CAPABILITIES

Emergency

Under attack right now?

It’s 2:25 AM. Credential stuffing is hammering the login route, stored value is draining, and your team is awake because the pager went off. You do not have time for a demo call.

The target journey is to prepare a verified domain in about 30 minutes. That browser protection journey is not currently available: automatic proof issuance, attachment and renewal are absent. A manually minted proof is for controlled testing, not a production browser integration.

Not live yet. Public production is currently in outage. This page describes the lane and its limits; it is not a window you can start tonight. The signup below points to the MANDATE dashboard. Restoring production alone will not complete the missing browser integration.

Start emergency protection

The target signup-to-protection journey

This is an illustrative target, not a currently available rollout. Timing depends on DNS, framework integration and the missing browser proof-delivery path.

  1. ~2 min

    Sign up

    No card, no sales gate, no review queue in this lane. It assumes you do not have time for any of those.

  2. ~5 min

    Verify your domain

    One DNS TXT record. Enforcement stays locked until ownership passes; that check is what keeps a free emergency tier from becoming an attacker’s tool.

  3. ~10 min

    Install

    Review the source-package guide for your framework and start in observe mode. Keep the app secret on your server; it is shown once at creation.

  4. ~10 min

    Enforce on the attacked routes

    The target is one bounded route with a working browser proof-delivery path. Until that path exists, test only with callers you control; enforcement denies legitimate callers without proof.

  5. ongoing

    Watch

    Review window availability separately from origin enforcement. End stops new issuance and requests managed rollback; change your own middleware to observe or remove it separately.

02:47
account created, no card
02:51
domain verified (DNS TXT)
02:58
framework integration prepared in observe
03:09
target: proof delivery and bounded enforcement
03:15
target: window and origin status reviewed

Free, deliberately temporary

MANDATE Emergency is designed for a time-limited response on a verified domain. A window is available once per domain; it does not by itself confirm that protection is installed.

Designed as a 48-hour window

One window per verified domain, no card, no review step, when that entitlement is actually live. Public production is in outage; do not treat this page as a live 48-hour offering.

Hour 48 is designed to end with a baseline

A report, not a cliff, is the contract we are building to: what the attack looked like, what your normal traffic looks like, and the next actions we would take. It is a design contract, not a shipped artifact.

Then convert or drop to observe

Explore hosted verification for ongoing protection, or return your middleware to observe and review the evidence. The Emergency window does not renew for the same domain.

What the offline token does — and what it deliberately does not

MANDATE Emergency verifies short-lived proofs in your backend with your site secret, without calling MANDATE in the verification path. This local check has different limits from ongoing hosted verification.

What it does

  • Verifies locally in your backend with your site secret; no callback to MANDATE in the verify path.
  • Keeps enforcing on already-issued tokens while our edge is unreachable.
  • Short-lived (minutes), bound to one route class and one window, fail-closed exactly where you choose.
  • No network call in the request path.

What it does not do

  • Stateless: a captured token can be replayed inside its TTL.
  • No revocation: a leaked token lives until it expires.
  • No cross-referencing: no replay markers, lineage, or session trust. That is the hosted stack’s job.
  • Automatic browser proof issuance, attachment and renewal are absent. A manually minted test proof does not complete a production integration.

Full product access