Edge

The enforcement layer that sits in front of everything

ArxLayer Edge terminates connections, inspects every request, routes to your origin, and applies rate and reputation controls, all before traffic reaches your servers. It's the substrate every other ArxLayer product runs on.

Start free Explore the platform

The problem

If enforcement starts at your origin, it starts too late

When inspection happens behind your application, attacks and floods have already consumed connections, compute, and risk before any decision is made.

Origins absorb the hit

Without an enforcement point in front, every request, good or hostile, lands directly on your servers.

Decisions scattered per app

Termination, inspection, and routing handled app by app means inconsistent policy and gaps between services.

Config changes are risky

Pushing rule and routing updates live can break traffic if a bad version takes effect with no safe fallback.

What you get

One enforcement point in front of your stack

The edge handles the full request lifecycle locally and in memory: terminate, inspect, decide, route. Raw client IPs never leave it.

Terminate and route

Connections terminate at the edge, get inspected, and route to the right origin under one consistent policy.

Inspect before origin

WAF, bot, and reputation checks run at the edge so hostile traffic is decided on before it reaches you.

Rate and reputation controls

Shed excess and abusive traffic at the edge with rate limits and reputation signals, keeping origins clear.

Last-known-good boot

The edge boots from a snapshot of the last working config, so a control-plane outage never stops enforcement.

Event-driven rollout

Policy and routing changes propagate to the edge through an event stream, not manual pushes to each node.

No private keys at the edge

The enforcement layer holds no private keys, keeping a cleaner trust boundary in front of your origin.

How it works

From your domain to your origin

Route traffic through the edge once, and every ArxLayer protection runs in that single pass.

Point your domain

Send traffic to ArxLayer Edge. Connections terminate there instead of at your origin.

Inspect and decide

Each request is inspected and decided on locally, then allowed, challenged, shed, or routed on.

Forward to origin

Clean traffic reaches your origin, with config kept current through event-driven rollout.

Start free Request demo

FAQ

Questions, answered

What does the edge do before traffic reaches my origin?: It terminates the connection, inspects the request, applies WAF, bot, rate, and reputation checks, then routes clean traffic to your origin.
What happens if the control plane is unavailable?: The edge boots and keeps running from a last-known-good config snapshot, so enforcement continues even when the control plane is unreachable.
How are config changes rolled out to the edge?: Through an event-driven path. Versioned policy and routing updates propagate to edge nodes as events rather than manual per-node pushes.
Does the edge expose raw client IPs?: No. The request path is local and in-memory, and client IPs are hashed for reputation; raw IPs never leave the edge.

Explore

Put an enforcement layer in front of your origin

Route your domain through ArxLayer Edge and inspect, decide, and route every request before it reaches your servers.