How it works.
A private network overlay that peers directly with your ISP. Your traffic enters our fabric at the first interconnect and stays there until it reaches its destination.
The short version
You keep your existing ISP — one of the providers we peer with directly.
At the peering edge, your traffic is handed off to our backbone. No public-internet detour.
On our backbone, traffic is encrypted with hybrid classical + post-quantum cryptography, routed on latency-aware paths, and inspected by our security stack.
At the egress, we deliver to the destination over the shortest measured path, not the shortest AS-path.
Architecture flow
Every packet traverses all five layers, in order, every time.
The components
Six functional layers that make up the platform. Every packet touches all of them, in order.
Ingress
Direct interconnect with your ISP at a Tier-1 facility. No last-mile from us; we don't run fiber to buildings. Your first hop out of your ISP is our edge.
Edge inspection
SASE functions run here: ZTNA policy, FWaaS rules, SWG filtering, CASB visibility, DLP enforcement, encrypted DNS resolution. Every flow is classified, policy-evaluated, and logged.
Core transit
Our own backbone, measured in real time for latency, jitter, packet loss, and peering capacity. Latency-aware routing overlays re-select paths on the order of seconds when the internet weather changes.
Cryptographic layer
Hybrid TLS 1.3 key exchange: X25519 + ML-KEM (FIPS 203). Signatures using ML-DSA (FIPS 204) where supported, falling back to classical ECDSA where not. SLH-DSA (FIPS 205) for firmware and code signing.
Threat analytics
Behavioral baselines per user, per device, per workload. Deviation triggers enrichment, scoring, and — for high-confidence events — autonomous containment.
Egress
Policy-driven exit selection. Traffic can leave on the nearest peer, the lowest-latency peer, or a peer in a specific jurisdiction — your policy, your call.
Who this is for
We're a premium network overlay, not a retail ISP. We don't sell last-mile connectivity, and we don't bolt onto arbitrary broadband lines. We partner with a defined set of ISPs we interconnect with directly, and we only onboard customers who already have service from one of those ISPs.
If your current ISP is on our partner list, you can use 101 Bits.
If it isn't, we can't help you — honestly.
What this isn't
Not a VPN.
VPNs are client-side, per-device, and typically add latency. Our overlay is negotiated at the peering layer, transparent to devices, and usually reduces latency.
Not a replacement ISP.
You keep your existing ISP. We're the layer between that ISP and the rest of the internet.
Not a managed firewall vendor.
The security stack is part of the transit, not a separate product bolted on.
Interconnected ISP Partners
Ask us anything.
An architect — not a sales rep — will answer within one business day.