Every call kept safe, from edge to core.

Three rules the network is built on.

A voice network meets the open internet on every call: floods, scanners, password guessing against SIP accounts, toll fraud. These rules decide how every layer is built.

1. Hardware is our job.

   Tenants bring their carriers, numbers, certificates and brand. We look after the servers.

2. Nodes only dial out.

   Each edge node opens its own encrypted, mutually authenticated connection to the control plane. The control plane never reaches in to a node, and the node's image carries no remote shell to reach.

3. People approve. Machines can't.

   Releasing or re-imaging a node that detection has flagged takes a signed approval from a named person. No control-plane service holds a key that could sign it.

Follow a call inward.

Five rings, from the open internet to the people who approve. A call is decided at the outer ring; the inner rings hold the records, the keys and the approvals.

1. 01 Edge

   Point of presence

   The edge runs SBCs in active/standby pairs: when one is contained, its peer takes the calls. The firewall admits only known SIP peers, the SBC checks every message, and routing is decided right here.

2. 02 Fabric

   An outbound-only link

   Each node dials out to the control plane over an encrypted, mutually authenticated link. Call records, signed configuration and health data travel over it. The control plane never dials in.

3. 03 Control

   Control plane

   Routing data, rating, call records and the audit log. Tenant isolation is enforced in the database, every request is permission-checked, and the audit log is append-only and hash-chained.

4. 04 Keys

   Signing and approval keys

   Each tenant signs its calls with its own STIR/SHAKEN certificate. Approval keys are non-exportable and sit in a separate key store that only the approval signer uses, on a network of its own.

5. 05 People

   Named approvers

   Releasing or re-imaging a flagged node, and opening break-glass access, need a named person's own WebAuthn assertion, with user verification. Every signature is logged, append-only.

The edge appliance: sealed, signed and read-only.

The SBC at a point of presence is where every call's signalling and media arrive. We build it as a sealed appliance, not as a server someone logs in to.

What every call meets

• A default-deny firewall that admits only known SIP peers.
• Flood detection, plus size and sanity checks on every message.
• A method allowlist and call-rate caps on every trunk.
• Bans after repeated failed digest logins.
• TLS 1.2 or later for encrypted signalling.
• Media accepted only from the source the call negotiated.

What the machine is

1. Secure Boot enforcing Lunar's own keys
2. A signed boot image with kernel lockdown
3. A read-only root verified against a signed hash as it is read
4. One writable volume encrypted with a key sealed to the TPM
5. Secrets in memory decrypted only into memory-backed storage

No remote shell in the image. Updates land in a spare A/B slot and roll back on their own if the new version fails its checks. Releases are signed, ship with a software bill of materials, and need two people.

Getting into a running node is the exception.

There is no everyday login to an edge node: access is break-glass only, and it takes two people, a signed grant and a recording.

1. Request A person asks for access to one node, with a reason and a time limit.
2. Approve A separate security approver agrees, or it goes no further.
3. Sign The grant is signed, and the node verifies the signature before it opens anything.
4. Record The session runs in a recorded shell, streamed off the node over the connection the node itself opened.
5. Expire They connect with a short-lived certificate, and the grant has its own time limit.

People approve. Machines can't.

• Each approval needs the approver's own WebAuthn assertion, with user verification, bound to a hash of the exact command. The approver sees exactly what is signed.
• Adding or removing an approver needs two other approvers as witnesses.
• Machine secrets are kept in a self-hosted secrets store, with one short-lived identity for each machine or job. Tokens are minted by a person, never by automation.

Watching every machine, and the watchers.

Detection is self-hosted and open source, so host telemetry never leaves Lunar's own systems. There is no cloud-hosted endpoint detection (EDR) service.

When an SBC is flagged

1. Watch File-integrity and runtime-behaviour monitoring on every SBC.
2. Flag A finding on an SBC starts containment automatically.
3. Fail over Its peer in the pair takes the calls.
4. Quarantine The flagged SBC passes only emergency and inbound calls.
5. A person decides Release, or re-image from the known-good image, only with a person's signed approval.

• No detection or response ever stops the SBC's call software directly.
• Isolating any machine whose loss would block a tenant's calls needs a person's approval.
• Every automatic action is audited, can be reversed, and pages a person at Lunar. A missing heartbeat or a stopped agent is an alert in itself.

Emergency calls go first.

911 and 933 skip every credit, spend and fraud check, and route when everything else fails.

From any known trunk or account, an emergency call skips credit checks, spend caps and fraud locks, and routes even when the account is suspended. It keeps working through every containment state, quarantine included. If the SBC cannot reach its own decision service, emergency calls route from data held on the SBC itself.

Calls carry their identity.

US voice runs on trust between carriers. Calls are signed on the way out, and blocks are answered the way the FCC's rules require.

• Each tenant signs its calls with its own STIR/SHAKEN certificate, not a shared one, and the edge checks the signatures on incoming calls.
• A call blocked on the strength of analytics is answered with SIP 603+, which carries a redress contact, so whoever placed it knows where to dispute the block.

How customer data is handled

• Call records, phone numbers, recordings and configuration are all treated as customer proprietary network information (CPNI).
• Access to CPNI is logged with a stated purpose. Exporting it needs a CPNI permission and a fresh step-up sign-in.
• Each tenant's data is kept apart in the database itself, and every request is permission-checked.

Host telemetry

Never leaves Lunar's own systems.

Backups

Encrypted on our servers before they go off-site.

Web traffic

Our public websites are served through a content delivery network, which terminates TLS for them. Calls bypass it entirely: signalling and media go straight to our SBCs.

Outside providers

Emergency location updates and notification email go through outside providers.

Heimdall

Heimdall's endpoints are pass-through by rule, so no third party can decrypt the call metadata sent to it.

Registering our own ASN and IP space.

Lunar is registering its own autonomous system number (ASN) and its own IP address space, so the network is addressed and routed as ours, end to end.

Why it matters: registering our own address space is what lets network-level DDoS scrubbing sit in front of our voice points of presence.

The network grows one point of presence at a time, and every one is built the same way.

Check it yourself on lunarsystems.io.

In place since 24 September 2026. Anyone can check these from outside with standard DNS and TLS tools.

DNSSEC

The domain is DNSSEC-signed, so a validating resolver can detect a forged answer.

HTTPS only

Plain HTTP is redirected to HTTPS.

TLS

TLS 1.2 is the minimum version, and TLS 1.3 is on.

CAA

CAA records limit which certificate authorities may issue certificates for the domain.