A white-label Class 4 switch, yours to resell.

Everything a carrier desk runs on, sharing one call record.

Routing, rating, debugging and billing read the same CDR, so the number on the invoice matches the call you can trace.

Routing, rating and balance leases

One call record per call, rated by one authority. End-to-end tests follow a call from the first INVITE to the ledger.

Portal

One portal for the whole desk, reading the platform's own data: trunks, vendors, routes, rates and call records.

01 — Debug

Astra gives every call a full trace.

Open any Call-ID to see the SIP message sequence, media quality, post-dial delay and the routing decision that picked the vendor. Download the .pcap when you need the packets.

Call inspector

A SIP ladder, .pcap download, media quality and the routing decision for any call.

02 — Route

Least-cost routing with guardrails.

Margin floors, and quality-based sorting where you turn it on. A sell rate below cost or under its floor waits for finance approval. Vendors that fail health checks leave the route automatically and return when they recover.

03 — Bill

Rated as each call ends.

Every CDR carries its revenue, cost, margin and the deck versions behind them, all from one rating authority. Each call spends against a balance lease, so with no lease a call is refused, except an emergency call. Vendor invoices are matched line by line against Astra's own record of each call.

{
  "call_id":  "7f3a9c21-4be0-a8e4",
  "dest":     "+442079460018",
  "duration": 212,
  "sell":     { "deck": "RESELLER-A v14" },
  "buy":      { "deck": "VENDOR-A v9" },
  "margin":   "31.1%",
  "stir":     "A"
}

04 — Protect

Fraud rules that act on their own.

Burst detection on high-risk prefixes, spend caps and blocklists, checked across every node. When a rule fires, Astra responds in steps, from an alert to a throttle to a block, and tells you by signed webhook.

Fraud controls and webhooks

Velocity checks across nodes, spend caps, blocklists and high-risk destination lists. Webhooks are signed with HMAC-SHA256 and every delivery goes through an SSRF guard.

Heimdall scoring

Heimdall, Lunar's sister product for call security, can score a call at admission, before STIR/SHAKEN signing. The step is optional and off by default, and if Heimdall cannot answer in time the call carries on under Astra's own rules. Emergency calls (911, 933) and calls to the 988 crisis line are never scored, delayed or blocked by Heimdall. False answer supervision detection runs in shadow first.

05 — Resell

Your brand, your rates.

Each reseller gets a portal in its own brand, sets its own markup, builds its own sell decks and can create sub-resellers. The account above sets each account's credit limit, never the account itself.

Resellers, markups and sell decks

A tenant tree of any depth, brand theming per tenant, markups and a sell-deck builder.

Portals on your own domain

Each reseller's portal on a domain of its own.

How Astra runs.

We manage Astra for you, from the edge nodes to the control plane. You bring your carriers, numbers, STIR/SHAKEN certificates and brand. We bring the hardware. Early access is open: request it at hello@lunarsystems.io.

Hosted edge

SBC and Class 4 switch on bare-metal servers we manage. Routing decisions happen right on the edge node.

Active/standby SBCs

Astra's edge runs SBCs as active/standby pairs: when one is contained, its peer takes the calls.

STIR/SHAKEN

Calls signed with each tenant's own certificate, and the signatures on incoming calls verified at the edge.

Tenant isolation and audit

Every tenant table is isolated in the database, every request is permission-checked, and the audit log is append-only and hash-chained with signed anchors.

US compliance

Robocall Mitigation Database checks, CPNI access logging and US telecom tax on invoices.

911

Built so an emergency call from an identified source always routes, even with a zero balance, a suspension or a fraud lock, and is never billed.

Each call spends against a balance lease, so with no lease a call is refused, except an emergency call.

Emergency calls (911, 933) and calls to the 988 crisis line are never scored, delayed or blocked by Heimdall.

Signalling, media, identity and integration.

SIGNALLING

SIP over UDP, TCP, TLS

MEDIA

RTP relay, SRTP, G.711

IDENTITY

STIR/SHAKEN signing with your own certificate

INTEGRATION

REST API, signed webhooks, MCP