OEM URL Filtering Licence: Embed Our Category Database in Your Product
Give your firewall, DNS filter, gateway or app a category engine your customers can trust. You license the data, run it inside your own systems and keep full control of the product experience.
License the database Compare licence modelsWho an OEM URL filtering licence is for
Any company that sells a product which allows, blocks or reports on websites by category. If category data is a feature your customers expect but not a thing you want to build, this licence fits.
Firewall vendors
Next-generation firewalls and UTM appliances that need category-based policy rules.
- Local category cache on the appliance
- Cloud lookup for unknown domains
DNS filter providers
Resolvers that answer, block or redirect by category before a connection opens.
- Category per domain at resolver speed
- Daily new-domain coverage
SWG and SASE platforms
Secure web gateways and edge services that enforce URL policy for distributed teams.
- Multi-category ranking for nuanced rules
- Mapping to labels admins already use
Browser isolation
Isolation products that decide which sites to render remotely and which to allow directly.
- Risk categories for isolation triggers
- Content categories for reporting
MSP and RMM portals
Managed service platforms that offer web protection to many client tenants from one console.
- One dataset, many tenant policies
- Category reports per client
Parental control apps
Home and family apps that need age-appropriate categories on phones, tablets and routers.
- Compact on-device category lists
- Adult, dating, gambling and more
Edtech and school filters
Classroom and student safety tools that must block content in line with school policy.
- CIPA-relevant category set
- AI tools category for classroom rules
ISPs and telecoms
Network-level filtering offered to households or business subscribers as a value-added service.
- Carrier-scale lookups from local files
- Group-wide licence across brands
Already serving one of these markets? See the vendor views for MSP web filtering, ISP web filtering and cybersecurity vendors.
What is delivered with the URL filtering licence
You receive data and access, not a black box. Everything below is part of a standard licence; the scope of each item is agreed per deployment.
| Deliverable | What it contains | How teams use it |
|---|---|---|
| Full database file | Every licensed domain with its categories, ranked by how much of the site each category describes | Initial load into your category store, appliance image or resolver |
| Daily delta files | About 300,000 newly registered domains a day, plus re-checks after a week and after a month | Keep new domains covered between monthly refreshes |
| Monthly refresh | Updated categories for all other domains | Replace or merge into the full table on a schedule you control |
| Lookup API | Category answers for single domains or batches | Fallback for domains not in your local subset, support tools, admin consoles |
| AI tools set | 16,000+ AI-tool domains in 18 categories, updated daily | AI usage policies, shadow AI reports, classroom rules |
| Validation reports | Measured accuracy from regular manual validations, including the CIPA categories | Quality evidence for your product team and your own customers |
File formats and export options
Core files come as CSVParquetJSON. Licensed customers can also receive category exports shaped for enforcement points.
Hosts filesDNS RPZAdGuard / Pi-hole listsFirewall EDLPAC files
For what each export looks like, read our guide to DNS blocklist formats. The full category list is on the web filtering categories page.
Looking for a web filtering SDK?
Many teams search for a web filtering SDK and expect a library to drop into the build. We take a different path, and for most products it is the simpler one.
Data plus API (what we deliver)
- Plain files your engineers can read in any language
- You choose the storage: hash table, key-value store, SQL, embedded index
- No third-party code inside your binary, no extra licence audit for code
- Works offline, on-premise and air-gapped
- The lookup API covers what your local copy does not
Closed SDK (what we do not ship)
- A compiled library tied to specific platforms and versions
- Upgrades depend on the SDK release cycle
- Memory and lookup behaviour decided by someone else
- Harder to inspect, test and certify
If you need help designing the lookup layer, our team can talk through common patterns with your engineers. The API documentation shows request and response shapes.
Licence models: internal, OEM and group-wide
Every licence lets you use the categories in the way agreed. None of them allow resale or publication of the raw data.
For your own network
For organisations that filter, analyse or report on traffic inside their own company.
- Corporate web filtering and reporting
- Security analytics and threat hunting
- Data enrichment for internal teams
- Starter tiers available
Inside a product you sell
For vendors whose customers see category decisions, policies or reports powered by our data.
- Categories exposed as product features
- Your brand, your console, your policy model
- Data stays inside your product, never resold raw
- Quoted per deployment
Several products, one contract
For companies with more than one product line, brand or regional subsidiary.
- One licence across business units
- Shared update feed and API access
- Simpler procurement and renewal
- Quoted per group structure
| Question | Internal | OEM / embedded | Group-wide |
|---|---|---|---|
| Customers see category decisions | No | Yes | Yes, across products |
| Runs on-premise or air-gapped | Yes | Yes | Yes |
| Lookup API included | Yes | Yes | Yes |
| Daily delta files | By scope | Yes, typical | Yes, typical |
| Raw data resale or publication | Not allowed | Not allowed | Not allowed |
How OEM pricing is structured
An OEM quote reflects how the data is used, not a fixed price list. These are the factors we look at with you.
Data scope
Top 20 million domains or the full 120 million, filtering categories only or with IAB categories.
Product type
Appliance, cloud service, mobile app or router firmware each use the data differently.
Distribution
Where the data lives: your cloud only, or copied to devices at customer sites.
Update cadence
Daily delta files, weekly bundles or monthly refreshes only.
API usage
Expected lookup volume for domains outside your local copy.
Group structure
One product, several product lines, or a group of companies and brands.
Starter database tiers from $999; enterprise and OEM licences are quoted per deployment. The pricing page shows the starter tiers.
Bring a short description of your product and target market to the first call. That is usually enough for us to scope a quote.
Integration steps for an embedded category database
Most integrations follow the same six steps. The work sits with your engineers, and we answer questions along the way.
Map our categories to your policy model
Decide which of the 59 categories your console shows, which you merge and which you rename.
Choose the local subset
Many appliances keep the most visited domains locally and ask the API for the rest. Cloud services often load everything.
Load the full file
Import the CSV, Parquet or JSON file into your store. Each row carries a domain and its ranked categories.
domain,categories example-casino.test,"Gambling;Gaming" example-news.test,"News/Media;Political"Add the lookup path
Resolve the most specific host first, then fall back to the parent domain. Unknown domains go to the lookup API or a default rule.
Automate updates
Schedule the daily delta import and the monthly refresh. Test both on staging before they reach customers.
Expose reporting
Use the ranked categories in dashboards, so admins see why a site was allowed or blocked.
For deeper guidance read DNS filtering integration and real-time URL classification.
Onboarding timeline
A typical sequence from first call to production. Actual timing depends on your release cycle and team size.
Scoping call
We learn about your product, deployment model and target customers, and you learn how the data is built and delivered.
Quote and licence terms
You receive a quote based on scope. Legal teams review the licence, including use rights and the no-resale clause.
Data delivery
After signature, you receive access to the full file, the delta feed and API credentials.
Engineering integration
Your engineers load the data, build the lookup path and map categories into the console.
Internal testing
Run the integration against your own traffic logs and policy tests before any customer sees it.
Launch and steady state
Updates run on schedule. Validation reports arrive quarterly, monthly on request.
Support for OEM partners
You deal with people who know the data, not a ticket queue that forwards questions elsewhere.
Engineering questions
File structure, delta handling, lookup order and API usage.
Taxonomy help
Mapping our categories to your existing labels or to other vendors' lists.
Category reviews
Send domains you think are miscategorized and our team reviews them.
Validation reports
Measured accuracy figures you can share with your own product team.
Account contact
One named contact for renewals, scope changes and new product lines.
Data handling and privacy
No user traffic sent to us
Local files mean your customers' browsing decisions stay inside your systems.
API calls carry domains only
When you use the lookup API, you send a domain name and receive categories back, nothing about the user.
Easier compliance reviews
On-premise data helps customers in regulated sectors pass their own privacy and procurement checks.
See our data privacy page for details.
Want to check how we categorize specific sites before a call? Use the domain lookup tool or the bulk categorization tool.
Embedding patterns by product type
The same data ends up in very different places. These are the patterns we see most often, so your architects can start from a known shape.
| Product | Where the data lives | Lookup order | Update path |
|---|---|---|---|
| Firewall appliance | Compact local table of the most visited domains on each box | Local table, then your cloud service, then default rule | Your update server pushes deltas to appliances |
| Cloud DNS resolver | Full table in memory or a fast key-value store per region | Exact host, parent domain, then unknown handling | Daily delta import into each region |
| SWG / SASE edge | Full table in a shared category service behind the proxies | Category service with short-lived cache at the edge | Rolling reload of the category service |
| Browser isolation | Category service in the isolation cloud | Risk categories first, content categories for reports | Daily delta plus monthly refresh |
| Mobile parental app | Small on-device list for the categories families block most | On-device list, then your backend | App fetches a compact list from your backend |
| Router firmware | Minimal list or none, with cloud lookup through your backend | Your backend, which holds the full table | Backend updates only, no firmware change |
| MSP portal | One central table shared by all tenants | Central table, policies applied per tenant | Single import serves every client |
In every pattern, the end customer talks to your product and never to us. That keeps your brand in front and your service independent of third-party uptime.
What to check in any URL filtering licence
Before you sign with any data provider, your legal and product teams should agree on the points below. We are happy to walk through each one.
Use rights
Is the data allowed inside a product you sell, or only for internal use?
Copies on devices
Can subsets be stored on appliances or phones at customer sites?
Affiliates
Do subsidiaries and acquired brands fall under the same licence?
Display of categories
May your console show category names and reports to end customers?
End of term
What happens to stored data and deployed devices when the licence ends?
Raw data limits
Resale or publication of the raw database is excluded in our licences, so plan features around decisions and reports.
Why vendors embed rather than build
Building a URL category database is a long-running operation, not a one-time project. These are the trade-offs product teams usually weigh.
| Area | Build in-house | Embed licensed data |
|---|---|---|
| Time to first release | Long: collection, labelling, review and tooling first | Short: integration work only |
| New domains | Needs a daily pipeline and staff | About 300,000 a day delivered |
| Quality evidence | Own validation programme needed | Validation reports with measured accuracy |
| Taxonomy upkeep | New categories designed and back-filled by you | Categories such as AI tools already maintained |
| Team focus | Split between data and product | On product features and customers |
Organisations that trust this data include a large virtualization and browser isolation vendor and one of Europe's largest telecom groups. Read more on our web filtering database page.
OEM web filtering FAQ
What is an OEM URL filtering licence?
It is a licence that lets a vendor embed our URL category data inside a product it sells, so the product can apply category policies for its own customers. The raw data itself is never resold or published.
Do you offer a web filtering SDK?
We deliver data rather than a closed binary: downloadable files in CSV, Parquet or JSON plus a lookup API. Your engineers load the data into your own engine, which keeps you in control of performance, memory and code.
How often is the data updated?
About 300,000 newly registered domains are categorized every day and delivered as daily delta files. Each new domain is checked again after a week and after a month. All other domains are refreshed monthly.
Can the database run on-premise or air-gapped?
Yes. The files run inside your own systems, so the product works without calling out to us. Air-gapped deployments can import the update files through their own transfer process.
How is OEM pricing set?
Starter database tiers start from $999. Enterprise and OEM licences are quoted per deployment, based on the scope of data, the kind of product, how it is distributed and the update cadence you need.
Can one licence cover several of our products?
Yes. A group-wide licence covers a company that ships several products or runs several brands, so each team does not need its own contract.
Can a domain have more than one category?
Yes. Each domain can carry several categories, ranked by how much of the site they describe. You can enforce on the top category only or on any listed category.
Which categories matter for schools?
The CIPA-relevant set includes Adult, Gambling, Weapons, Illegal Drugs, Violence, VPN / Proxy / Anonymizers and Hate/Discrimination, among others. See K-12 school web filtering for more.
Can we rename categories in our console?
Yes. Many OEM partners show their own labels and map several of our categories into one. The mapping is part of your product design.
Do you cover threats as well as content?
Yes. The Malware / Phishing / Suspicious category sits in the same file as content categories. See our phishing and malware domain feed guide.
License the database for your product
Tell us what you build and where it runs. We will scope an OEM or group-wide licence that fits your deployment.