The agreement behind the subscription.

This agreement is between DEFLECTO LLC, registered at [[REGISTERED_ADDRESS]] (DEFLECTO, we, us), and the person or organisation that opens an account (you, the Customer). By creating an account or pointing a domain at our network you accept these terms.

Service

The DEFLECTO Layer 7 web application firewall and reverse proxy, the edge network that runs it, the control panel, and the APIs we publish for it.

Origin

The server or servers you operate, or have operated on your behalf, that the Service forwards requests to.

Protected Property

A domain, subdomain or application you have configured to route through the Service.

Forwarded Request

A request the Service delivered to your Origin. The unit of metering, defined precisely in clause 4.2.

Refused Request

A request the Service blocked, dropped or answered with a proof-of-work challenge rather than delivering it to your Origin.

Quota

The number of Forwarded Requests included in your plan in a billing month.

AUP

The Acceptable Use Policy published on this site, which forms part of this agreement.

The Service sits in front of your Origin. Traffic addressed to a Protected Property reaches our network first, is inspected against the rule set and the rate and reputation ladders configured for your account, and is then forwarded, challenged, blocked or dropped. Volume floods are absorbed at the edge. Clients that look automated but are not clearly hostile are given a proof-of-work puzzle rather than being refused outright.

We provide the Service on a subscription basis for the term you select. We do not host your application, we do not back it up, and we are not a content delivery network. If your Origin is down, the Service will faithfully report that it is down.

• You must give accurate registration details and keep them current. Invoices and security notices go to the address on file.
• You are responsible for everything done under your credentials. Enable multi-factor authentication and tell us immediately at support@deflecto.net if you suspect a compromise.
• One account covers one legal entity. Adding a Protected Property you do not control or are not authorised to protect is a breach of this agreement and of the AUP.
• You must be able to enter a binding contract, and you must not be a person or entity we are prohibited from dealing with under applicable sanctions law.

• Subscriptions are billed monthly in advance, on the anniversary of the day you subscribed, to the payment method on file.
• All prices are exclusive of VAT, sales tax, GST and any other tax or duty, which is added where we are required to charge it. If you are required to withhold tax, the amount payable to us is grossed up so that we receive the full fee.
• A failed payment is retried. If it has not cleared within 7 days we may suspend the Service on notice, and if it has not cleared within 30 days we may terminate the account under clause 9.
• We may change published prices with 30 days notice by email. A price change never applies within a billing month you have already paid for.

• Comply with the AUP. It forms part of this agreement and a breach of it is a breach of this agreement.
• Only route domains you own or are authorised to protect, and keep your DNS records accurate and pointed where you intend.
• Keep your Origin secured and patched, and restrict it so that it accepts traffic only from our network. A proxy in front of an origin that is still reachable by its own address protects nothing, and configuring that lockdown is your responsibility.
• Hold every licence, consent and registration your content and your business require, and keep your own privacy notices accurate about the fact that traffic passes through us.
• Do not resell, sublicense or provide the Service to third parties without a written reseller agreement with us. Protecting your own customers' sites as part of an agency or hosting business counts as reselling.
• Do not attempt to circumvent Quota measurement, reverse engineer the rule set for third parties, or perform load or penetration testing against the Service without written permission. See clause 6 of the AUP for the security research carve out.

For traffic to your Protected Properties you are the controller and we are the processor, on the terms set out in the Privacy Policy and in the data processing agreement we enter into with you. For your account data we are the controller. We process traffic data only to provide the Service and only on your instructions, which are expressed through your configuration and this agreement.

We own the Service, the rule sets, the software and everything we publish about it. You own your content, your configuration and your data. Neither of us gets any right in the other's property except the limited right to use the Service for its term.

We may name you as a customer and use your logo unless you tell us not to, which you may do at any time by email. Each party will keep the other's non-public information confidential and use it only for this agreement, for three years after disclosure, except where the law requires disclosure.

The Service evolves. We may add, change or remove features, and we may change rule sets and detection thresholds at any time, including without notice where a change is needed to counter an active threat. We will not materially reduce the core protection you subscribed to within a paid term.

We may change these terms on 30 days notice by email to the address on your account, with the change also published here and the date at the top updated. If a change materially disadvantages you, you may terminate before it takes effect and receive a pro rata refund of any prepaid fees for the unused period. Continuing to use the Service after the notice period is acceptance.

We warrant that we will provide the Service with reasonable skill and care and in accordance with clause 7.

Beyond that, and to the fullest extent the law allows, the Service is provided as it is and we exclude all other warranties, express or implied, including fitness for a particular purpose and non-infringement. In particular we do not warrant that the Service will be uninterrupted, that every attack will be mitigated without impact, that no legitimate request will ever be refused by a rule, or that no malicious request will ever reach your Origin. A WAF reduces risk. It does not eliminate it, and any vendor claiming otherwise is selling you a story.

Neither party limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited.

Subject to that, and to the fullest extent permitted by law, neither party is liable for indirect or consequential loss, loss of profit, loss of revenue, loss of anticipated savings, loss of goodwill, loss of business, or loss or corruption of data, whether or not it was foreseeable.

Subject to the same, our total aggregate liability arising out of or in connection with this agreement in any 12 month period is limited to the fees you actually paid us in the 12 months before the event giving rise to the claim.

These limits are a deliberate allocation of risk that the price reflects. A $15 plan cannot carry unbounded exposure for the revenue of the site it protects.

You will indemnify us against claims, losses and reasonable costs arising from your content, your use of the Service in breach of this agreement or the AUP, your infringement of a third party's rights, or a claim by one of your own end users relating to material you served through the Service.

Neither party is liable for a failure to perform caused by an event beyond its reasonable control, including war, civil unrest, natural disaster, epidemic, government action, failure of a transit provider or internet exchange, or a nationwide power or network outage. The affected party will tell the other and will resume as soon as it can. An attack against your Protected Property is not force majeure for us, it is the thing we are paid to handle.

• You may not assign this agreement without our written consent. We may assign it to a successor to our business on notice to you.
• Nothing here creates a partnership, joint venture or employment relationship.
• This agreement, the AUP and the Privacy Policy are the whole agreement between us on their subject, and replace anything said beforehand.
• If a provision is unenforceable it is severed and the rest stands.
• A failure to enforce a term is not a waiver of it.
• No third party may enforce any part of this agreement.
• Notices to you go to the email address on your account. Notices to us go to sales@deflecto.net.

This agreement and any dispute arising from it are governed by [[GOVERNING_LAW]], and the courts of [[JURISDICTION]] have exclusive jurisdiction.

Before starting proceedings, both parties will try in good faith to resolve the dispute by escalating it to a senior representative on each side for 30 days. That does not prevent either party from seeking urgent injunctive relief.

Contracts and plan changes: sales@deflecto.net. Operational and billing support: support@deflecto.net. Registered entity and address: DEFLECTO LLC, [[REGISTERED_ADDRESS]].