Report without effort
An executive or technical report, over the period of your choice, sent every week or month to the list you set.
Reports and compliance
PDF reports on demand or scheduled, evidence for PCI DSS, NIS2, DORA, ISO 27001 and SOC 2 computed from the real state of your installation, and privacy settings. ToutWAF claims no certification: it provides controls and evidence.
Where to find it in the console : Analysis menu: Reports and compliance (tabs Reports, Compliance evidence and Privacy settings).
What it is for
Evidence drawn from the real state
Each control of a framework is tied to a finding of the platform: pass, warning, fail or manual.
Privacy under control
Pseudonymised or anonymised addresses, retention periods, log minimisation, masked fields.
People's rights
Export or erase what is stored about an IP address, in one action reserved to platform administrators.
A report, from request to inbox
A report never holds more than your role allows you to see.
Choose the type and the period
Executive or technical, from 1 to 365 days (7 by default), optionally following a framework.
Generate or schedule
On demand, or every week or month. Sending goes through the organisation's e-mail integration or the platform's mail server.
Find and reread
Generated reports are listed; « Run now » runs a schedule at once and shows its last result.
Evidence by framework
Gratuito
PCI DSS 4.0, NIS2, DORA, ISO/IEC 27001 and SOC 2: each control is tied to the real state of the platform, as PDF or JSON.
- A control takes the worst result of the checks it relies on: WAF in blocking, TLS, logs, audit-log hash chain, two-factor authentication, change approval, backups, incidents and more.
- « Pass » means the product feature is in place and configured; it is not an attestation, and for several checks it means « on for at least one site ».
- Where only you can provide the proof (a written policy, for example), the control is « manual ».
Privacy
Gratuito
Settings that apply to events and incidents.
- Pseudonymisation of IP addresses with an automatically generated salt, applied by the data plane and again by the control plane.
- Retention of events (1 to 3650 days); the addresses held in incidents and false-positive samples go with them.
- Retention of addresses: after that delay, 203.0.113.7 becomes 203.0.113.0 (an IPv6 keeps its first 48 bits), while the event stays until its retention ends.
- Log minimisation: none, standard or strict (which also drops the query string, user agent and referrer), and payload capture can be switched off.
Right of access and erasure
Gratuito
For an IP address, reserved to platform administrators since the data spans all organisations.
- The export returns the stored events, the incident identifiers and the bans that concern the address.
- Erasure deletes its events, removes it from incidents and false-positive statistics, removes its bans and masks it in the audit log; the answer counts each deletion.
- You remain the data controller: the legal basis, the register and informing people are your responsibility.
Reports per client and score per site
GratuitoPro e superiori
For providers who manage several clients, and for following a site over time.
- Licence required (several organisations): one report per client, holding only its sites, with its name and logo next to ToutWAF, never in its place; sent to a list and to each client's contact.
- Free: a security score per site, with the list of improvements to make, as a recurring review item.
- PDF reports exist in seven languages; in Russian, Chinese and Arabic they are produced in English.
What is not done, or not proven
We prefer to say it plainly.
- ToutWAF holds no certification (ISO 27001, SOC 2, PCI DSS, Common Criteria, ANSSI CSPN) and makes no compliance claim. Compliance is a property of your organisation, not of a product.
- Event retention is 30 days by default: the twelve-month retention check therefore stays on warning until you lengthen it.
- Erasure acts on live data; backups already written are not rewritten. With ClickHouse, which cannot rewrite its rows, an address retention shorter than the event retention is refused.
- Report sending was proven against a local test SMTP server, not against a mail provider.
Use cases
A monthly report for management
A scheduled executive report, sent to the management list with the summary of attacks and of the protection's state.
Prepare a PCI DSS audit
The evidence PDF shows what is in place, what is left to settle and what you must document yourself.
Answer an erasure request
You export what concerns the address, then erase it; the audit log keeps a trace of the operation.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdizioneGratuito Incluso in tutte le offerte, comprese le due gratuite (Free e Free +)Pro e superiori Offerte a pagamento: visibile nella console, bloccata senza licenza. Da Pro, salvo indicazione Agency o Enterprise
Reports and compliance
- Executive or technical PDF reports, on demand or scheduled (weekly or monthly), sent by e-mail or through an integrationGratuito
- Evidence for PCI DSS 4.0, NIS2, DORA, ISO 27001 and SOC 2, computed from the real state; it is not an attestationGratuito
- Privacy: address pseudonymisation, retention of events and addresses, log minimisation, masked fieldsGratuito
- Right of access and erasure for an IP address: export, then erasure of events, incidents and bansGratuito
- Security score per site, with the list of improvements to makeGratuito
Tenant e MSP
- Rapporti PDF per cliente, pianificati; esportazione dell'utilizzo in CSV per la tua fatturazioneAgency e superiori
Tornare al valore predefinito di un'opzione avanzata è sempre possibile. Che cosa accade alla fine di una licenza a pagamento è descritto nelle domande frequenti sui prezzi: 48 ore di tolleranza, 48 ore di sola lettura, poi la protezione WAF viene disattivata fino al rinnovo.
Metti oggi stesso uno scudo davanti alle tue applicazioni
Installalo sul tuo server, oppure scrivici per parlare di licenze.