AIN
NYC AIN
Private networks & diverse backup

Built for private APN. Perfect as backup.

NYC AIN was designed from the ground up as a private LTE/5G operator — our own spectrum, our own core, our own SIMs — not as a resold consumer plan. That same architecture makes AIN a physically-diverse backup path for enterprises whose primary circuit is fiber or cable.

Qualify an address Start a private-network quote
01

Failover-grade broadband

Physically diverse from fiber & cable
AIN rides B41 (2.5 GHz) over the air from AIN-owned macro sites — no shared conduit, no shared last-mile pole, no shared central office. When a contractor cuts a Verizon or Optimum lateral, AIN keeps working.
Own spectrum, own core
Licensed 2.5 GHz and a dedicated packet core mean AIN is not competing with mobile subscribers for capacity during commuter peaks. Backup that only works at 3am is not backup.
SD-WAN & IPsec ready
AIN CPE presents a clean Ethernet handoff into your existing SD-WAN edge (Fortinet, Palo, Meraki, Velocloud, Cato). BFD, IPsec, and BGP over the tunnel all work out of the box.
02

Common failover topologies

Active / passive
Fiber primary, AIN backup
SD-WAN edge tracks the fiber path with BFD; failover to AIN in <1 second when the fiber goes down. AIN stays idle until called.
Users → SD-WAN ┬─ Fiber (primary) ──→ HQ / cloud
               └─ AIN B41 (standby) ─→ HQ / cloud
Active / active
Dual-transport load balance
Both circuits carry traffic simultaneously. Cloud & SaaS steer to whichever path has better loss/jitter in the last 200ms — AIN typically wins for real-time voice during cable congestion.
Users → SD-WAN ═══ Fiber ═══╗
               ═══ AIN B41 ═╬══→ HQ / cloud
Out-of-band
Management-plane lifeboat
AIN carries only console, IPMI, and orchestration traffic. If the production network goes dark, network engineers still reach every switch, firewall, and hypervisor over AIN to fix it.
Prod fabric ──✕──  (down)
OOB switch → AIN B41 → NOC jump host
Site-to-site
Private mesh between NYC sites
Multiple retail / clinic / job-site locations join the same private APN. Traffic stays inside the AIN core — never touches the public internet — with a single ACL policy applied network-wide.
Site A ─┐
Site B ─┼→ AIN private APN → HQ router
Site C ─┘
03

Private-network capabilities

Private APN
Named APN scoped to your account. Your SIMs never touch the public APN or the public internet unless you explicitly route them there.
Custom IP addressing
Bring your own RFC1918 range (or /29–/24 public). Devices get static or DHCP-reserved addresses inside your plan — no CGNAT, no double-NAT.
Traffic isolation
Per-tenant VRF on the AIN core. Cross-tenant leakage is not possible at the fabric layer, not just at the firewall.
Handoff options
Ethernet (Q-in-Q or access VLAN), IPsec to your edge public IP, or GRE. Cross-connect at 60 Hudson or 111 8th on request for enterprise builds.
Direct-to-cloud
Peering to AWS Direct Connect / Azure ExpressRoute / GCP Partner Interconnect — your SIM traffic reaches your VPC without transiting the public internet.
SIM lifecycle API
REST endpoints to activate, suspend, and rotate SIMs; assign to device pools; and pull per-SIM usage. Fits into fleet-management tooling.
Device policy
Per-SIM QoS class, upload/download caps, and destination allowlists enforced at the core — not on the device.
On-premise slice (roadmap)
For campuses that need coverage inside a building or lot, a private AIN small-cell can extend the same APN indoors while remaining part of your slice.
04

Who buys this

Retail & QSR
  • ·POS + payment isolation
  • ·PCI-scope reduction via private APN
  • ·Failover during store-open hours
Healthcare
  • ·EHR/Epic backup path
  • ·HIPAA-scoped VRF
  • ·Telemetry off the public internet
Financial services
  • ·Branch office diversity
  • ·Out-of-band for trading floor
  • ·Cross-connect at 60 Hudson
Construction & job sites
  • ·Temporary private APN
  • ·Rooftop Pro at the trailer
  • ·Same SIMs move site-to-site
Media & production
  • ·Field bonding over B41
  • ·Isolated APN for camera IP
  • ·No commodity ISP contention
Municipal / public safety (non-FirstNet)
  • ·Camera & sensor backhaul
  • ·Kiosk & signage fleet
  • ·Private addressing plan
05

What's included in a private-network deployment

Included at every site
  • Address qualification + RF report (this site's tools)
  • SIM provisioning against your private APN
  • Ethernet handoff to your firewall / SD-WAN edge
  • Static IPs or DHCP reservations from your plan
  • 24/7 NOC with AIN-owned RAN + core visibility
  • Per-SIM usage & alarms in the customer portal
Available as add-ons
  • Rooftop Pro directional install (harder addresses)
  • IPsec / GRE tunnel to a cloud VPC or DC
  • BGP peering + /29 or /28 public block
  • Cross-connect at 60 Hudson / 111 8th Ave
  • Managed SD-WAN edge (Fortinet / Meraki / Cato)
  • SIM-lifecycle API access
Next step

Get an RF report, then scope the private-network deployment.

Every private-network engagement starts with the same address qualifier — we won't quote a slice we can't deliver.

Qualify addressQuote intake