Heimdallby Lunar Systems
The watchman of the network
Heimdall scores every call as it crosses the network, fingerprints what callers can't fake, and acts on the ones that shouldn't get through.
Built and tested. Not yet in production service.
Illustrative: the sky behind this is a simulated call, not real traffic.
The phone network still takes a caller's word for who they are. A number is typed in, not proven.
Robocallers rotate numbers faster than blocklists can list them, and spoof whatever looks trustworthy: your bank, your neighbour, your own area code.
Signed caller identity helps, but only where it's present and actually checked.
Static lists always lose. They block yesterday's number.
Illustrative: the waveform behind this section is a simulated call.
The web solved this years ago: a security layer at the edge that recognises clients by what they can't disguise, learns from everything it sees, and decides in milliseconds. Heimdall brings that idea to voice.
A caller controls its number and its name. It doesn't control how its phone system builds call identifiers, orders its headers, or sends audio. The truth is in the disagreement: a caller that claims to be one thing while its signals say another.
Heimdall checks the signature on the call's STIR/SHAKEN identity, including whether the signing certificate has been revoked, and trusts only the signer it actually verified.
Every call is scored while it's being set up, within a 40 ms budget. If Heimdall can't answer in time, the call proceeds under your own rules, untouched.
A number gains or loses reputation only when its identity was verified. A spoofed call can't damage the real owner of the number it borrowed.
The network's own defences (rate limits, allow-lists, bans) do their job first.
Heimdall's 28 layers score the call before it's connected. Watch only, flag, or block: you choose.
Astra's admission step is off by default. In Astra's first release, scores flag; only hard stops block.Media signals, such as whether audio flows both ways.
Every record is analysed, and vendors are compared with their peers over the hour, day and week.
Signaturehd1:id0-st.a7-bh3-nw.rh-md.1w
ResultFour layers disagree with the claim: flag
Illustrative: not a real call, number or signature. Media signals feed vendor analysis, not the call-time score.
The verified signer, its certificate chain and revocation, and whether the calling number matches what was signed.
How the caller's phone system generates branch IDs, call IDs and tags, and the order it writes headers in. Compiled phone systems can't easily change this.
Velocity, sequential dialling, neighbour spoofing, short calls.
Where the call comes from, conditioned on who's calling: a carrier interconnect isn't judged like a remote handset.
Network data from open sources only.Who answers, whether audio flows, how it's packetised.
A caller can claim to be anything. It can't make all five agree.
Robocall campaigns rotate numbers, but they reuse infrastructure: the same phone systems, the same signers, the same routes.
Heimdall keys what it learns to what persists (the signer, the route, the stack) rather than a number that will be gone tomorrow.
Carriers are never punished for their customers. On a carrier interconnect, Heimdall looks through the peer to the originator and never learns reputation on the carrier itself.
Registered phones, remote extensions and softphones behave like web clients. Heimdall learns on network identity here.
Carrier trunks carry many customers' calls. Heimdall reads the call, not the pipe.
28 layers, in four groups, on every call
Caller ID, STIR/SHAKEN attestation and the certificate behind it.
Velocity, sequential dialling, neighbour spoofing, short calls.
IP, carrier and phone-system fingerprints.
Do-Not-Call, TCPA calling hours, consent.
Both directions: robocalls out, fraud in.
Watching every callRolling out · shadow first
Heimdall reads Astra's call records and events and sends fraud signals back. Astra's fraud guard applies its graduated response (alert, throttle, block). Nothing in the call path changes.
At call admissionBuilt · off by default
Optional, off by default: a check before STIR/SHAKEN signing, per customer and per trunk, from shadow to dry run to live.
StandaloneBuilt
A native module for open-source PBXs.
Heimdall is a Lunar Systems product, and Astra, Lunar's hosted carrier platform (in development), is its first integration.
Heimdall compares each vendor with its peers: instant answers, no ringing first, very short billed calls, vendor-side releases, silent or one-way audio. Suspect vendors are flagged before they cost you money.
| Vendor | Signal | Window | Against peers | Verdict |
|---|---|---|---|---|
| Vendor C | Instant answers | Last hour | Above peers | Flag |
| Vendor A | One-way audio | Last day | In line | OK |
| Vendor F | Very short billed calls | Last week | Far above peers | Block |
| Vendor D | Vendor-side releases | Last hour | In line | OK |
| Vendor B | No ringing first | Last day | Above peers | Flag |
Emergency calls (911, 933) and calls to 988 are never scored, delayed or blocked by Heimdall.
Nothing is blocked until you decide: shadow → dry run → live.
If Heimdall can't answer in time, the call carries on under your existing rules.
Callers who withhold their number stay private in every customer view, and withholding never counts against them.
An append-only, hash-chained audit of every decision.
Built and tested. Not yet in production service.
Talk to us about a pilotOr write to hello@lunarsystems.io