SEC-VPN is a zero-touch IPSec VPN service designed for edge-scale deployments of headless devices such as sensors, gateways, routers, and embedded systems. The solution operates on a centralized, declarative management model where VPN topologies are defined once via a Web GUI or API, and devices connect automatically without manual configuration or local setup. It is composed of three core components: - MicroEdge: A lightweight VPN client that runs on Linux/Unix-based systems, establishes IPSec tunnels, and supports hardware-based trust anchors such as TPM and Arm TrustZone for zero-trust deployments. - NetEdge: A scalable VPN server deployed as a container or VM (cloud or on-premises) that acts as the IPSec tunnel endpoint. - ControlEdge: A central orchestrator that manages key distribution, tunnel setup, topology updates, load balancing, failover, and high availability across all nodes. It supports multi-tenant enterprise structures and provides a full management API. Key capabilities include automated key and certificate management and rotation, built-in NAT/firewall traversal (STUN/STUNless), tunnel profiles with device grouping, and lifecycle automation with no manual credential handling. SEC-VPN can be deployed on-premises, on Google Cloud, or on AWS. It supports multi-tenant management and is designed to scale without field access or manual provisioning.