Agency offer: for agencies
For agencies and service providers who run their clients' sites: multi-client management, standby console and priority support. The full detail before you order.
Agency
For agencies and providers who run their clients' sites: several client organisations, standby console, priority support.
or €1788 excl. tax per year
Prices exclude tax; VAT is added according to your country. Show the prices in your currency with the button at the top of the page; the euro remains the reference price.
At a glance
- 50 protected sites
- 5 WAF nodes
- 25 users
- 25 organisations
- Unlimited requests
- Priority support
The ceilings apply to the whole offer (all your servers together), not to each server.
Quotas and limits
Every ceiling of the offer, one by one.
- Protected sites
- 50
- WAF nodes
- 5
- Users
- 25
- Organisations
- 25
- Allowed requests per month
- Unlimited requests
- Event retention
- 30 days by default, adjustable by the administrator; the offer sets no duration
- Support
- Priority support
- Licence
- Signed key, valid for the period ordered
Unlimited requests: no commercial request quota. It is not a throughput guarantee, performance depends on your infrastructure.
What is included
In every offer, the free ones included:
- WAF protection
- Two-factor authentication
- Security updates
Every function marked “Free” on the Features page: detectors, rules, bots, TLS, basic load balancing, logs and many more.
On top of that, 64 functions of the paid offers:
Automatic rules
- Site self-test: ordinary requests evaluated through your data plane before anything is blocked
- Estimated false-positive rate per rule group and the Ready to block indicator
- Journal of automatic decisions with the evidence, and one-click undo
- Automatic profile: log only, then challenge, then block, one rule group at a time
- Automatic exceptions: narrow, expiring, created only from strong evidence in real traffic
- Automatic rollback of a rule update that blocks ordinary requests
Definitions and threat intelligence
- Pro and Maximum packages: broader address lists, phishing domains, AS table, City table
- Precision of each list measured on your own traffic
- Adjustable points for each reputation class
- Weekly watcher of public registries that proposes new sources and flags dead ones
- Your own keys for lists that need one, stored encrypted
API security
- Specification import and validation of requests and responses: OpenAPI 3, Swagger 2, GraphQL SDL, gRPC proto
- BOLA: identifiers never given to this client, learned from traffic
- Test my protection with harmless attacks, simulation on past traffic, profile import
- Consumers, plans and quotas, private usage pages, limits per key or per user
- Signed incoming webhooks: Stripe, GitHub, GitLab, Slack, Shopify, Twilio and generic HMAC
Access control and IP reputation
- Six degrees per country: normal, watch, harden, challenge, restrict, block
- Scopes by path, method and hours; expiring rules; reputation thresholds per country
- Own degree for Tor, VPN and hosting addresses and for chosen ASNs
- Simulation of a geographic policy on past traffic
- External IP lists refreshed automatically
- Kernel blocking (nftables) of the very large lists, on the host of the control plane Not yet tried in real conditions
TLS and certificates
- Several authorities with automatic failover, paid and internal ACME directories Not yet tried in real conditions
Traffic delivery and load balancing
- Other algorithms: least connections, IP hash, consistent hash, random, two choices, fastest
- Session persistence by cookie, address or header
- Active health checks and fine tuning of the circuit breaker
- Maintenance of a server or a node without cutting a single request (drain)
- Canary and blue/green rollouts by share of requests, and slow start
Analytics
- Advanced analytics: conversion funnels, retention cohorts, map down to the city, traffic alerts, scheduled reports by e-mail (PDF or CSV)
Servers and host agents
- More than one protection node, installed and kept in step from the console
Server monitoring
- Rules and thresholds of your own, for the measures you choose
- More than one supervised server
- More than 3 availability probes
- Host security: inventory of packages, accounts, SSH keys and scheduled tasks, with a vulnerability lookup done on your console (your package list never leaves it)
- Integrity of the files you choose and 25 read-only hardening checks
Backups and standby console
- Off-site targets: S3, SFTP, WebDAV or a command
- Backup server: files and databases (MySQL, MariaDB, PostgreSQL) of supervised servers, encrypted with a recovery key only you keep, verified by a restore test
- Standby console: an encrypted, verified copy every hour and a guided, manual takeover Not yet tried in real conditions
Mail security gateway
- Inbound gateway in front of your mail server, installed and managed over SSH on a dedicated Linux server Not yet tried in real conditions
- Anti-spam and anti-phishing, attachment policy, optional antivirus, quarantine Not yet tried in real conditions
- Data-loss prevention on messages Not yet tried in real conditions
- Sender verification (SPF, DKIM, DMARC), greylisting, impersonation and link detection: all off by default Not yet tried in real conditions
- Never an open relay: every configuration is checked; if the filter stops, mail is held, not lost Not yet tried in real conditions
- Optional outgoing mail: relay, DKIM signing, sending limits Not yet tried in real conditions
- Mail doctor, daily digest of the quarantine, reports and exports Not yet tried in real conditions
- Nothing about your mail goes to a third party by default; message content is never in the audit log Not yet tried in real conditions
Tenants and MSPs
- Add a client wizard: client, quotas, first user, report brand, isolation check and handover
- Strict isolation between clients, checked by tests on every family of routes
- Quotas per client (sites, users); the monthly volume of requests is measured and never cuts traffic
- Client selector and a multi-client overview with the protection state of each client
- Suspend, archive, export and delete a client; reactivating, exporting and deleting are never locked
- Moving a site from one client to another
- A policy floor imposed from above
- Invitations by single-use link: no password is ever sent
- PDF reports per client, scheduled; usage export in CSV for your own invoicing
- The client's name, logo, colours and support contact on its reports, next to ToutWAF and never in its place
- Reseller licence: one pool of quotas shared by all your clients
Administration and access
- Audit log exports in CEF and Syslog for a SIEM
Integrations
- SIEM and logs: Syslog (CEF, LEEF, JSON), Splunk, Elastic and OpenSearch, Microsoft Sentinel, QRadar, ArcSight, Wazuh, Graylog, Datadog, Loki, OpenTelemetry Not yet tried in real conditions
- More chat and paging: Discord, Google Chat, Mattermost, Telegram, ntfy, Pushover, Rocket.Chat, Webex, Zulip, Gotify
- Ticketing: Jira, GLPI, ServiceNow, GitHub and GitLab Issues, Linear, Redmine, Zendesk Not yet tried in real conditions
- SOAR and automation: n8n, Shuffle, Zapier, TheHive
- Threat intelligence: MISP in both directions, STIX/TAXII (OpenCTI and others), CrowdSec
- Git link (off by default, experimental): the configuration lives in a Git repository, ToutWAF computes a plan and applies it after checks Not yet tried in real conditions
Works in the product's tests, but has not yet been tried with the real service, system or equipment. The console shows the same note where you set the function up.
What is not included
To decide with full knowledge, here is what this offer does not include:
- No enterprise sign-in (SSO) or private language model: reserved for Enterprise.
- Ceilings: 50 sites, 5 nodes, 25 users and 25 organisations; Agency Max removes them all.
Functions reserved for a higher offer (2):
Anomaly detection, AI assistant and LLM protection
- Private language model on your own server (Ollama or OpenAI-compatible): no question leaves your network Not yet tried in real conditions
Administration and access
- Enterprise sign-in: OIDC and SAML providers and SCIM provisioning Not yet tried in real conditions
ToutWAF does not advertise what does not exist: the endpoint antivirus is not offered in any plan for now.
Support
Priority support
Your requests come before those of the free offers. No response time is guaranteed by contract: contract-defined support is Enterprise's.
Licence cycle
A paid licence is valid for the period ordered. When it expires, nothing is deleted and nothing is cut off at once:
- 48 hours of grace: everything works, with a permanent banner and alerts.
- 48 hours of read-only: traffic and protection continue, but nothing can be created or changed.
- Then the licence is locked: WAF protection is switched off and traffic keeps flowing, unprotected (an “Unsecured traffic” banner in the console, and a notice to visitors on the HTML pages of protected sites unless the platform administrator sets it otherwise). Only renewal remains possible in the panel.
- Renewing (entering a valid licence) restores everything at once. No data or configuration is deleted at any time.
Free and Free + have no such cycle: they simply fall back to their limits.
Billing and payment
- Prices in euros excluding tax. Applicable VAT is added (20% in France); the publisher computes it when you order, according to your country and VAT number.
- Period chosen when you order: monthly or annual, paid in advance for the whole period.
- Payment with one of the methods the publisher has enabled, offered when you order. Payment details are entered with the provider, never on this site.
- Currency: you order in the currency of your choice among those offered; the amount charged is in that currency, at the rate locked when you order. The euro remains the reference price.
- An invoice is issued for every paid order and sent by e-mail, with your company's details if you order as a company.
- No automatic renewal: remember to renew before the end date (see the licence cycle).
Withdrawal and refund
- Individuals (consumers in the European Union): you have 14 days from the order to withdraw, unless you asked for immediate activation of the licence and acknowledged losing that right once the service is fully performed (digital content).
- Professionals: the statutory right of withdrawal does not apply.
- Refund: a licence that has not been activated can be refunded in full on request within 14 days of the order; after that, there is no pro rata refund of the current period.
- For any request, write to us from the Contact page, quoting the order number.
Frequently asked questions
How do I receive my licence?
As soon as the order is confirmed (and paid, for a paid offer), the signed licence key is sent by e-mail to the order address. You paste it in the console (Administration > Fleet and licence): it is checked on your machine, with no network call.
Can I change offer later?
Yes: order the offer you want, the new key replaces the previous one in the console. To take the period already paid into account, write to us from the Contact page.
What happens if I reach a ceiling?
The console refuses to create an item beyond the ceiling (error TW-8008, which says what limits and what to do); what already exists keeps working. Move to the next offer for more capacity.
Which payment methods?
The ones the publisher has enabled; they are shown when you order. While none is enabled, paid ordering is not open and the form tells you so clearly.
In which currency am I charged?
In the currency you pick with the button at the top of the page, among those offered, at the rate locked when you order. The euro remains the reference price.
Can I get an invoice with my VAT number?
Yes: give your company name and VAT number in the order form; its format is checked. The final VAT is computed by the publisher according to your country.
What happens when the licence ends?
See “Licence cycle” above: 48 h of grace, 48 h of read-only, then WAF protection is switched off until you renew. Nothing is deleted.
Agency or Agency Max?
Agency suits you as long as you stay within its ceilings (see the quotas). Agency Max removes all the ceilings: unlimited sites, nodes, users and organisations.
Choose Agency
A cart, a form, and your licence arrives by e-mail.