---
title: "Edge Resiliency: What We Rebuilt"
description: How direct-to-region endpoints and bypass keep our API reachable if an edge provider outage occurs.
image: https://blog.basistheory.com/hubfs/Edge%20Resiliency.webp
---

[Skip to content](https://blog.basistheory.com/edge-resiliency-what-we-rebuilt#main-content)

![Basis Theory logo](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=365&height=122&name=BTLogo%20(1).png)

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)

Open main navigation

Close main navigation

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)
- [Get a demo](https://basistheory.com/contact)

[Login](https://portal.basistheory.com/)

[Get a demo](https://basistheory.com/contact)

 October 27, 2026

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) ·

[Engineering](https://blog.basistheory.com/tag/engineering)

# Edge Resiliency: What We Rebuilt

![Edge Resiliency ](https://blog.basistheory.com/hubfs/Edge%20Resiliency.webp)

## Table of Contents

- [History Repeating Itself](https://blog.basistheory.com/edge-resiliency-what-we-rebuilt#History)
- [Was Was Built for Edge Protection](https://blog.basistheory.com/edge-resiliency-what-we-rebuilt#Built)
- [What Edge Protection Means for Our Customers](https://blog.basistheory.com/edge-resiliency-what-we-rebuilt#Protection)
- [Why This Was Stage 1 of Edge Protection](https://blog.basistheory.com/edge-resiliency-what-we-rebuilt#Stage)

When we couldn’t route around a Cloudflare outage, we rebuilt how our API gets traffic.

After the November 2025 Cloudflare outage, Basis Theory built direct-to-region API endpoints, each with its own failover, and an emergency path that sends traffic straight to our own infrastructure. If our edge provider goes down, we can keep the API online with a DNS change and no code change for you.

Here is that story.

In November of 2025, [Cloudflare had a global outage](https://blog.cloudflare.com/18-november-2025-outage/). For about six hours, most requests to Basis Theory were failing, as they were to a broad swath of the internet, including ChatGPT, Spotify, and Discord. At one point, Cloudflare returned errors for 100% of our inbound traffic.

Our infrastructure remained healthy, with capacity to spare. And yet our [vault](https://basistheory.com/platform), [card management](https://basistheory.com/add-ons), and [Elements](https://developers.basistheory.com/docs/concepts/elements) were all unreachable because every customer request needed to pass through Cloudflare before getting to us. Our synthetics kept flickering green, and each recovery read like the end of it rather than a lull. That cost us time. Even our status page was down, and we couldn’t tell customers what was happening.

After an hour, there was no ambiguity left. This was a total outage, and we had to plan for bypassing Cloudflare completely.

The fix wasn’t obvious, but this post explains what we changed, and what you need to do about it. If you’re running EU tenants, skip to the section about what this means for you. There’s action for you.

## History Repeating Itself

In August of 2025, a [single Cloudflare location degraded](https://blog.cloudflare.com/cloudflare-incident-on-august-21-2025/), and the impact was mostly on traffic coming from us-east-1 impacting U.S. customers. Some saw it clearly, while many didn’t see it at all.

We had the right ideas at the time, and a clear line-of-sight to preventing this from happening again:

- Build a redundant path that doesn’t depend on one edge provider.
- Consolidate our ingress so failing over became one operation instead of six.
- Split the API into per-region hostnames so each region can fail over on its own.

Customers could move themselves if they want to. We started on this work and when the November outage occurred, the pieces were in flight but nothing was finished to change the outcome.

Our architecture had no state in which we could fully state "Cloudflare is not in the path.”

It wasn't a setting we had turned off. It was a mode we had never built.

A single hostname, api.basistheory.com served every tenant in every region. Requests arrived at the edge, and the edge read each one to decide where it should go. U.S. tenants to the U.S., EU tenants to the EU, test tenants to our test environment. That decision was made by inspecting the request at Layer 7, on every call.

![Edge Resilience Old Setup](https://blog.basistheory.com/hs-fs/hubfs/Edge%20Resilience%20%E2%80%94%20Old.png?width=1500&height=578&name=Edge%20Resilience%20%E2%80%94%20Old.png)

Everything about that picture is fine until the box in the middle stops working. Because the region was decided inside the request path, there was no way to take that box out. Point the DNS record somewhere else and you don't just lose the edge, you lose the routing.

Over time the edge had also accumulated more than 18 path-specific rules layered on top of that steering, sending different URL paths to different backends. Each layer was reasonable when it was added. Together they were hard to reason about during an incident. ;

Complexity wasn't just an aesthetic problem. It was producing real defects in the layer we were most dependent on.

[Return to Top](https://blog.basistheory.com/edge-resiliency-what-we-rebuilt#TOC)

## What Was Built for Edge Protection

The change is easier to describe than it was to do. Instead of one hostname that has to be inspected to figure out where it goes, there are now hostnames that already say where they go.

api.us.basistheory.com resolves to the U.S. api.eu.basistheory.com resolves to the EU. No inspection, no rule evaluation, no decision to make. The destination is settled before the request is ever looked at.

Three things worth pointing out.

1. Each region is a separate path, end to end. Its own hostname, its own health-checked load balancer, its own origins across two AWS regions with automatic failover between them. A problem in one region's path doesn't touch the other's, and neither does a fix.
2. api.basistheory.com still gets inspected. We did not break it, and we are not deprecating it. It remains the default endpoint, and it operationally resolves to the U.S. But it's a compatibility endpoint now, and that distinction matters because it's the reason for the one action we're asking EU customers to take. That action is explained in the next section below.
3. The test endpoint is already running this way. api.test.basistheory.com was migrated onto the new architecture first, deliberately, because during the November outage test tenants were down for the entire incident with no alternate path at all. The hostname didn't change and nothing in your test integration needed to move. It just sits behind a health-checked load balancer now instead of a single static mapping.

None of this helps if recovering the API only recovers part of the API. Every service that serves public API traffic now sits behind regional load balancers in each region, and the routing path that used to happen at the edge happens there instead. One entry point per region, one failover operation, and all of the API on the other side of it.

That had a second effect we didn't fully appreciate going in.

Moving those responsibilities onto our own regional gateways meant a large amount of routing logic stopped living in a vendor's configuration. Fewer moving parts at the edge, fewer things to replicate if we ever move the edge, and less that has to keep working for us to serve a request.

Because each regional hostname already names its region, we can change where it points without losing anything.

![Edge Resilience New Setup](https://blog.basistheory.com/hs-fs/hubfs/Edge%20Resilience%20%E2%80%94%20New.png?width=1500&height=390&name=Edge%20Resilience%20%E2%80%94%20New.png)

In normal operation, traffic flows through the edge and gets everything the edge is good at. In an emergency, we can send a region's traffic directly to our own infrastructure instead, with a DNS change and no code change on your side.

It's per-region. Moving the US doesn't move the EU, and vice versa. During the November outage that distinction didn't exist: we had one lever, it covered everything at once, and it didn't work.

This is a real procedure now, not a diagram. It's automated, it runs in a fixed order with health verification between each step, it requires approval to run against production, and every run leaves an audit trail.

[Return to Top](https://blog.basistheory.com/edge-resiliency-what-we-rebuilt#TOC)

## What Edge Protection Means for Our Customers

Most of this changed nothing for you. api.basistheory.com works exactly as it did. If you do nothing, nothing breaks.

There is one exception, and it's important.

### If you have an EU tenant, please move to api.eu.basistheory.com

This one isn't optional, and here's the mechanical reason.

- When an EU tenant calls api.basistheory.com, the request reaches the EU because the edge reads it and sends it there. That routing happens inside the edge proxy. Take the proxy out of the path—which is exactly what an emergency bypass does—and the routing goes with it. EU traffic arriving on the shared hostname has nowhere to go.

So the compatibility endpoint works for EU tenants, right up until the moment you'd most want it to. That routing only holds while the edge is healthy. It's the one thing we're asking EU customers to do, because it's the one thing we can't do for you.

api.eu.basistheory.com has no such dependency. The hostname resolves to the EU, so the region survives a bypass and your traffic keeps its regional guarantees.

Moving is a configuration change:

- SDK Users: Set the region to EU.
- Elements (web, React Native, iOS, Android): Set the region option to eu. This matters more than it looks, and there's more on what it covers just below.
- Direct HTTP integrations: Change the base URL to https://api.eu.basistheory.com.

Nothing else about your integration changes. Same API, same keys, same behavior.

### If you have a US tenant, you can move, but you don't have to.

api.basistheory.com defaults to the U.S., and a U.S. bypass covers the compatibility hostname along with the regional one. So this traffic fails over either way.

If you'd like to drop the edge dependency for routing anyway, api.us.basistheory.com is there and it's a one-line change. We'd encourage it. We're not going to tell you it's urgent, because for U.S. tenants it isn't.

### If you use test tenants, nothing changes.

Keep using https://api.test.basistheory.com. There are no regional test endpoints. Test runs in a single region, and a configured region is ignored rather than pointed at a hostname that doesn't resolve.

### If you use Elements, set a region there too.

[Elements](https://developers.basistheory.com/docs/concepts/elements) are two things: the script and secure iframe your checkout page loads from js.basistheory.com, and the API calls that iframe makes to tokenize a card. A region affects the second one.

[Return to Top](https://blog.basistheory.com/edge-resiliency-what-we-rebuilt#TOC)

## Why This Was Stage 1 of Edge Protection

The goal of this work wasn't to move off Cloudflare. We use them because they're good, and the November outage was an unusually bad day for a service that primarily has good days.

The goal was to be able to act. On that November morning we knew what we wanted to do well before we could try it, and when we finally tried, it did nothing. Six hours of outage, and not one of them was spent on a fix that was available to us.

It's worth being precise about why, because it's the part we're still working on. Our routing and our DNS lived inside the same system. When that system failed, the routing was stuck where it was, and the DNS change that should have let us route around it had to be honored by the very thing that was failing.

Two levers, one failure domain, neither of them any use.

Since then, the work has been pulling pieces out of the edge one at a time. Path routing moved onto our own regional gateways. Regional selection moved into DNS. Service ingress consolidated behind infrastructure we control. Every piece that comes out is one less thing that has to be healthy for us to serve a request, and one less thing to rebuild if we ever put a different edge in front.

The end state is an edge and a DNS layer that are genuinely independent of each other, so that losing one never costs us the ability to move away from it.

We're not there. But that's the direction, and it's the same principle underneath all of it: abstract our providers far enough that no single one of them is a total failure mode for our customers.

Questions about migrating, or which region your tenant is in? [support@basistheory.com](mailto:support@basistheory.com).

[Return to Top](https://blog.basistheory.com/edge-resiliency-what-we-rebuilt#TOC)

[![View an Interactive Demo   See how the Basis Theory platform secures payment data and significantly reduces PCI compliance burden from day 1.  ](https://no-cache.hubspot.com/cta/default/22332934/interactive-171495116167.png)](https://blog.basistheory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLNJ1utfWPRddkkEn%2BfBTfpBP6Nup6NLmSNZ4KVdG9Ewxdpl8jArrrlvH6MScMwkWyjhAqxIh4VYI7uNQz93cUPAeSO6aKaaRmQQKq7Jw%2BTnSMnemL7pPsFw6vcvcOH0DcwAsR1t8ZQ90yaaFtst0Dp61CAQHRtdk36piYu4eTRciMyhKFrU2SW0UhYDTRulJK7gJ0d375qznWVErHlTdHDzGtp%2FSiNolT6spXwq0p9vUe4fsl5zg%3D%3D&webInteractiveContentId=171495116167&portalId=22332934)

## Related posts

[![PCI 4.0 Updates: What this means for merchants](https://blog.basistheory.com/hubfs/pci-4-updated-requirements-merchants.webp)](https://blog.basistheory.com/pci-4.0-updated-requirements-merchants)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [PCI 4.0 Updated Requirements: What This Means for Merchants](https://blog.basistheory.com/pci-4.0-updated-requirements-merchants)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 March 19, 2024

[Read more](https://blog.basistheory.com/pci-4.0-updated-requirements-merchants)

[![PCI DSS Requirement 12: Maintain an Information Security Policy](https://blog.basistheory.com/hubfs/pci-dss-requirement-12.png)](https://blog.basistheory.com/pci-dss-requirement-12)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [PCI DSS Requirement 12: Maintain an Information Security Policy](https://blog.basistheory.com/pci-dss-requirement-12)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 November 1, 2023

[Read more](https://blog.basistheory.com/pci-dss-requirement-12)

[![PCI DSS Requirement 10: Track and Monitor Network Access](https://blog.basistheory.com/hubfs/pci-dss-requirement-10.png)](https://blog.basistheory.com/pci-dss-requirement-10)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [PCI DSS Requirement 10: Track and Monitor Network Access](https://blog.basistheory.com/pci-dss-requirement-10)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 October 17, 2023

[Read more](https://blog.basistheory.com/pci-dss-requirement-10)

## Stay Connected

### Receive the latest updates straight to your inbox

### Follow on Social

<https://www.linkedin.com/comm/mynetwork/discovery-see-all?usecase=PEOPLE_FOLLOWS&followMember=colinthomasluce>

[![BTLogo (1)](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=138&height=46&name=BTLogo%20(1).png "BTLogo (1)")](https://basistheory.com)

- Use Cases 
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Remittance](https://basistheory.com/use-cases/remittance)
    - [Subscription Platforms](https://basistheory.com/use-cases/subscriptions)
    - [Online Travel Agencies](https://basistheory.com/use-cases/travel)
    - [Vertical SaaS](https://basistheory.com/use-cases/vsaas)
- Developers 
    - [Quickstart](https://developers.basistheory.com/getting-started)
    - [Elements](https://developers.basistheory.com/docs/sdks/web/javascript)
    - [Documentation](https://developers.basistheory.com/)
- Basis Theory 
    - [Pricing](https://basistheory.com/pricing)
    - [Add-Ons](https://basistheory.com/add-ons)
    - [ROI Calculator](https://go.basistheory.com/roi)
    - [Case Studies](https://blog.basistheory.com/case-studies)
    - [Blog](https://blog.basistheory.com)
    - [Contact](https://basistheory.com/contact)
- Other 
    - [Terms and Conditions](https://basistheory.com/resources/terms-of-service)
    - [Privacy Policy](https://basistheory.com/resources/privacy-policy)
    - [Cookie Policy](https://basistheory.com/resources/cookie-policy)
    - [Security](https://basistheory.com/security)
    - [System Status](https://status.basistheory.com/)
- Compare 
    - [Basis Theory Vs. Evervault](https://go.basistheory.com/evervault-alternative)
    - [Basis Theory Vs. IXOPAY](https://go.basistheory.com/alternative-to-ixopay)
    - [Basis Theory Vs. VGS](https://go.basistheory.com/compare/very-good-security)

---

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Basis Theory",
    "url" : "https://blog.basistheory.com/author/basis-theory-team"
  },
  "dateModified" : "2026-10-27T13:16:23.106Z",
  "datePublished" : "2026-10-27T13:16:00.000Z",
  "headline" : "Edge Resiliency: What We Rebuilt ",
  "image" : [ "https://blog.basistheory.com/hubfs/Edge%20Resiliency.webp" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.basistheory.com/edge-resiliency-what-we-rebuilt",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.basistheory.com/hubfs/BTLogo%20(1).png"
    },
    "name" : "Basis Theory"
  }
}
```