Your network is yours.
No one else sees it until you say so.
InterLINK is a controlled wholesale exchange, not a public directory. Every operator’s inventory, pricing, and customer data is isolated from every other operator on the platform. Here is exactly how that works.
The short version
- Nothing about your network is visible to other operators until you publish a listing.
- Listings are either targeted (specific operators) or public (all approved buyers).
- Pricing and speed plans inherit the listing’s audience — outsiders never see them.
- You control a do-not-sell list and churn protection on top of any listing.
- RN-level visibility is approval-gated, per device, default-deny.
- Every secret is encrypted at rest. Every cross-tenant access attempt is audited.
Your tenant is isolated by default
Every API request, every database query, and every AI agent action is bound to your operator ID at the server. No other operator can see your inventory, devices, sites, sectors, pricing, or speed plans unless you publish a listing that explicitly includes them.
- Server-side tenant guard on every authenticated route — your operator ID comes from your session, not the request body.
- Database queries are hard-filtered by operator ID. Cross-tenant joins are blocked at the service layer, not just the UI.
- Audit trail captures every blocked cross-tenant request for your security team.
Listings: you choose who sees what
A listing is the only mechanism by which another operator can see any of your network capacity. Nothing is published until you say so, and listings come in two shapes.
- Targeted (private) listing — visible only to the specific operators you select.
- Public listing — visible to every approved buyer when you want maximum reach.
- Per-site control — every site or sector can have a different audience.
- Speed plans and pricing inherit the listing’s audience. Outsiders can’t see what you charge.
New listings do not go live immediately
A delayed-visibility scheduler holds new listings in a staging state for a short window before flipping them to visible — time to catch a wrong price, audience, or site before anyone else can see it.
- Listings move from staged to visible on a scheduled pass, not synchronously on save.
- You can edit or pull a listing in the staging window without anyone outside your tenant seeing it.
Do-not-sell controls and churn protection
Even on a public listing, you can prevent the marketplace from helping a competitor poach your own customers.
- Subscribers list (do-not-sell): lookups against your active addresses won’t return your listings to buyers.
- Churn protection: candidate sellers whose footprint matches the buyer’s lookup address are hidden by default.
- Win-back mode: optionally surface yourself as a re-acquisition path for recently disconnected customers.
- Partner exceptions: an explicit allow-list of trusted operators who bypass the gate.
RN visibility is approval-gated
If a buyer requests visibility into the specific RN devices serving an address on your network, the default answer is no. You explicitly approve or deny each request, per device.
- Default-deny posture — no automatic sharing of device-level data.
- Each approval is scoped to the requesting buyer and the specific RN, not a blanket grant.
- Approvals can be time-boxed and auto-expire.
- Every approve/deny decision is audit-logged.
Credentials and customer data are encrypted at rest
Every secret you give the platform — carrier API keys, RF engine keys, payment tokens, webhook signing secrets — is AES-256-GCM encrypted in the database. Plaintext is never returned to the UI.
- Carrier credentials are encrypted per operator and decrypted only at the moment of the outbound call.
- Payment card data never touches our servers — all gateways use hosted payment forms.
- Rotating a key invalidates the old ciphertext immediately.
Terms and NDAs round-trip with a full audit chain
Before data flows between two operators on a private listing, both sides sign. The negotiation surface captures every redline, counter-proposal, and acceptance in an immutable chain.
- Publish your own master service agreement or NDA template per operator.
- Counterparties accept the published version as-is or open a redlined negotiation round.
- Every round is preserved — you can always reconstruct what was agreed and when.
Audit trail you can query
Every state change that touches your tenant is captured: who did what, when, on which entity, and with what metadata — including blocked cross-tenant requests, listing publish events, RN visibility decisions, and credential rotations.
- Compliance-grade audit log scoped to your operator.
- Blocked cross-tenant access attempts are logged for your security team.
- Suspension events, plan changes, and admin actions on your tenant are all captured.
The same rules protect you as a buyer
Tenant isolation is symmetric. The protections above apply whether you’re the seller hosting capacity or the buyer reaching new addresses.
Your leads stay yours
Address checks you run against the marketplace are not exposed to sellers as a lead pipeline. Sellers see availability requests, not your customer roster.
Partner relationships are controlled
Pause your own team from quoting against a specific seller’s site or device with a sales freeze — without affecting any other operator.
Your pricing stays yours
Quotes you receive on a private listing are bound to the listing’s audience. Other operators in the same lookup don’t see what you were quoted.
Questions about how a specific control works?
We’ll walk you through tenant isolation, listing visibility, and the audit surface before you publish anything.