Enterprise-grade security. Every layer of the edge.
Six modules running in sequence at the edge, protecting your origin before traffic ever reaches it.
Web Application Firewall
Weighted-scoring engine decodes double URL-encoding, strips SQL comments, then scores patterns across SQLi, XSS, LFI and RCE categories. Only blocks when the accumulated score crosses the sensitivity-driven threshold — never trigger-happy.
AI Bot Management
Fingerprints AI crawlers (GPTBot, ClaudeBot, Bytespider) and blocks them permanently. Headless browsers are detected via injected telemetry SDK that tracks mouse movements and canvas hashes. Configurable actions: block, challenge, tarpit, or serve fake data.
L7 DDoS Mitigation
Tracks RPS velocity per IP and session using Valkey atomic INCR/EXPIRE. Offenders are thrown into the Penalty Box — a Redis set checked in O(1). All subsequent packets from penalized IPs are dropped at the Nginx edge via ngx.exit(444) in 0 milliseconds.
API Shield & Zero-Trust
Shadow API discovery maps undocumented REST/GraphQL endpoints. JWTs are cryptographically verified at the edge, blocking alg:none bypass attacks. Recursive SSRF protection unpacks nested JSON to block cloud metadata attacks. GraphQL introspection and depth limits enforced.
India Data Loss Prevention
Deep-scans outgoing HTML and JSON responses in OpenResty RAM. Masks 12-digit Aadhaar numbers, PAN cards (format-matching), credit cards and phone numbers before the packet is flushed to the client socket. The unredacted data never touches disk.
Zero-Day AI Virtual Patching
A background worker polls the NVD hourly, sends each new CVE description to Google Gemini, generates a Lua regex WAF rule, stores it in MongoDB, and pushes it to every tenant's edge dynamically — no restart required.
The life of a request, in two milliseconds.
Every request runs through a sequential Lua pipeline. Each stage is sub-millisecond, cached in shared memory, and engineered to drop threats before they ever reach your origin.
Every layer of defense. One nameserver change.
Six modules inspect each request in sequence — routing, DDoS, WAF, bots, API shield and DLP — then scrub the response on the way back.
Sensitive data, masked in RAM
Outgoing HTML and JSON are scanned in OpenResty's memory. Aadhaar, PAN and card numbers are masked before the packet hits the network socket. Nothing sensitive is ever written to disk.
Risk-scored in real time
Weighted, not trigger-happy
The Penalty Box
Patched before you know
JWT & SSRF, blocked at the edge
JWTs are cryptographically validated in Lua. Recursive SSRF payloads targeting the cloud metadata IP are unpacked and dropped before they reach your backend.
Zero-day threats patched before you wake up.
A background worker polls the NVD hourly, sends each CVE to Gemini to generate a Lua regex WAF rule, and pushes it to every tenant's edge — without a single restart.
{ p = "path_traversal--[\\w/]+--etc/passwd", w = 7 },