Use Cases

Who is Airlock Microgateway for?

Teams who don't want to run WAF infrastructure themselves

We operate, monitor and patch the Gateway infrastructure. You still configure and maintain your own WAF rules through the Airlock resources in your own namespace, tailored to your application.

Kubernetes-native architectures

Runs sidecarless via the Kubernetes Gateway API, directly inside your Managed Kubernetes cluster, instead of as an upstream external service.

Regulated industries

The WAF inspection takes place in your cluster in our Swiss data centres, not in an external service in front of it. This matters for industries with data location requirements.

Applications with identity requirements

OIDC- and JWT-based access control right at the Gateway, without running an additional reverse proxy component.

Managed Services

What we provide, what you control

We operate the Airlock Microgateway operator and the Gateway infrastructure, you attach your applications using standard Gateway API resources and define your own security policies.

Features in detail

Setup & operations: We install the Airlock Microgateway operator on your Managed Kubernetes cluster and create one or more Gateways in the Nine-managed nine-system namespace, each with its own load balancer IP and stable hostname.

Certificates: Let’s Encrypt ClusterIssuers for your domains, issued and renewed automatically.

Attachment: You create ListenerSet and HTTPRoute resources in your own namespace to attach your application to the Gateway and route traffic.

Operations & maintenance: Monitoring, patching and license management of the operator are on us, not on you. You don’t need to build or maintain in-house WAF expertise on your team.

Features

What Airlock Microgateway can do

Protection against web attacks

Protection against the OWASP Top 10, including DoS limits, header filtering and CSRF protection, plus JSON parsing for structured attack detection.

API specification enforcement

Validation of OpenAPI specifications and GraphQL schemas, so only requests that match your API definition get through.

Sidecarless Gateway API integration

Configured exclusively through the Kubernetes Gateway API, no sidecar container needed in your application pods.

Identity-aware proxy

OIDC relying party support, token introspection and JWKS-based JWT validation with claims- and path-based access control right at the Gateway.

Identity propagation

Identity information is passed through to your backend, for single sign-on without an extra component of your own.

Custom responses & observability

Define your own error pages and responses, every request logged in structured form and, with Loki enabled, visible directly in Grafana.

Architecture

How it all fits together

Airlock Gateway

Managed Kubernetes

Runs in the Nine-managed nine-system namespace on your Managed Kubernetes cluster

Your application

Attached via ListenerSet & HTTPRoute in your own namespace

Loki & Grafana

Access logs and observability, if enabled on your cluster

The application, the WAF inspection and the underlying hardware all run on the same Nine-owned infrastructure in Swiss data centres.

Pricing

What does Airlock Microgateway cost?

from CHF 427.–/ month Up to 1 million requests per month, cumulated across all production gateways.
CHF 520.– per month, up to 2 million requests
CHF 720.– per month, up to 5 million requests
CHF 933.– per month, up to 10 million requests

Staging and test environments have their own tiers, from CHF 42.70 per month (up to 1 million requests, cumulated across all non-production gateways). You can find all tiers in the Price Calculator. For more than 10 million requests per month, contact us.

Infrastructure & Compliance

Built on trusted Swiss infrastructure

ISO certified

We are certified to ISO 9001 and ISO/IEC 27001 for quality management and information security, this also covers the infrastructure your Managed Kubernetes cluster runs on.

No third-country transit

No US or other third-country provider sits between the Gateway and your backend.

Swiss product

Airlock Microgateway is a Swiss security solution from Ergon, which we operate on our own Swiss infrastructure.

Our own hardware, not a hyperscaler

Your Managed Kubernetes cluster runs on our own hardware in Swiss data centres, without rented hyperscaler compute in the background.

Getting Started

How it works

Airlock Microgateway is not currently self-service, setup happens together with us.

1. Get in touch – tell us about your expected request volume and requirements.

2. Setup by us – we install the operator and create one or more Gateways on your Managed Kubernetes cluster, including automatic TLS certificates.

3. Attachment by you – you create ListenerSet and HTTPRoute resources in your own namespace and define your security policies.

4. Operations – we take care of monitoring, patching and license management for the operator.

Ready to protect your applications with Airlock Microgateway?

We'll discuss, without obligation, whether and how Airlock Microgateway fits your Managed Kubernetes cluster.

Request a consultation