Why HiloVPN
Built by sysadmins who had enough
Endless device-by-device rollouts, connections that drop, painful sign-ins, steep licence fees, data processed in the United States. We lived with those problems at our clients for years. So we built the VPN we wanted to give them.
We took the best protocol in the world, and fixed everything around it.
How it works
How HiloVPN gets through everywhere
From the user's click to an established tunnel, everything is automatic, including the plan B when a network blocks VPNs.
One click to connect
The user signs in with the Microsoft 365 account they already use. Nothing to configure, no extra password.
The fast lane first
By default, the tunnel connects over UDP, the fastest path there is. That's the everyday one.
Blocked? The stealth lane
In a courthouse, a hotel or abroad, some networks block VPNs. HiloVPN then takes the same path as secure websites (HTTPS), which can't be blocked without cutting off the entire web.
Connected, and it holds
The connection restores itself after a drop, and if one of our servers goes down, another takes over, with no one having to step in.
Identity
Access follows Microsoft 365
Add an employee to a Microsoft 365 group and they show up in the platform with the right access, without anyone creating them. To connect, they click one button and use the account and MFA they already have. No extra password, no certificates to hand out.
An employee leaves the company? Remove their access and they are cut off within seconds.
Deployment
200 devices deployed in one go
The agent installs silently through your usual management tool, such as Intune or NinjaOne. The user sees nothing and clicks nothing. On first launch, they sign in with Microsoft 365 and everything is already configured.
Change something later? The new configuration rolls out on its own at the next reconnect. No desk-to-desk visits.
Access control
Each user sees only what they need
With a traditional VPN, being connected often means access to the entire network. Here, the same Microsoft 365 groups also decide what each person can reach. Accounting sees the accounting server, technicians see theirs, and nothing else.
So a compromised device can't go exploring your network, because it can't even see what doesn't concern it. It's the principle of network access control (NAC), without another product to buy.
Infrastructure
Data in Quebec. A service built to stay up.
HiloVPN runs on several servers in Quebec, and each one keeps a copy of every other server's configuration. If one falters, another takes over its clients automatically, with the same configuration, within minutes.
These servers are hosted at OVH and Azure, on top of our own facilities, and your data never leaves Quebec. It is never rented or sold, and each client is walled off in its own network.
measured in full tunnel, all traffic through the VPN
of the connection's speed kept in the same test
to cut all access for a departing employee
of data hosted in Quebec
And everything else
Built for the people who run it and the people who use it
Built-in diagnostics
"My VPN is slow" turns into a precise answer. The app tests the connection end to end and says where the problem is. We can even run that test remotely, without bothering the user.
Split or full tunnel, your choice
Either only work traffic goes through the VPN (faster day to day), or everything does and exits in Quebec. Users can switch between the two themselves.
Connects to your offices and Azure
We connect to your offices through your firewalls, or through a small relay when they're off-limits. Same in Azure, where that relay can replace a paid VPN gateway.
Every client, isolated from the rest
Every client lives in its own isolated network. Ten companies can use exactly the same internal addresses without ever colliding.
White label
Your name, your logo, your domain. Offer the VPN under your own brand to your users or to your clients.
Your servers answer by name
File shares, Active Directory, internal applications. Everything answers by its usual name as soon as the tunnel is up, with no addresses for the user to remember.
Against the alternatives
Compare for yourself
What HiloVPN includes, next to cloud solutions and the VPNs built into firewalls, based on their public documentation: a ✓ only where the feature is documented for both products named.
| Feature | HiloVPN | Cloud solutions (Tailscale, Zscaler) | Firewall VPNs (Fortinet, Meraki) |
|---|---|---|---|
| Price per device per month | $5all-in, in Canadian dollars | depends on the plan and vendor | depends on the hardware and its licences |
| Data hosted in Quebec | ✓OVH, Azure and our own facilities | no Canadian hosting documented | the gateway is your own firewall |
| Automatic fallback when a network blocks VPNs | ✓HTTPS and TLS stealth mode | HTTPS relays with Tailscale; TLS tunnel with Zscaler | to configure: IPsec over TCP with Fortinet, AnyConnect with Meraki |
| Microsoft 365 sign-in, accounts created automatically | ✓SSO and SCIM included | ✓SCIM on Tailscale's paid plans | Entra sign-in possible; no SCIM documented |
| Role-based access | ✓through your Entra ID groups, included | ✓number of groups capped by Tailscale plan | ✓through firewall rules (RADIUS with Meraki) |
| Split or full tunnel, the user's choice | ✓ | with Tailscale (exit node); set by the admin with Zscaler | no in-app choice documented |
| Silent mass deployment | ✓through your RMM or Intune | ✓ | ✓ |
| Remotely triggered diagnostics | ✓without disturbing the user | remote logs with Zscaler; not with Tailscale | with FortiClient EMS (Fortinet); not documented for Meraki |
| White label | ✓your name, your logo, your domain | company logo with Zscaler (Windows); no white label documented | no white label documented |
Pricing
One price, $5 per device
No hidden tiers, no features held hostage in an "Enterprise" plan. Microsoft 365 sign-in, stealth mode, access control, high availability and diagnostics are included for every device.
Included for every device
- Microsoft 365 sign-in and MFA
- Automatic stealth mode
- Role-based access control
- High availability in Quebec
- Remote diagnostics
- Windows, macOS and Linux
DNS web filtering: an upcoming option. Its availability and price will be confirmed in your quote.
Your estimate
Monthly total: $125 per month
≈ $1,500 / year
No credit card required. Estimate without commitment.
Transparency. Indicative launch price, before taxes, confirmed with your quote.
FAQ
Frequently asked questions
What is WireGuard?
Does it work on networks that block VPNs?
How do my employees connect?
Does my data go through the United States?
What happens if a server goes down?
Can we limit what each user can reach?
Which systems does the agent run on?
Can we offer it under our own brand?
Ready to stop thinking about your VPN?
Ask for a demo: we show you HiloVPN in action, and you judge for yourself.
Prefer email? info@hilotech.ca
Prices in Canadian dollars, before taxes: an indicative launch price, confirmed in your quote. DNS web filtering is an upcoming option; its availability and price will be confirmed at quote time.
Throughput and speed kept measured by HiloTech in 2026, in a full-tunnel speed test; results vary with your internet connection.
Comparisons are based on the public documentation of the products mentioned (tailscale.com, help.zscaler.com, docs.fortinet.com and documentation.meraki.com), consulted on October 29, 2026, and may vary by plan, version and configuration.
Tailscale, Zscaler, Fortinet, Cisco Meraki, Microsoft 365, Entra ID, Intune, Azure, NinjaOne and OVH are trademarks of their respective owners, with no affiliation to HiloTech. WireGuard is a registered trademark of Jason A. Donenfeld.