Skytropic

Security

Defence in depth from the first packet to your origin: anycast absorption, a WAF that reads every request, sealed tunnels, and an account model with two-factor sign-in and revocable sessions.

Defence in depth

Security is not a feature you switch on. It is how every part of Skytropic is designed, from the protocol to the sign-in screen.

Encryption

Modern ciphers everywhere, keys you can hold.

  • TLS 1.3 only, HSTS preload
  • AES-256-GCM · ChaCha20-Poly1305
  • Customer-managed keys (BYOK)

Identity

Accounts that resist takeover.

  • TOTP two-factor + recovery codes
  • Server-side, revocable sessions
  • Lockout after repeated failures

DDoS absorption

Floods dissolve across the network.

  • Anycast L3/L4 scrubbing
  • HTTP flood heuristics
  • Mitigation in seconds

Network edge

Only clean traffic moves inward.

  • Geo and ASN policies
  • Origin IP never exposed
  • Private tunnels to origin

Web firewall

Every request read before it costs you.

  • OWASP Core Rule Set
  • Custom expressions
  • Bot challenge & rate limits

Transparency

Trust you can verify.

  • Open crypto architecture
  • EU data residency, GDPR
  • Public bug bounty

Under attack, live

A 1.3 Tbps HTTP flood is absorbed across the anycast network while origin load stays at two percent. A single firewall expression deploys to every PoP in about three seconds.

Attack · HTTP flood Mitigating

Absorbed at edge

1.3 Tbps

Origin load

2%

Time to mitigate

3 s

Traffic at edge Reaches origin

New firewall rule

waf.rules
when
thenBlockLive on 41 PoPs · 3.1 s

Then it travels sealed

TLS 1.3 at the edge, WireGuard and mTLS back to your origin, AES-256-GCM and ChaCha20-Poly1305 everywhere in between. The crypto architecture is open: audit it, pin it, bring your own keys.

skytropic — tunnelend-to-end sealed

$ skytropic tunnel up --origin 10.0.4.12:443 --pop waw-01

→ ClientHello TLS 1.3 · X25519 · ALPN h3

← ServerHello TLS_AES_256_GCM_SHA384

← Certificate ECDSA P-256 · OCSP stapled

→ WireGuard Curve25519 · ChaCha20-Poly1305

✓ mTLS pinned origin.lumen.internal · SPKI match

✓ Tunnel up waw-01 ⇄ origin · 0-RTT resume · 3.8 ms

keys: customer-managed (BYOK) · rotation 24h · HSM-backed

$

01

European standards

AES-256, ChaCha20-Poly1305 and TLS 1.3 — aligned with GDPR, NIS2 and EU cybersecurity practice.

02

Open crypto architecture

Audited primitives, published designs, transparency reports and a public bug bounty.

03

No cage

Customer-managed keys, S3-compatible storage, GitOps config. Leave whenever you like — with everything.

Responsible disclosure

We welcome reports from researchers. We answer within two working days, never pursue good-faith research, and credit every valid finding.

/.well-known/security.txt
Contact: mailto:security@altumptic.com
Policy: https://skytropic.space/security
Preferred-Languages: en, uk
Encryption: openpgp4fpr:7A3F…E19C
Acknowledgments: https://skytropic.space/thanks
Expires: 2027-10-01T00:00:00Z
Report a vulnerability

When you are ready

Open an edge account and put your traffic into motion — protected from the very first hop.

Create accountSign in
  • Pay in crypto
  • Two-factor sign-in
  • Leave any time, with your keys