Decide before
you serve.
An open decision layer that judges every request — bots, scrapers, abusers, brute-forcers — in less than a millisecond, and lets the rest pass.
How it works
Three steps. No infrastructure to run.
Acrossed is a hosted decision engine. You send us a request fingerprint, we answer in under a millisecond. There's nothing to deploy and nothing to scale on your end.
- 01
Install the SDK
One package per language — Node, Python, or Go. Get an API key and an HMAC signing secret in under a minute.
- 02
Define your rules
Block IP ranges, geos, paths, headers. Add per-IP rate limits. Combine in any order — first match wins.
- 03
Get sub-ms decisions
Every request to your app calls /check. We return ALLOW or DENY, signed. You enforce — we just decide.
Security model
Cryptographically sound. Deliberately stateless.
We're a security layer, so the security has to be the boring part. Here's exactly what we do — no buzzwords, no certifications we don't have.
AES-256-GCM at rest
Your rules and signing secrets are encrypted before they touch the database. The encryption key never leaves the engine process.
HMAC-SHA256 in flight
Every response is signed with your project's secret. The SDK verifies before honouring — so a man-in-the-middle can't forge an ALLOW.
Stateless on your traffic
We never persist request bodies, headers, or response payloads. /check carries a small fingerprint that we evaluate and forget.
Fail-open by default
If our API is unreachable, the SDK returns ALLOW so an Acrossed outage cannot take your app down. Flip a flag to fail-closed if you want stricter behaviour.
From the teams using it
Built for engineers who read the code.
“We were rebuilding our auth stack and needed rate limiting without adding Redis to the mix. Acrossed was three lines of middleware and we were done. The latency headroom is negligible.”
“The fail-open default is exactly the right call. Our security vendor should never be the reason our app goes down. We ship with Acrossed in front of every internal service.”
“I read the entire SDK source before using it. It's 180 lines. No magic, no hidden network calls. That's rare in the security space and it matters a lot to us.”
- 10,000 decisions / month
- Up to 5 active rules
- Default <slug>.acrsd.dev subdomain with TLS
- AES-256-GCM encrypted rule storage
- HMAC-SHA256 signed responses
- JS, Python, and Go SDKs
- 1,000,000 decisions / month
- Up to 100 active rules
- Up to 3 custom domains with on-demand TLS
- Country-level geo blocking
- Per-IP rate limiting at engine speed
- Pay-as-you-go: $0.10 / extra 1K
- 10,000,000 decisions / month
- Up to 500 active rules
- Up to 10 custom domains with on-demand TLS
- Country-level geo blocking
- Per-IP rate limiting at engine speed
- Pay-as-you-go: $0.08 / extra 1K
- 50,000,000 decisions / month
- Up to 2,500 active rules
- Up to 25 custom domains with on-demand TLS
- Audit log export (CSV, JSON)
- Multi-region routing (US + EU)
- Pay-as-you-go: $0.05 / extra 1K
- Priority chat support