Trust

Your private keys never live in the enforcement layer

ArxLayer separates custody from inspection. A dedicated trust boundary owns your private keys, while the WAF and edge see only references, never the material itself. The component that touches every request holds nothing worth stealing.

Start free Explore the platform

The problem

The layer that handles every request is the one you can't fully trust with keys

Edge enforcement runs hot, scales wide, and is exposed to the public internet. Putting private key material there spreads your most sensitive secrets across the largest, most reachable surface you operate.

Keys spread to the edge

When the enforcement layer holds private keys, every edge node becomes a copy of your most sensitive material across a wide, public-facing fleet.

One breach, total exposure

If the component inspecting traffic also stores keys, a single compromise of that layer can hand an attacker both your traffic and your secrets.

No clean security boundary

Mixing inspection and custody in one process means there's no line you can audit, no place where responsibility for keys clearly ends.

What you get

Custody and enforcement, kept apart by design

ArxLayer draws a hard line between the component that owns your keys and the component that inspects your traffic. That separation of duties is built into the architecture, not bolted on.

Keyless enforcement layer

The WAF and edge hold no private keys. The part of the platform exposed to every request stores nothing worth stealing.

A dedicated trust boundary

A separate component owns key custody, isolated from inspection so responsibility for secrets lives in one auditable place.

References, not keys, on the bus

The config bus carries certificate references, never the underlying key material. Rolling out policy never moves a secret.

Bounded blast radius

Compromising an edge node exposes traffic at that node, not your private keys. The boundary contains the damage.

Multi-tenant isolation

Custody is scoped per tenant. One customer's keys are never reachable from another customer's enforcement path.

An auditable seam

Because custody and inspection are distinct, you can reason about exactly what touches a key and what does not.

How it works

Separation of duties, end to end

Keys stay behind the trust boundary. The enforcement layer works with references and never holds the material.

Custody stays behind the boundary

Private key material is owned by a dedicated trust component, isolated from the layer that inspects traffic.

Only references propagate

Config rollout sends certificate references over the event-driven bus. The keys themselves never travel with policy.

Enforcement runs keyless

The edge enforces your policy on every request while holding no private keys, keeping a clean, defensible security line.

Start free Request demo

FAQ

Questions, answered

Does the WAF ever hold my private keys?: No. The enforcement layer stores no private key material. Custody lives behind a separate trust boundary, and the edge only ever works with references.
What actually travels over the config bus?: Certificate references and policy, never the private keys. Rolling out a configuration change does not move any secret material.
What happens if an edge node is compromised?: The blast radius is bounded to traffic at that node. Because no keys live in enforcement, a node compromise does not expose your private key material.
How is this different from a normal WAF?: Many setups put TLS keys in the same layer that inspects traffic. ArxLayer keeps custody and inspection separate, so the most exposed component holds nothing worth stealing.

Explore

Keep your keys out of the line of fire

See how ArxLayer separates custody from enforcement, so the layer that handles every request holds no private keys.