Built to be run for other people

Anyone can run this for themselves — one organisation, one edge, its own devices. But the shape of the system assumes a harder case, and that assumption is visible in the code rather than only in a description of it.

The harder case is a service provider — a telco, an ISP, a data centre operator, an MSSP — running one deployment for many customer organisations that must not be able to see each other. Almost everything awkward about the design exists because of that: whose certificate authority signs what, who is allowed to raise a limit, and what happens to a running deployment when a commercial relationship ends.

We do not operate anything

Lantern Networks does not run a service. The operator runs it — on their infrastructure, in their jurisdiction. That is not a business preference; it is the premise the software is written against, and it is why there is no control plane of ours anywhere in the path.

What that assumption looks like in the published code

Three of these you can read today. They are the parts of the operator model that live in the enforcement core rather than in the operations layer.

• Tenants have their own certificate authorities. The tenant CA registry is not a label attached to a shared root — each tenant's devices chain to that tenant's own authority. Compromising one does not extend to the next.
• Seats are divided by the operator, across tenants, from one pool. The package that does this opens by saying what it is for, which is as good a statement of the intended shape as any page can be:

  “Package seatallocation is how an MSSP divides the seats its licence grants among the tenants it operates.”

• There is no licence server. A licence is a signed file. An operator's deployment does not ask our permission to keep running and does not stop when we are unreachable — which is the only thing that makes "your infrastructure, your jurisdiction" mean anything. A licence may refuse new enrolments beyond its scope; it may not stop steering, cut flowing traffic, halt an edge, or disable features. You can check that rather than take it: the predicates that would do it exist and have zero call sites outside their own tests, and the absence is deliberate rather than unfinished.

Running it for yourself is not a lesser case

An organisation that wants this for itself alone can run it and pay nothing, forever. That is not a loophole left open — it is what makes the openness real. Apache-2.0 means exactly what it says, and a project that treated its own licence as a funnel would deserve none of the trust this site asks for.

What is not in this release

Isolation between tenants, the admin console, high availability and multi-region are all in the open-source scope — they are not a commercial tier and are not going to become one. Multi-region especially: it is where data residency actually gets delivered, and a sovereignty claim that stopped at one region would be decoration.

The status page says what has actually shipped, and it is the only place on this site that does. Nothing here asks you to infer the contents of a release from a description of the design.