Product Update: July 2026

Our last update in April covered end-user authentication arriving in the pilot. Since then, the work has centered on a different question: once your traffic and your users are on the platform, how do you see what is happening, and why should you trust what you see? Three months later we have good answers, and they are live.

See exactly what your traffic is doing

The Console now has a Usage view: requests, data in and out, sign-ins, and registrations, per organization, project, and environment, with time-range controls.

The numbers are in neutral units, deliberately. We meter first and price later, so when pricing arrives you will already know exactly what your workloads consume. And every organization sees only its own usage; the boundary is enforced on the server, not in the browser.

Know whose fault it is

Every response that crosses the edge is now attributed to where it originated: your backend, or our platform. When something breaks, the platform tells you which side of the line it broke on instead of leaving you to correlate logs across two systems.

The new Status view puts that attribution next to live health: whether each outbound connector (Warpgate) is connected and when it was last seen, per-environment and per-route health, and error rates split platform versus customer. The 2 a.m. question, “is this outage mine or theirs,” now has a dashboard answer.

As part of the same work, a service that times out behind your connector returns an honest 504 instead of a generic 502, on a branded diagnostic page.

Your monitoring, not ours

Warpgate can now expose a standard Prometheus metrics endpoint: request rate, latency, sizes, upstream health, tunnel connections and reconnects. It is off by default, uses standard reverse-proxy metric names, and reports nothing back to us. Your traffic telemetry belongs in your monitoring stack, so we made that the easy path.

Promises, continuously proven

We say that credentials never travel past the edge, and that your application receives identity as trusted headers. Saying it is easy. Now every deployment proves it: an automated check drives authenticated traffic through a live tunnel and verifies that requests arrive with the correct identity headers, that session and API-token requests resolve to the same user, that sign-out genuinely ends the session, and that no credential we issue reaches your upstream. If any of that regresses, the deployment does not ship.

The same quarter closed out the security-header posture at the edge: every response from customer endpoints now carries the platform security-header set, including error pages and hosted sign-in pages, with HTTP Strict Transport Security on by default. A third-party review of the whole system was completed and its findings addressed. We also hardened tenant isolation so that organization-scoped resources cannot be referenced across organizations at all, closing a gap our own review found before any customer could.

Reliability work you should never notice

A lot of unglamorous work went into failure recovery this quarter, and we are glad it did.

The platform database now survives all of its members restarting at once and re-forms itself without an operator. Availability monitoring pages us within minutes if sign-in or registration breaks, driven by a continuous black-box probe of the real public flow. And our nightly resilience suite runs genuinely destructive failure drills against staging, with restoration safety rails, as a release gate.

We would rather find these failure modes ourselves, repeatedly, than have a pilot customer find one once.

Console quality

Routes and environments are now edited on full pages with proper tabs (routing, access, headers, and a separate danger zone) instead of cramped dialogs, with unsaved-change protection throughout. The Console also adopted the brand design system, so what pilot teams use today looks like what we will ship at launch.

Toward October

Next up: more ways to sign in, for both Console operators and end users, and continued pre-launch hardening. The public launch is October 2026. Until then, pilot projects are where the platform earns its claims against real traffic.

If you are building a customer-facing app or API and want ingress, auth, and edge security to be one layer instead of a vendor list, we would like to hear from you.