The right permission for each person
An analyst investigates without being able to publish, an approver reviews without being able to edit, a client sees their sites and nothing else.
Teams, permissions and multi-organisation
Seven built-in roles and roles of your own, limited to some sites, two-factor authentication, a tamper-evident audit log, and the management of several clients from one console with isolated organisations, quotas and invitations.
Where to find it in the console : Administration menu: Users and access, Audit log, Tenants and MSPs.
What it is for
Better protected accounts
Two-factor authentication through a TOTP app with recovery codes, scoped API tokens, and enterprise sign-in under licence.
Know who did what
Every change is recorded with the author, time, origin and before-and-after, in a hash chain you can verify.
Several clients, one console
One organisation per client, isolated from the others, with its quotas, users and reports. Your clients' sites stay protected whatever you do with their access.
A platform, providers, clients
Organisations form a tree. Everyone sees their own space and what is below it, never a neighbour's.
A tree of organisations
The platform is at the root and stays free. Below it, optional providers, then clients. A user belongs to one organisation.
Roles, per site if needed
A role is given to a person for their whole organisation or for a few sites only.
A reviewed publication
A client's administrator edits their configuration, but going live remains with a platform administrator: a client does not change what runs on shared nodes without review.
Roles and permissions
免费
A permission is written resource:action. The seven built-in roles cannot be edited; you create roles of your own to combine permissions.
- Owner, Administrator, Operator, Security analyst, Change approver, Read-only and Client (managed security service provider).
- A role can be limited to a few sites; an API token can be too, and never exceeds the rights of the person who created it.
- Four-eyes approval: a policy version goes live only after an approver agrees.
- Keep at least two owners: the product refuses to remove the last one.
Sign-in and audit log
免费Pro 及以上
Controls on access, and the trace of every action.
- TOTP with single-use recovery codes; the secret is encrypted at rest. Hardware keys (WebAuthn, FIDO2) are not available.
- Licence required: OIDC and SAML enterprise sign-in, and SCIM provisioning.
- Audit log: who, what, when, from where, with the before and after; filters, free CSV, JSON and NDJSON export, CEF and Syslog under licence.
- Verification recomputes the hash chain and reports the first inconsistency. Secrets are never written to it.
Manage several clients
Pro 及以上
The first organisation, the default one, is free. Adding clients needs a licence; reactivating, exporting and deleting are never locked.
- The « Add a client » wizard: client, quotas, first user, report brand, isolation test and handover. Nothing is created before the last step.
- Quotas on sites, users and clients; the monthly request volume is measured for your invoicing and never cuts traffic.
- A client selector limits every list to one client; an overview shows each one's protection state.
- Suspending cuts console access, not the protection. Archiving requires an export less than 24 hours old and the organisation's name, then opens a grace period before a possible deletion.
Imposed floor and client brand
Pro 及以上
What is imposed from above can be tightened below, never relaxed.
- A provider imposes a minimum mode, a minimum paranoia level, maximum thresholds and protection settings; a weaker value already in place is raised without erasing anything.
- Integrations only flow downward: an integration receives the alerts of its organisation and of those below it.
- The client's name, logo and colours appear on its reports and refusal pages next to ToutWAF, never in its place.
- Invitations use a single-use link, valid for 7 days by default: no password is sent or shown.
What is not done, or not proven
We prefer to say it plainly.
- The SAML flow has not been tried end to end with a real identity provider; OIDC is the best-proven path. Keep a local owner account as a break-glass.
- Imposed rules do not cover the rule overrides, exceptions or custom rules of a site. A provider does not share its integrations downward.
- The Agency (multi-client) licence sets a ceiling of sites and nodes for all its clients together; ToutWAF invoices nobody, and the legal texts for resellers are not written.
- Sending invitations was proven against a local test SMTP server, and the grace period of an archived client by moving the end date back, without waiting for it. Nothing ran against a real ToutPanel.
Use cases
An agency managing its clients' sites
One organisation per client, a read-only Client role for them, and a monthly report in their name next to ToutWAF.
A three-person security team
An analyst, an approver and an owner: nobody puts a blocking rule live alone.
An access audit
You verify the log chain over the period, export the entries and prove who changed the policy.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
版本免费 包含在所有方案中，包括两个免费方案（Free 和 Free +）Pro 及以上 付费方案：在控制台中可见，无许可证时被锁定。从 Pro 起，另有标注 Agency 或 Enterprise 的除外
尚未在真实环境中试过 在产品测试中运行正常，但尚未用真实的服务、系统或设备试过。您设置该功能时，控制台会在相应位置显示同样的提示。
管理与访问
- 角色与权限：七个内置角色、自定义角色、按站点限定范围（免费版 2 个用户）免费
- TOTP 双因素认证（含恢复码），以及限定权限范围的 API 令牌免费
- 审计日志：谁、做了什么、何时、从哪里，含变更前后对比，可验证的哈希链，支持 CSV、JSON 和 NDJSON 导出免费
- 审计日志以 CEF 和 Syslog 格式导出，供 SIEM 使用Pro 及以上
- 企业登录：OIDC 和 SAML 身份提供方，以及 SCIM 账户同步 尚未在真实环境中试过Enterprise
- 控制台能做的一切都有对应的 REST API，令牌可限定权限范围免费
- 命令行工具：策略、测试、模拟、备份、诊断免费
- 节点总览页：节点、版本、注册令牌，以及按序编排的节点更新免费
- 许可证：签名密钥在您的机器上本地校验，不经网络核验；到期后先有 48 小时宽限期，再有 48 小时只读免费
租户与 MSP
- 免费版包含一个组织，即默认组织免费
- “添加客户”向导：客户信息、配额、首位用户、报告品牌、隔离验证和交付Agency 及以上
- 客户之间严格隔离，对每一类接口都有测试验证Agency 及以上
- 按客户设置配额（站点、用户）；每月请求量只做统计，绝不会中断流量Agency 及以上
- 客户选择器，以及显示各客户防护状态的多客户总览Agency 及以上
- 可暂停、归档、导出和删除客户；重新启用、导出和删除永远不会被锁定Agency 及以上
- 把站点从一个客户移到另一个客户Agency 及以上
- 由上级强制规定的策略底线Agency 及以上
- 通过一次性链接发出邀请：绝不发送密码Agency 及以上
- 按客户定期生成 PDF 报告；导出 CSV 用量，供您自行开具账单Agency 及以上
- 客户的名称、标志、颜色和支持联系方式显示在其报告中，与 ToutWAF 并列，绝不取代 ToutWAFAgency 及以上
- 经销商许可证：所有客户共享一个配额池Agency 及以上
随时都可以把高级选项恢复为默认值。付费许可证结束后会发生什么，见定价页的常见问题：48 小时宽限期、48 小时只读，之后 WAF 防护关闭，直到续订。