Skytropic

The platform

CDN, WAF, DDoS scrubbing, Zero Trust and encryption share one data plane, one console and one API — so a rule written once protects every request, everywhere.

Get startedRead the docs

Architecture

Each request passes the same clean sequence. Most never need to travel past the second step.

01

HTTPS · QUIC

Client

Browsers and apps connect over TLS 1.3 or HTTP/3 to the Skytropic anycast address.

02

Anycast · cache

Edge PoP

The nearest point of presence answers from cache and enforces WAF and rate limits.

03

L3 – L7

Scrubber

Volumetric and application-layer floods are absorbed before they gather.

04

WireGuard · mTLS

Tunnel

What needs the origin travels through a sealed, pinned, key-rotated tunnel.

05

Your servers

Origin

Your infrastructure sees clean, authenticated traffic — and a fraction of it.

Watch it work

Request trace Live
  • GET/api/stockMISS31 ms
  • GET/HIT9 ms
  • POST/wp-login.phpBLOCK1 ms
  • GET/img/hero.avifHIT5 ms
  • GET/api/cartMISS38 ms
  • GET/checkoutHIT7 ms

Cache hits answer in single-digit milliseconds.

skytropic — tunnelend-to-end sealed

$ skytropic tunnel up --origin 10.0.4.12:443 --pop waw-01

→ ClientHello TLS 1.3 · X25519 · ALPN h3

← ServerHello TLS_AES_256_GCM_SHA384

← Certificate ECDSA P-256 · OCSP stapled

→ WireGuard Curve25519 · ChaCha20-Poly1305

✓ mTLS pinned origin.lumen.internal · SPKI match

✓ Tunnel up waw-01 ⇄ origin · 0-RTT resume · 3.8 ms

keys: customer-managed (BYOK) · rotation 24h · HSM-backed

$

Origin traffic is encrypted end to end, with your keys.

Inside the stack

An edge stack that grows with you — from a static site on a CDN to Zero Trust and post-quantum cryptography, configured from one console and one API.

01

CDN

HTTP/2 · HTTP/3, gzip/brotli, TTFB < 100 ms at a local PoP.

02

WAF

OWASP Top 10, rate limiting, ML anomaly detection. False positive < 0.1%.

03

DDoS Scrubber

Netflow, behavioral ML, mitigation time < 30 seconds.

04

Zero Trust

Device posture, OIDC/SAML, private WireGuard/mTLS tunnels.

05

Encryption Core

E2EE, AES-256, ChaCha20-Poly1305, TLS 1.3, HSM.

06

Edge Compute

Serverless at the network edge — without vendor lock-in.

Built on open standards

TLS 1.3HTTP/3 · QUICAES-256-GCMChaCha20-Poly1305X25519WireGuardmTLSOWASP CRSAnycastDNSSECGDPRNIS2

When you are ready

Open an edge account and put your traffic into motion — protected from the very first hop.

Create accountSign in
  • Pay in crypto
  • Two-factor sign-in
  • Leave any time, with your keys