A web application firewall that keeps your traffic and TLS keys with you.

Self-hosted: a Rust data plane, a Go control plane and a web console that run on your own infrastructure.

TeichionWeb application firewall

How it is built

The data plane is written in Rust.

The control plane is written in Go; the console is a React web application.

Who it is for

Teichion is for organisations that run their own infrastructure and have to keep web traffic and TLS keys in-house — including the teams that maintain ModSecurity and OWASP CRS rule sets by hand today.

How Teichion runs

Self-hosted web application firewall: a Rust data plane, a Go control plane and a web console that run on your own infrastructure. Your traffic and TLS keys stay with you.

The Teichion console Overview page for a non-production environment: the last-24-hour activity summary, the event trend, and the action and severity breakdowns, with the non-production environment indicator. — The Teichion console, running on infrastructure you control.

What it does today

Imports SecLang rules and lists the constructs it does not support.
Includes rules from OWASP CRS v4.0.0.
Per-policy rate limiting at the application layer.

Sign-in and identity

Single sign-on through your OIDC identity provider.

There is no in-app MFA enrolment in this release.

What we do not claim

Client IP addresses are stored pseudonymised (hashed); password, token, cookie and session values are redacted before storage.
One organisation per install.
There is no in-app MFA enrolment in this release.
We publish no efficacy, performance or coverage numbers.