on your office network — a database, an internal web app, an RDP endpoint. You want team members to be able to reach it from anywhere, but you don't want to expose it to the internet, and you don't want to manage a VPN.

With ZTNA in Reach:

  1. A small agent runs inside your network — it connects out to Reach, so you don't open any inbound firewall ports
  2. The org admin defines which internal resources are accessible and to whom
  3. Authorised team members connect through Reach, which brokers the connection without either side needing to know the other's IP address

It's live now for organisations on the Reach plan. More granular access controls are on the roadmap.

Cloud firewall automation

When you run services behind an IP allowlist on AWS, GCP, or Cloudflare, the Reach gateway IPs need to be in that list for proxied traffic to reach your server. Managing that manually is tedious and error-prone.

The new Cloud tab in the org settings lets you connect your cloud account and manage firewall rules directly from the Reach portal:

You grant Reach access to your cloud account once. After that, when your gateway IPs change, Reach updates your firewall rules automatically. When you remove a connection, the rules are revoked. Your cloud credentials stay in your account — Reach never stores them.

Azure support is coming.

If there's something specific you need, reach out at reach.tyo.com.au or email [email protected].

This wraps the launch series. Thanks for reading — and thanks to the early users who pushed us to build a lot of this.