Delivery · Enterprise
opncdn Private a CDN with capacity that’s only yours
For organisations that need to deliver files privately. You get dedicated capacity at each PoP, private BGP peering, access control at the edge, and a 99.99% SLA, fully separate from the public opncdn network.
- dedicated capacity
- Isolated
- BGP peering
- Private
- availability SLA
- 99.99%
- pricing
- Custom
Isolation, access control, and peering
Who else uses the hardware, what happens to requests that shouldn’t be served, and how traffic reaches your network. The rest is in the specifications below.
Isolation
Dedicated capacity at every PoP
On a shared CDN, your files share a cache and bandwidth with every other customer, so another customer’s traffic spike can slow you down. Private gives you dedicated capacity at each PoP, with your own cache and egress and no other traffic routed through it.
- Dedicated cache and egress at each PoP
- Another customer’s traffic can’t evict your cached files
- Purge and warm affect only your objects
$ opncdn pops --plane private POP TENANT CACHE EGRESS STATEFRA you (sole) 412 GB dedicated readyNBG you (sole) 396 GB dedicated readyFSN you (sole) 401 GB dedicated readyHAM you (sole) 388 GB dedicated readyZRH you (sole) 395 GB dedicated ready shared tenants on these nodes: 0
Access
Every request is checked at the edge
On most CDNs, content is protected only by a URL that’s hard to guess. Private refuses every request that doesn’t pass the checks you choose: a signed token, an allowlisted IP address, a verified client certificate, or all three. Requests that fail are refused at the edge and never reach your origin.
- Signed URLs with an expiry, scoped to a path
- IP allowlists enforced at the PoP, not at your origin
- mTLS with your own CA when a token isn’t enough
10:14:02 GET /vault/q4.pdf token valid exp +212s src 203.0.113.44 allowlist hit mtls CN=acme-app-01 verified 200 served from FRA (cache hit) 10:14:07 GET /vault/q4.pdf token expired 403 refused at edge - origin not contacted
Routing
Private peering to your network
Private connects to your VPC and on-premises network directly over BGP, so traffic between your origin and our edge stays off the public internet. If you want to keep your existing IP addresses, you can announce your own prefix through our AS.
- BGP peering into your VPC or on-premises network
- Origin fetches travel the private path, not the public internet
- Bring your own prefix and announce it through our AS
your origin 10.20.0.0/16 on-prem + VPC | | BGP session private path vopncdn edge FRA / NBG / FSN / HAM / ZRH public internet exposure of origin: none
Set up with our team
Dedicated capacity and a BGP session can’t be set up in the console, so we start by talking through sites and routing with you. After that, there are four steps.
- 01
Choose the sites
Pick the PoPs you want capacity in. You’re the only tenant on each one.
FRA · NBG · FSN · HAM · ZRH - 02
Set up peering
A BGP session into your VPC or on-premises network, so origin fetches never touch the public internet.
BGP session → your ASN - 03
Choose how requests are authorised
Signed tokens, an IP allowlist, client certificates, or a combination, all enforced at the edge.
token + allowlist + mTLS - 04
Point your hostnames at it
Add a CNAME per hostname. Certificates are issued and renewed for you, including for private hostnames.
Full specifications
Everything Private includes. If a feature isn’t listed here, we don’t offer it.
Capacity
- Model
- Dedicated per PoP
- Shared tenants
- None
- Sites
- fra-1 · nbg-1 · fsn-1 · ham-1 · zrh-1
- Custom prefix
- Announced via our AS
- Air-gapped option
- No internet breakout
Access control
- Encryption
- TLS 1.3 + mTLS
- Authentication
- Token · IP · mTLS
- URL signing
- Scoped, with expiry
- Enforcement point
- At the edge
- Origin exposure
- Private peering only
Service level
- Uptime SLA
- 99.99%
- Credit threshold
- Below 99.9%
- Support response
- Under 15 min
- DDoS capacity
- 10 Tbit/s
- NOC
- 24/7, named engineer
Logs and data
- Log formats
- CEF · JSON · Syslog
- SIEM delivery
- Streamed
- Data residency
- EU / CH only
- US transfer
- None
Common questions
What does “private” mean here?
The capacity at each PoP is dedicated to you. You get your own cache and egress, and no other customer’s traffic goes through those nodes. On a shared CDN, another customer’s busy day can lower your cache hit rate. On Private, it can’t.
How is this different from the public opncdn network?
Both run the same software at the same sites. The public network is shared, has a 99.9% SLA, and doesn’t require peering. Private adds dedicated capacity, BGP peering into your network, access control at the edge, and a 99.99% SLA with credits. If you don’t need those, the public network costs less.
Can I use my own IP addresses?
Yes. If you have a prefix you want to keep, we can announce it through our AS, so your clients keep using the addresses they already know. Otherwise, you use ours.
What does the SLA pay out?
If availability falls below 99.9% in a month, you get service credits for that month. We apply them to the invoice automatically and publish the measurement ourselves, so you don’t have to prove the outage.
Where do the logs go?
Access logs stream to your SIEM in CEF, JSON, or syslog format. They stay on EU or Swiss infrastructure in transit and at rest, and nothing is sent to the US. If you want them stored only in your own collector, we can set it up that way.
Is there an air-gapped option?
Yes, for environments that don’t allow any internet breakout. It runs the same delivery software with no public path and is reached only over private peering. Each air-gapped setup is scoped individually, so contact us first.
Ask for a quote
Pricing depends on capacity, sites, and SLA. Tell us what you deliver and to whom, and we’ll design the setup and send you a price.