Solutions · Hosting providers
Protection you can run across a fleet of customer-facing addresses
Hosting providers register the addresses they operate, verify each one, and manage them under one organization: shared policy, defined roles, an API and a record of every sensitive action.
Many customer-facing addresses
One organization, many endpoints, each one verified
A hosting provider's exposure is spread over many addresses, and any one of them can be the target. UMBREN models each as its own endpoint, so each has its own state, policy, telemetry and history.
One endpoint per address
An endpoint is one origin address, one protocol and a port or port range. The Multi-IP plan covers multiple endpoints in one organization.
Per-endpoint policy
A policy is scoped to the whole organization or to a single endpoint. State your default once, and write a separate policy where a service needs one.
Verified address by address
Ownership is verified for every address. A verified origin, protocol and port range can belong to only one endpoint.
Telemetry per endpoint
Bandwidth, packet rate, protocol distribution and allowed versus mitigated traffic are reported for each endpoint.
Register only infrastructure you own or are authorized to register. Registering a third party's infrastructure without authorization is prohibited by the Acceptable Use Policy.
Roles and teams
Access that matches how an operations team is organized
Network engineers, finance and support do not need the same permissions. Each member of an organization holds one of five roles.
- Isolated organizations. Each organization's data is isolated. A request for another organization's resource returns 404, the same as a resource that does not exist.
- Strong sign-in. Two-factor authentication with one-time recovery codes, a session list, and session revocation.
| Role | Access |
|---|---|
| Owner | Full control of the organization. |
| Admin | Members, infrastructure, policies, billing and settings. Cannot delete the organization or displace owners. |
| Engineer | Protected infrastructure, policies and notifications. May authorize activation. |
| Billing | Subscription, invoices and payment details. |
| Viewer | Read-only access to infrastructure, analytics and incidents. |
Audit trail
A record of who changed what, including us
When protection sits in front of your customers' services, you need to be able to answer for every change to it. UMBREN keeps that record for you.
- Append-only audit log. Sensitive actions are recorded in a log that is added to and never edited.
- Staff actions are included. Actions taken by UMBREN staff on your organization are recorded in the same log as your own team's.
- Activation is authorized by a person. A member with activation rights types the endpoint name to approve the change. API credentials cannot authorize activation.
- Policy history is permanent. Every policy change creates a new immutable version. A rollback restores an earlier version as a new one.
API-driven registration
Register endpoints from the systems you already run
The REST API covers endpoint registration, verification, policies, telemetry and incidents. An address added to your inventory can be registered with UMBREN in the same workflow.
- Scoped credentials. An API credential belongs to one organization and carries a role of viewer or engineer. It is shown once when it is created. API credentials are a plan feature.
- Predictable errors. Errors are JSON with a code, a message, field-level detail and a request identifier. Invalid lifecycle transitions return 409.
- Registration is not activation. A new endpoint starts in
DRAFT. Ownership still has to be verified, and a member of your team still has to authorize activation.
curl -X POST https://api.umbren.net/v1/orgs/{org}/endpoints \
-H "Authorization: Bearer $UMBREN_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"name": "customer-node-014",
"category": "generic_udp",
"origin_ip": "203.0.113.14",
"protocol": "udp",
"port_start": 27000,
"port_end": 27015,
"preferred_region": "auto",
"connection_requirements": "Instances on a contiguous port range.",
"protection_profile": "standard"
}'api.umbren.net is the planned production address of the API. 203.0.113.14 is a documentation address used as a placeholder. Reserved ranges are rejected, so use your own public address.
Planned
What is not available yet
Two capabilities matter to hosting providers and are not part of the product today. They are listed here so that you can plan around them, not so that you can buy them.
Routed-prefix protection
The Network plan is planned to add protection for routed infrastructure, with advanced network configuration and higher allowances. Today every endpoint is a single address, and a fleet is protected address by address.
Hosting-provider verification
An integration that lets ownership be verified through the hosting provider is planned. Today ownership is verified with the verification agent on the origin server, or by a manual request reviewed by UMBREN staff.
Bring your customer-facing addresses under protection
Create an account, register an endpoint and verify ownership. Protection is activated only after every check has passed and a member of your team has authorized the change.