Report without effort
An executive or technical report, over the period of your choice, sent every week or month to the list you set.
Reports and compliance
PDF reports on demand or scheduled, evidence for PCI DSS, NIS2, DORA, ISO 27001 and SOC 2 computed from the real state of your installation, and privacy settings. ToutWAF claims no certification: it provides controls and evidence.
Where to find it in the console : Analysis menu: Reports and compliance (tabs Reports, Compliance evidence and Privacy settings).
What it is for
Evidence drawn from the real state
Each control of a framework is tied to a finding of the platform: pass, warning, fail or manual.
Privacy under control
Pseudonymised or anonymised addresses, retention periods, log minimisation, masked fields.
People's rights
Export or erase what is stored about an IP address, in one action reserved to platform administrators.
A report, from request to inbox
A report never holds more than your role allows you to see.
Choose the type and the period
Executive or technical, from 1 to 365 days (7 by default), optionally following a framework.
Generate or schedule
On demand, or every week or month. Sending goes through the organisation's e-mail integration or the platform's mail server.
Find and reread
Generated reports are listed; « Run now » runs a schedule at once and shows its last result.
Evidence by framework
免费
PCI DSS 4.0, NIS2, DORA, ISO/IEC 27001 and SOC 2: each control is tied to the real state of the platform, as PDF or JSON.
- A control takes the worst result of the checks it relies on: WAF in blocking, TLS, logs, audit-log hash chain, two-factor authentication, change approval, backups, incidents and more.
- « Pass » means the product feature is in place and configured; it is not an attestation, and for several checks it means « on for at least one site ».
- Where only you can provide the proof (a written policy, for example), the control is « manual ».
Privacy
免费
Settings that apply to events and incidents.
- Pseudonymisation of IP addresses with an automatically generated salt, applied by the data plane and again by the control plane.
- Retention of events (1 to 3650 days); the addresses held in incidents and false-positive samples go with them.
- Retention of addresses: after that delay, 203.0.113.7 becomes 203.0.113.0 (an IPv6 keeps its first 48 bits), while the event stays until its retention ends.
- Log minimisation: none, standard or strict (which also drops the query string, user agent and referrer), and payload capture can be switched off.
Right of access and erasure
免费
For an IP address, reserved to platform administrators since the data spans all organisations.
- The export returns the stored events, the incident identifiers and the bans that concern the address.
- Erasure deletes its events, removes it from incidents and false-positive statistics, removes its bans and masks it in the audit log; the answer counts each deletion.
- You remain the data controller: the legal basis, the register and informing people are your responsibility.
Reports per client and score per site
免费Pro 及以上
For providers who manage several clients, and for following a site over time.
- Licence required (several organisations): one report per client, holding only its sites, with its name and logo next to ToutWAF, never in its place; sent to a list and to each client's contact.
- Free: a security score per site, with the list of improvements to make, as a recurring review item.
- PDF reports exist in seven languages; in Russian, Chinese and Arabic they are produced in English.
What is not done, or not proven
We prefer to say it plainly.
- ToutWAF holds no certification (ISO 27001, SOC 2, PCI DSS, Common Criteria, ANSSI CSPN) and makes no compliance claim. Compliance is a property of your organisation, not of a product.
- Event retention is 30 days by default: the twelve-month retention check therefore stays on warning until you lengthen it.
- Erasure acts on live data; backups already written are not rewritten. With ClickHouse, which cannot rewrite its rows, an address retention shorter than the event retention is refused.
- Report sending was proven against a local test SMTP server, not against a mail provider.
Use cases
A monthly report for management
A scheduled executive report, sent to the management list with the summary of attacks and of the protection's state.
Prepare a PCI DSS audit
The evidence PDF shows what is in place, what is left to settle and what you must document yourself.
Answer an erasure request
You export what concerns the address, then erase it; the audit log keeps a trace of the operation.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
版本免费 包含在所有方案中，包括两个免费方案（Free 和 Free +）Pro 及以上 付费方案：在控制台中可见，无许可证时被锁定。从 Pro 起，另有标注 Agency 或 Enterprise 的除外
Reports and compliance
- Executive or technical PDF reports, on demand or scheduled (weekly or monthly), sent by e-mail or through an integration免费
- Evidence for PCI DSS 4.0, NIS2, DORA, ISO 27001 and SOC 2, computed from the real state; it is not an attestation免费
- Privacy: address pseudonymisation, retention of events and addresses, log minimisation, masked fields免费
- Right of access and erasure for an IP address: export, then erasure of events, incidents and bans免费
- Security score per site, with the list of improvements to make免费
租户与 MSP
- 按客户定期生成 PDF 报告；导出 CSV 用量，供您自行开具账单Agency 及以上
随时都可以把高级选项恢复为默认值。付费许可证结束后会发生什么，见定价页的常见问题：48 小时宽限期、48 小时只读，之后 WAF 防护关闭，直到续订。