A dedicated, isolated CDN network for enterprises that require private asset delivery. Dedicated PoP capacity, private BGP peering, access control, and a 99.99% SLA — fully separated from our public CDN infrastructure.
How it works
Who else is on the hardware, what happens to a request that should not be served, and how the traffic reaches you at all. The rest of the capability list is in the spec table below.
Isolation
On a shared edge your assets sit in the same cache and behind the same bandwidth as every other tenant, which means someone else's traffic event is your latency problem. A private plane is dedicated capacity at each PoP: your own cache, your own egress, nobody else routed through it.
$ opncdn pops --plane private POP TENANT CACHE EGRESS STATEFRA you (sole) 412 GB dedicated readyAMS you (sole) 388 GB dedicated readyHEL you (sole) 401 GB dedicated readyZRH you (sole) 395 GB dedicated ready shared tenants on these nodes: 0
Access
Most CDN content is protected by being hard to guess. Private treats every request as unauthenticated until it proves otherwise: a signed token, an address on the allowlist, a client certificate we can verify, or all three. Anything that fails is refused at the edge and never reaches your origin.
10:14:02 GET /vault/q4.pdf token valid exp +212s src 203.0.113.44 allowlist hit mtls CN=acme-app-01 verified 200 served from FRA (cache hit) 10:14:07 GET /vault/q4.pdf token expired 403 refused at edge - origin not contacted
Routing
Delivery is only half the path. Private peers directly into your VPC and on-premises network over BGP, so the hop between your origin and our edge is a private one. You can announce your own prefix through our AS if you would rather keep the addresses you already have.
your origin 10.20.0.0/16 on-prem + VPC | | BGP session private path vopncdn edge FRA / AMS / HEL / ZRH public internet exposure of origin: none
Getting started
Dedicated capacity and a BGP session are not things you click into existence, so this one starts with a conversation about sites and routing. Four steps from there.
Which PoPs you want capacity in. You are the only tenant on the ones you take.
FRA · AMS · HEL · ZRHA BGP session into your VPC or on-premises network, so origin fetches never touch the public internet.
BGP session → your ASNSigned tokens, an IP allowlist, client certificates, or a combination. Enforced at the edge.
token + allowlist + mTLSA CNAME per hostname. Certificates are issued and renewed for you, including for private hostnames.
Specifications
Everything the private plane does that did not need a paragraph above. If something you need is missing from this list, it is missing from the product.
Before you buy
That the PoP capacity is dedicated to you rather than shared. Your cache, your egress, no other tenant routed through the same nodes. It is the difference between a floor in a building and a desk in an open-plan office: on a shared edge someone else's busy day changes your cache hit rate, and on a private one it cannot.
Same software, same sites, different tenancy and different guarantees. The public network is a shared pool with a 99.9% SLA and no peering requirement. Private gives you dedicated capacity, BGP peering into your own network, edge-enforced access control and a 99.99% SLA with credits. If you do not need those, the public network is the cheaper and correct answer.
Yes. If you hold a prefix you would rather keep, it can be announced through our AS so the addresses your clients already trust are the ones serving. If you do not, you use ours and nothing changes for you operationally.
Availability below 99.9% in a month triggers service credits against that month. The credit is applied to the invoice rather than being something you have to chase, and the measurement is ours to publish, not yours to prove.
Access logs stream to your SIEM in CEF, JSON or syslog format. They stay on EU or Swiss infrastructure in transit and at rest, and there is no US transfer in the path. If you want them nowhere but your own collector, that is the configuration.
Yes, for environments where internet breakout is not permitted at all. It runs the same delivery software with no public path, reached only over the private peering. It is a scoped engagement rather than a checkbox, so it starts with a conversation.
Pricing is custom based on capacity, regions, and SLA requirements. Contact us to design your private CDN deployment.