1. Who we are and what these terms cover
OpenWAF Cloud (“OpenWAF”, “we”, “us”) is a managed web application firewall (WAF) and authoritative DNS service operated by AI Services LLC, trade name OpenWAF, 99 Wall Street #2351, New York, NY 10005, USA. The full company details are in the Legal Notice.
These Terms of Service govern the use of the OpenWAF Cloud service, its API and its command-line tool (openwaf-cloud ctl). By requesting early access, creating an account or using the service, you accept these terms on behalf of the organisation you represent (the “customer”).
2. Who can use OpenWAF
OpenWAF is a service for businesses. It is intended for agencies, companies and professionals that manage websites, including websites of their own clients. To use it you must:
- be at least 18 years old;
- use it for a business or professional purpose; and
- have the authority to accept these terms on behalf of the company or organisation you represent.
3. Early access
OpenWAF is currently in early access. This means:
- early access is requested by e-mail to [email protected]; sign-up is not self-service yet;
- the service is free and has no limits, subject to fair use as described in the Acceptable Use Policy;
- features may change, be added or be removed, and some announced features (such as the web dashboard) are not available yet;
- there is no service level agreement (SLA). We operate the service on a best-effort basis.
4. Account, members and API tokens
Each customer has an account. You can give other people of your organisation access to the account as members. You are responsible for everything done through your account, by your members and with your API tokens.
API tokens are credentials. Keep them secret, give them only to people and systems that need them, and revoke them if you think they have been exposed. Tokens expire (at most after 365 days). Tell us at [email protected] without delay if you detect unauthorised use of your account.
5. Your domains and your clients
You may only add domains to OpenWAF that you control, or that you are authorised to manage by their owner. If you are an agency and you add domains of your clients, you warrant that:
- each client has authorised you to place its domain and website behind OpenWAF;
- you will inform your clients that OpenWAF processes the traffic of their websites, and pass on to them the information they need, including the information on cookies in section 4 of our Cookie Policy.
6. What delegating your nameservers means
Each account has a fixed pair of nameservers under ns.openwaf.dev. When you change a domain’s nameservers at your registrar to those nameservers:
- we answer DNS queries for that zone with the records you configure;
- we proxy the hostnames you mark as “proxied”: their traffic passes through our edge nodes, where the WAF rules you configure are applied before the request reaches your server (the “origin”);
- if the delegation is later removed, the zone stops being active in OpenWAF.
You are responsible for your DNS records, your WAF configuration and the security of your origin servers. A WAF reduces risk but does not give absolute protection: it can block legitimate traffic (false positives) and it can fail to detect attacks (false negatives). Configure it, monitor it and keep your own applications up to date.
7. TLS certificates
To serve your proxied hostnames over HTTPS, we request TLS certificates on your behalf from Let’s Encrypt, a certificate authority run by Internet Security Research Group. By using the service you authorise us to request, renew and revoke those certificates for your hostnames, and you accept the Let’s Encrypt Subscriber Agreement for them.
You can also upload your own certificates. If you do, you warrant that you have the right to use them and their private keys. We store those private keys only to serve TLS for your hostnames.
8. Data protection
Our Privacy Policy explains how we handle personal data as controller. For the traffic of your websites and the e-mail addresses you authorise in the access gate, you are the controller and we act as your processor. That processing is governed by our Data Processing Agreement, which forms part of these terms.
9. Acceptable use
The Acceptable Use Policy forms part of these terms. You must follow it, and you must make sure that the websites you place behind OpenWAF follow it.
10. Fees
The service is free during early access. We may introduce paid plans in the future. If we do, we will tell you by e-mail at least 30 days in advance, and we will not charge you anything without your explicit acceptance. See Pricing.
11. Availability and changes to the service
We work to keep the service available, but we do not guarantee that it will be uninterrupted or error-free. We may change or remove features. If we decide to discontinue the service, we will tell you by e-mail at least 30 days in advance, so that you can move your nameservers to another provider.
12. Suspension and termination
You can stop using OpenWAF at any time: move your domains’ nameservers to another provider and ask us at [email protected] to delete your account.
We may suspend all or part of the service (for example, proxying or DNS for one hostname) or close your account if you breach these terms or the Acceptable Use Policy. We may act immediately when that is necessary to stop serious harm, such as phishing or malware, or when the law requires it. We will notify you whenever possible, and you can contest the decision by replying by e-mail.
13. Intellectual property and feedback
The service, its software, documentation and brand belong to AI Services LLC or its licensors. These terms give you the right to use the service while your account is active; they do not transfer any other rights to you. Your content, your configuration and your websites remain yours.
If you send us suggestions or feedback, we may use them freely to improve the service, without any obligation to you.
14. Disclaimer of warranties
To the extent permitted by law, the service is provided “as is” and “as available”, without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose and non-infringement, and without any guarantee that it will stop every attack.
15. Limitation of liability
To the extent permitted by law:
- we are not liable for indirect or consequential damages, such as loss of profits, revenue, data or business opportunities;
- our total liability for all claims related to the service is limited to the greater of the amounts you paid us in the 12 months before the event that caused the claim, or USD 100.
These limits do not apply to damage caused by wilful misconduct or gross negligence, nor where the law does not allow liability to be limited or excluded. If you are a consumer, nothing in these terms affects the rights that the law gives you and that cannot be waived.
16. Indemnity
You will indemnify and hold AI Services LLC harmless against claims by third parties, and the related costs, arising from the content of the websites you place behind OpenWAF, or from domains you added without being authorised to do so.
17. Changes to these terms
We may update these terms. If a change is significant, we will tell you by e-mail at least 30 days before it takes effect. If you do not agree, you can stop using the service before that date. The date of the latest version is shown at the top of this page.
18. Governing law and jurisdiction
If you are a consumer residing in the European Union, these terms are governed by Spanish law, you keep the mandatory protections of the law of your country of residence, and you may bring proceedings before the courts of your place of residence. In all other cases, these terms are governed by the laws of the State of New York, USA, and any dispute will be submitted to the courts of the State of New York.
19. Contact
For any question about these terms, write to [email protected]. To report abuse, write to [email protected]. To report a vulnerability, see our security page and security.txt.