Why this protection exists
Cirrus Shield automatically and temporarily blocks IP addresses that send an abnormal volume of requests or that pile up failed sign-in attempts. This protects the platform against intrusion attempts and keeps response times acceptable for every customer.
The protection covers both the web interface and the REST API. It has been in effect since October 26, 2026.
Limits
Requests are counted per IP address. To stay within normal use, keep to an average of no more than 2 requests per second per IP address. Beyond several thousand requests in a few minutes, or after several failed authentication attempts in a short time, the address is temporarily blocked.
A first block lasts 30 minutes. Repeat offenses extend the block up to 24 hours.
All users who reach the Internet through the same IP address (corporate network, VPN, integration server) share the same counter. If several heavy users or an API integration share one IP address, let support know (see the last section). Customers integrating with the API can also get the exact limit values from support.
What happens when an IP is blocked
A blocked IP address can no longer reach Cirrus Shield: the browser or integration can no longer connect. Other IP addresses in your organization are not affected.
The block lifts automatically at the end of its duration (30 minutes or 24 hours). No data is lost on the Cirrus Shield side, but requests sent during the block are not processed: your integrations must resend them once the block is lifted.
Best practices for API integrations
Most integration blocks come from a full synchronization rerun on a fixed schedule, or from a retry loop after a failure. These rules prevent both:
- Only sync what has changed. Resending every already-synced record on each cycle multiplies calls for nothing. Filter on a last-modified date or a processing flag.
- Reuse your authentication token. Request a new token only when the current one has expired, not before every call.
- Stop after an authentication failure. An invalid credential or token will not become valid by retrying: fix the configuration instead of looping.
- Space out retries. After an error, wait before retrying and increase the delay after each new failure (for example 1, 2, 4, then 8 minutes).
- Spread out heavy jobs. For a data migration or a bulk import, spread the calls over time and let support know in advance.
Requesting an unblock or an exception
This option is reserved for customers on a paid plan, as the free version does not include email support. Contact support at support@cirrus-shield.com with:
- the IP address concerned;
- the approximate date and time of the block;
- what it is used for: interface users, or the name and purpose of the integration.
For a legitimate integration whose volume consistently exceeds the limits, we can allow its IP address after review. This requires a fixed IP address and an integration that follows the best practices above. We may withdraw the exception if the integration degrades platform performance.
