Platform Architecture & Core Features

Technical breakdown of our distributed edge proxy, caching mechanics, and security controls

Engine Architecture

High-Concurrency Edge Reverse Proxy with NVMe Cache Tier

Engineered with Go & OpenResty for sub-10ms response times and multi-terabit edge distribution.

HTTP/1.1 · HTTP/2BGP AnycastNVMe Storage

Regional Origin Shield Tier

Origin Offload

Consolidates cache misses across designated Shield POPs in Singapore (SIN), Frankfurt (FRA), and New York (NYC). Instead of thousands of edge requests hitting your customer origin, only the designated shield POP requests the resource, reducing origin egress costs and server load by up to 90%.

# Multi-tier shield forwarding logic: client -> edge_pop (cache miss) -> regional_shield (SIN/FRA/NYC) -> origin_server

Single-Flight Request Coalescing

Zero Stampedes

When an uncached or expired asset is concurrently requested by hundreds of users, our in-memory mutex locks subsequent requests. Only 1 request goes upstream to your origin server; all waiting clients are served from the newly cached NVMe response.

// Go singleflight coordination: res, err, _ := sfGroup.Do(cacheKey, func() { return fetchFromOrigin(r) })

Enterprise PCIe NVMe Disk Caching

Sub-10ms Reads

Content is stored directly on high-speed PCIe NVMe drives with byte-range slicing for video streaming (MP4, HLS, DASH) and dynamic revalidation headers (ETag, If-Modified-Since).

GET /videos/product-demo.mp4 HTTP/1.1 Range: bytes=0-1048575 HTTP/1.1 206 Partial Content X-Cache: HIT (NVMe Slice 0)

Sub-200ms Global Cache Invalidation

NATS JetStream Mesh

Purge single URLs, wildcard directory prefixes (/images/*), or entire zones simultaneously across all 9 worldwide edge nodes in under 200ms via our decentralized pub/sub messaging mesh.

curl -X POST https://zevcdn.com/v1/zones/{id}/purge \ -H "Authorization: Bearer <API_KEY>" \ -d '{"type":"prefix","targets":["/images/*"]}'

Smart Query String Normalization

Hit Ratio Boost

Strip unnecessary tracking tags (utm_source, gclid, fbclid) or alphabetize parameters before computing the SHA-256 cache key, maximizing edge hit ratios and saving bandwidth.

Raw: /shop?utm_source=ad&id=42&sort=asc Key: SHA256(/shop?id=42&sort=asc)

Edge WAF, IP CIDR Blocks & Rate Limiting

Edge Security

Enforce token bucket rate limiting per IP (RPS), instantly block abusive CIDR subnets at the edge with HTTP 403, and prevent image hotlinking with strict HTTP referer enforcement.

IP 198.51.100.0/24 -> 403 Forbidden Rate > 100 RPS -> 429 Too Many Requests Referer: evil-site.com -> 403 Blocked

Automated Let's Encrypt SSL & SNI

TLS 1.3 / Zero-RTT

Custom domains (e.g. cdn.yourbrand.com) automatically receive free Let's Encrypt TLS certificates. Certificates renew automatically every 60 days with dynamic SNI at the edge.

DNS CNAME: cdn.mystore.com -> cname.zevcdn.net SSL: TLS_AES_256_GCM_SHA384 (HTTP/2 + HTTP/3)

Decentralized Crypto Billing via NOWPayments

Non-Custodial

Pay for monthly bandwidth allocations in USDT (TRC20), Bitcoin, Ethereum, or Solana. On-chain deposits trigger cryptographically verified HMAC-SHA512 webhooks to renew quotas instantly.

Gateway: NOWPayments.io Currencies: USDT (TRC20), BTC, ETH, SOL Verification: HMAC-SHA512 x-nowpayments-sig