Skip to content
ArxLayer

By Cloud Granite Ltd

Platform

One platform for every layer of protection

ArxLayer unites web, API, AI-agent, and bot protection in a single event-driven control plane. Products are grouped under five pillars — Protect, Control, Trust, Edge, and Intelligence — and no private keys ever live in the enforcement layer.

The platform

Five pillars, one control plane

Adopt the products you need — they share one policy model, one event bus, and one control plane, and work together by design.

Protect

Always-on engines that detect and stop attacks and abuse.

Web Application Firewall
OWASP CRS protection for your domains and web apps.
Bot Defense
Bot, crawler, AI-traffic, and reputation controls.
DDoS Protection
Absorb and shed volumetric and application-layer floods.
API Protection
Schema, token, and abuse protection for every endpoint.
Agent Gateway
Identity-aware protection for AI-agent endpoints and tools.

Control

The policy and access levers you configure to govern traffic.

Rate Limiting
Per-route and per-identity request-rate controls.
IP & Reputation
Allow, deny, greylist, and cross-fleet reputation.
Token Protection
Bind, validate, and protect API and session tokens.
Protected Areas
Lock down login, admin, checkout, and upload paths.
WAF Rules
Versioned, reversible policy and scoped exclusions.

Trust

Identity, access, and certificate trust at the edge.

Zero Trust
Verify every request before it reaches the origin.
Identity & NHI
Identity for users, services, and machines.
Machine Access
Scoped, token-bound access for services and agents.
Certificates & TLS
Certificate lifecycle, kept separate from enforcement.
Key Custody
Private keys never live in the enforcement layer.

Edge

Protection, routing, and acceleration at the edge.

Edge Network
Enforcement at the edge, before your origin.
CDN & Cache
Caching and acceleration as part of the protection layer.
Origin Protection
Shield and hide origins behind the edge.
Edge Health
Per-node health, freshness, and convergence signals.
Config Propagation
Event-driven policy rollout across the fleet.

Intelligence

Visibility, analytics, and security intelligence.

Security Analytics
Dashboards for traffic, detections, and outcomes.
Threat Intelligence
Cross-fleet signals and emerging-threat insight.
Events & Audit Logs
Queryable security events and an immutable audit trail.
Attack Insights
Top attacked endpoints, rules, and campaigns.
Reports
Scheduled, shareable security and usage reports.
Explore all productsSee pricing

One platform, separate components

An event-driven platform with a clean boundary

Every product is a single-responsibility component on a shared event bus. The enforcement layer performs pure traffic inspection; trust, certificates, analytics, and identity each live in their own component — so a change or failure in one never widens the blast radius of another.

Architecture diagram. Traffic flows from the Internet to ArxLayer Edge, through Coraza with the OWASP Core Rule Set, then to your origin application. ArxLayer Trust, Certificates, Analytics, Billing, and IAM/NHI are separate platform components. No private keys traverse the event bus or config bus.

Request path
Internet
Untrusted client & machine traffic
ArxLayer Edge
TLS termination & request enforcement
Coraza + OWASP CRS
Inspection & anomaly scoring
Origin App
Your application or API
Platform components — separate from enforcement
ArxLayer Trust
Key custody & trust bundles
ArxLayer Certificates
Certificate lifecycle & certificate refs
ArxLayer Analytics
Event intelligence & reporting
ArxLayer Billing
Usage & commercial metering
ArxLayer IAM / NHI
User, service & machine identity

Boundary guarantee: ArxLayer Edge performs pure traffic enforcement. Certificate lifecycle, key custody, analytics, and billing are separate components — and no private keys ever traverse the event bus or config bus.

ArxLayer architecture: traffic is enforced at ArxLayer Edge using Coraza and the OWASP Core Rule Set before it reaches your origin, while certificate lifecycle (ArxLayer Certificates), key custody (ArxLayer Trust), analytics, billing, and identity (ArxLayer IAM / NHI) remain independent platform components.
View architectureSee pricing

Secure by design

No private keys in the enforcement layer

ArxLayer enforces traffic policy and nothing else. Certificate lifecycle and key custody live behind their own boundaries, and no secrets ever travel the config bus.

No keys in enforcement

The enforcement layer stores no private keys or secret material — nothing sensitive to exfiltrate from the request path.

Opaque certificate references

ArxLayer references certificates verbatim and never resolves them to keys.

Refs, not keys, on the bus

The event bus carries certificate references and metadata only — never private keys.

Explore the ArxLayer platform

See how one event-driven platform protects every exposed surface — web, API, AI-agent, and bot — with trust, edge, and intelligence built in.

Start freeRequest demo