A security product must be trustworthy first. Here is how ToutWAF is designed, built and delivered, and what it does for your control over your data.
A Rust data plane and a Go control plane, shipped as native binaries with no runtime to install. The SecLang evaluator and the detectors are the project's own code; third-party rule sets such as the OWASP CRS are downloaded as data. The source code is not published: the public repository holds binaries and installers only.
Releases are verified before install (SHA-256, and an Ed25519 signature when a release key is set), and a failed update rolls back by itself. Definitions are verified and can be rolled back.
Dedicated unprivileged service user, systemd hardening, TLS on the console, a console reachable only under a secret path, hashed passwords, CSRF protection, login lockout and TOTP two-factor authentication.
Your visitors' requests, your sites and your files stay on your servers. No telemetry, no tracking, no licence check over the network. The few outgoing connections (updates, definitions, certificates) are listed in the documentation. The requests the product makes to third parties (definitions, certificates, integrations, address look-ups) use neutral identifiers: they do not name ToutWAF or its version.
Detection-only mode, per-rule exceptions, simulation and one-step rollback let you deploy without breaking production.
Found a vulnerability? Write to the security contact below.
Built for organisations that must keep control of their data.
Traffic and logs stay on your infrastructure, in the jurisdiction you choose. No mandatory cloud, no telemetry; the few outgoing connections (updates, definitions, certificates) are listed in the documentation.
IP pseudonymisation, log minimisation, masked payload capture, configurable retention, and export or erasure by address.
A verifiable audit trail and evidence mapped to controls (PCI DSS 4.0, NIS2, DORA, ISO 27001, SOC 2) from the live state of the platform. It is evidence, not an attestation: ToutWAF holds no certification.
The data plane keeps protecting with the last policy if the control plane is down. Fail-open or fail-closed per app.
Everything in the console is also available through the REST API, the command line and YAML or JSON policy files. Export your policy any time.
SecLang and OWASP CRS v4 import: your existing rules and know-how keep their value.
