Every request proves itself. No keys, anywhere.

The part that actually refuses. It runs in your environment, in front of your API.

• Verifies every request locally — no call to any hosted service in the request path, so your latency and availability stay yours.
• Carries the proof types: the boundary is where the cryptography plugs in.
• Ships as a container today. Brownfield: put it in front of an existing API, your code unchanged. Greenfield: write endpoints, never auth logic.
• No metering in the enforcement path — the boundary never phones home to count requests.

What you buy when one protected API becomes twenty. The management layer, not the enforcement path.

• Trust anchors: declare who may call, from where, in what window, to which route — and edit them fleet-wide.
• Agent auto-enrollment: workloads matching an anchor enroll themselves by proving where they run. No credential hand-out.
• Revocation: withdraw access by editing the anchor. Nothing to rotate, nothing to chase.
• Fleet visibility: every protected API, every enrolled client, and their readiness in one view.
• Evidence-grade audit: every allow and deny as a decision record with a reason code, exportable for compliance and incident review.

Custom pricing, scoped per deployment — cost tracks your estate, not your traffic.

For teams whose auditors assess the deployed instance, not just the code.

• The control plane hosted inside your own environment, so trust anchors, enrollment, and audit records never leave your infrastructure.
• Built for regulated and sovereignty-bound deployments where a shared SaaS control plane is not an option.

Talk to us about Edge — scope is defined per deployment.