Architecture

A standalone, event-driven security architecture

Traffic is enforced at the edge with Coraza and the OWASP Core Rule Set, while certificates, key custody, analytics, and billing stay independent.

Request path

Internet

Untrusted client & machine traffic

ArxLayer Edge

TLS termination & request enforcement

Coraza + OWASP CRS

Inspection & anomaly scoring

Origin App

Your application or API

Platform components — separate from enforcement

ArxLayer Trust

Key custody & trust bundles

ArxLayer Certificates

Certificate lifecycle & certificate refs

ArxLayer Analytics

Event intelligence & reporting

ArxLayer Billing

Usage & commercial metering

ArxLayer IAM / NHI

User, service & machine identity

Boundary guarantee: ArxLayer Edge performs pure traffic enforcement. Certificate lifecycle, key custody, analytics, and billing are separate components — and no private keys ever traverse the event bus or config bus.

ArxLayer architecture: traffic is enforced at ArxLayer Edge using Coraza and the OWASP Core Rule Set before it reaches your origin, while certificate lifecycle (ArxLayer Certificates), key custody (ArxLayer Trust), analytics, billing, and identity (ArxLayer IAM / NHI) remain independent platform components.

ArxLayer Edge

Enforcement at the edge of your stack

The edge inspects every request and applies your policy before traffic reaches the origin.

Inspect before origin

Requests are evaluated at the edge, so attacks are stopped before they reach your application.

Last-known-good config

The edge boots from a config snapshot and keeps serving the last-known-good policy if the bus is briefly unavailable.

Fast, auditable rollout

Policy changes propagate to every node, with health and freshness signals for each one.

Coraza + OWASP CRS

Real, transparent WAF foundations

Protection runs on the Coraza engine with the OWASP Core Rule Set — an open, community-vetted detection baseline.

OWASP Core Rule Set

Industry-standard detection for common web and API attacks.

Anomaly scoring

Tunable thresholds so blocking decisions are deliberate, not all-or-nothing.

Detect → tune → block

A safe path to enforcement that does not break legitimate traffic.

Event-driven control plane

Event-first by design

A durable, versioned policy store is the source of truth. Configuration is published as events that the edge consumes to converge on the current policy.

Durable source of truth

Policy and every version live in a durable, versioned store, with an outbox for reliable publication.

Event-driven config

Configuration is distributed as events on a Kafka-compatible event bus, so rollout is fast and observable.

Converge & self-heal

Edge nodes reconcile against the event bus and recover cleanly after interruptions.

ArxLayer Trust & ArxLayer Certificates

Separate trust and certificate boundaries

ArxLayer Certificates owns certificate lifecycle; Trust owns key custody. The enforcement layer references certificates as opaque values — it never resolves them to keys.

Security boundary

No private keys in the WAF layer

A WAF is traffic enforcement, not a key store. Only certificate references and metadata ever travel the event bus.

No secrets in enforcement

The enforcement layer stores no private keys or secret material.

Bus carries refs only

The event bus carries certificate references and metadata — never private keys.

Bounded blast radius

Separation of duties keeps a failure in one component from compromising another.

API-first control plane

Manage protection as code

Domains, origins, and policies are API resources with immutable versions — reviewable, automatable, and reversible.

Everything is an API resource

Manage ArxLayer programmatically, with versioned policy you can review, automate, and roll back.

See the architecture in action

Book a demo to walk through edge enforcement, the event-driven control plane, and the security boundaries — or explore the platform.

Start free See pricing