Report without effort
An executive or technical report, over the period of your choice, sent every week or month to the list you set.
Reports and compliance
PDF reports on demand or scheduled, evidence for PCI DSS, NIS2, DORA, ISO 27001 and SOC 2 computed from the real state of your installation, and privacy settings. ToutWAF claims no certification: it provides controls and evidence.
Where to find it in the console : Analysis menu: Reports and compliance (tabs Reports, Compliance evidence and Privacy settings).
What it is for
Evidence drawn from the real state
Each control of a framework is tied to a finding of the platform: pass, warning, fail or manual.
Privacy under control
Pseudonymised or anonymised addresses, retention periods, log minimisation, masked fields.
People's rights
Export or erase what is stored about an IP address, in one action reserved to platform administrators.
A report, from request to inbox
A report never holds more than your role allows you to see.
Choose the type and the period
Executive or technical, from 1 to 365 days (7 by default), optionally following a framework.
Generate or schedule
On demand, or every week or month. Sending goes through the organisation's e-mail integration or the platform's mail server.
Find and reread
Generated reports are listed; « Run now » runs a schedule at once and shows its last result.
Evidence by framework
Free
PCI DSS 4.0, NIS2, DORA, ISO/IEC 27001 and SOC 2: each control is tied to the real state of the platform, as PDF or JSON.
- A control takes the worst result of the checks it relies on: WAF in blocking, TLS, logs, audit-log hash chain, two-factor authentication, change approval, backups, incidents and more.
- « Pass » means the product feature is in place and configured; it is not an attestation, and for several checks it means « on for at least one site ».
- Where only you can provide the proof (a written policy, for example), the control is « manual ».
Privacy
Free
Settings that apply to events and incidents.
- Pseudonymisation of IP addresses with an automatically generated salt, applied by the data plane and again by the control plane.
- Retention of events (1 to 3650 days); the addresses held in incidents and false-positive samples go with them.
- Retention of addresses: after that delay, 203.0.113.7 becomes 203.0.113.0 (an IPv6 keeps its first 48 bits), while the event stays until its retention ends.
- Log minimisation: none, standard or strict (which also drops the query string, user agent and referrer), and payload capture can be switched off.
Right of access and erasure
Free
For an IP address, reserved to platform administrators since the data spans all organisations.
- The export returns the stored events, the incident identifiers and the bans that concern the address.
- Erasure deletes its events, removes it from incidents and false-positive statistics, removes its bans and masks it in the audit log; the answer counts each deletion.
- You remain the data controller: the legal basis, the register and informing people are your responsibility.
Reports per client and score per site
FreePro and above
For providers who manage several clients, and for following a site over time.
- Licence required (several organisations): one report per client, holding only its sites, with its name and logo next to ToutWAF, never in its place; sent to a list and to each client's contact.
- Free: a security score per site, with the list of improvements to make, as a recurring review item.
- PDF reports exist in seven languages; in Russian, Chinese and Arabic they are produced in English.
What is not done, or not proven
We prefer to say it plainly.
- ToutWAF holds no certification (ISO 27001, SOC 2, PCI DSS, Common Criteria, ANSSI CSPN) and makes no compliance claim. Compliance is a property of your organisation, not of a product.
- Event retention is 30 days by default: the twelve-month retention check therefore stays on warning until you lengthen it.
- Erasure acts on live data; backups already written are not rewritten. With ClickHouse, which cannot rewrite its rows, an address retention shorter than the event retention is refused.
- Report sending was proven against a local test SMTP server, not against a mail provider.
Use cases
A monthly report for management
A scheduled executive report, sent to the management list with the summary of attacks and of the protection's state.
Prepare a PCI DSS audit
The evidence PDF shows what is in place, what is left to settle and what you must document yourself.
Answer an erasure request
You export what concerns the address, then erase it; the audit log keeps a trace of the operation.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionFree Included in every offer, including both free offers (Free and Free +)Pro and above Paid offers: visible in the console, locked without a licence. From Pro, unless Agency or Enterprise is shown
Reports and compliance
- Executive or technical PDF reports, on demand or scheduled (weekly or monthly), sent by e-mail or through an integrationFree
- Evidence for PCI DSS 4.0, NIS2, DORA, ISO 27001 and SOC 2, computed from the real state; it is not an attestationFree
- Privacy: address pseudonymisation, retention of events and addresses, log minimisation, masked fieldsFree
- Right of access and erasure for an IP address: export, then erasure of events, incidents and bansFree
- Security score per site, with the list of improvements to makeFree
Tenants and MSPs
- PDF reports per client, scheduled; usage export in CSV for your own invoicingAgency and above
Going back to the default of an advanced option is always possible. What happens when a paid licence ends is described in the pricing FAQ: 48 hours of grace, 48 hours of read-only, then WAF protection is switched off until renewal.
Pricing Read the documentation
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.