Sell protection, not a referral.
DEFLECTO has a full reseller system: your own panel, your own customers, your own balance, and your brand on the pages those customers see. You are not passing leads to us and hoping. You are the supplier, and we are the network underneath you.
You buy delivered requests. Nothing else.
The unit is a ward, and one ward is one request delivered to a customer's origin. You hold a balance, you move wards out of it into the customers you sign, and the balance falls only when one of their servers actually answered something.
Everything the WAF refuses is free. A challenge is free, a block is free, a dropped packet is free. So a customer of yours can be under a flood for a week and it will not move your balance, because none of that traffic was ever delivered to them. You are never billed for absorbing an attack on a customer’s behalf.
That is the part worth saying out loud to your own customers: the worst week of their year is not the largest line on their invoice. It is not a discount and it is not a credit, the traffic simply never counted.
What you pay for a ward, and what you charge for it, is agreed per partner. There is no published wholesale sheet, because the answer depends on the shape of your book.
- 1 ward
Delivered to the origin
The request was legitimate and your customer's server answered it.
- free
Answered with a challenge
The client was asked for proof of work instead of being forwarded.
- free
Blocked by the WAF
A rule refused it at the edge. Nothing reached your customer.
- free
Dropped
The connection was closed unanswered, below the socket.
One billable row. That is the whole meter, and it is the same meter the node writes its own records against.
A separate console, with a bearer secret of its own.
A reseller account is issued one secret when it is created, and that secret opens a panel that is neither ours nor your customers'. Everything below happens there, without asking us for anything.
Your own tenants
You create a customer, give it the domains the WAF should answer for, and it starts serving. Each tenant carries its own rate and concurrency ceilings, its own rules, its own whitelist and its own exempt paths, so a customer with an API and a customer with a shop are not forced through one policy.
Credentials you issue
Every tenant gets a secret you rotate from the panel. Rotation is revocation: whatever the old credential was signed into stops working on its next request. Your own secret is issued once, when the account is created.
Funding, from your balance
You move wards from your balance into a tenant, with a note that stays on the record. You decide what happens when a tenant runs out: keep serving, or stop. That decision is yours per customer rather than ours.
Usage you can show a customer
Delivered, challenged, blocked and dropped are counted per tenant, alongside what is in flight and what was shed at a ceiling. The split is the argument: it shows a customer what was refused on their behalf and that none of it was charged.
Your customers are yours
- A reseller reads and writes only its own tenants. Another reseller's customers are not listed, not readable and not addressable.
- A tenant id you do not own answers 404, not 403, because a 403 would confirm the id exists and confirmation is all an enumeration needs.
- Your panel, the customer panel and the operator console are three separate systems with three separate credentials. Yours cannot reach the other two.
Your name on the page the visitor actually sees.
When the WAF challenges a visitor, or when it tells a customer they are under attack, something has to be printed at the top of that page. White labelling decides whose name it is.
This is a real setting in the product rather than a promise. Your display name and your logo are yours to change from your own panel at any time, and the change is live on the next challenge the node serves.
Which tier you are on is granted by us, not set from your panel, so nobody can quietly promote themselves out of attribution. Ask for the tier you want and it is a conversation, not a form.
DEFLECTO
Your customers see the DEFLECTO mark and the DEFLECTO name on the challenge page and in attack notifications.
Your brand, attributed
Your customers see your logo and your name, with a quiet line underneath saying the service is provided by DEFLECTO.
Your brand alone
Your customers see your logo and your name, and nothing on the page names DEFLECTO at all.
A logo is an SVG, PNG or WebP you upload yourself. There is no design round trip and no ticket.
Anyone already holding the customer relationship.
If you are the one who gets called when a site stops answering, you are already doing the hard part. This turns that into something you charge for.
Hosting companies
You already carry the sites and you already take the call when one goes down. Protection becomes a line on the invoice instead of a bad afternoon, and the tenant boundary matches the boundary you already bill on.
Agencies and studios
You built the site, you keep it running, and the client has no idea what a syn flood is. You put protection in front of it, in your own name, and it never becomes a third party they have to be introduced to.
Managed service providers
You are accountable for uptime across a book of customers with nothing in common. One panel, one balance, per-customer ceilings and per-customer rules, without a separate contract for each.
Getting a customer behind the network is a DNS record, so onboarding one of yours is work you can do in the panel while they are still on the phone. Nothing about a tenant needs us, and nothing about it waits on a ticket queue of ours.
Tell us what your book looks like.
How many customers you carry, roughly how much legitimate traffic they move between them, and whether you want your brand on the challenge page. We will come back with terms, and margin is agreed per partner rather than read off a sheet.
Reseller enquiries go to sales@deflecto.net. Say it is a partner enquiry in the subject and it lands with the right person first time.