CloFix WAF - Transparent Pricing

SaaS - Zero-ops agility. Deploy in minutes, no infrastructure overhead, automatic updates, and elastic scaling on demand. | Dedicated - Maximum control & compliance. Isolated infrastructure, bring-your-own-cloud or our datacenter, full customization, named engineer, and enterprise SLA up to 99.999%.

OWASP CRS AI-Powered Detection 4 Scripting Engine PCI-DSS / HIPAA / GDPR Sub-10ms Latency 24/7 Support

SaaS Feature Comparison

Doc ID: CF-DHA-2026-001

WAF Dedicated Hosting Agreement

CloFix Infotech - Standard Service Agreement (Global)

Effective: January 1, 2026 Jurisdiction: International Governing Language: English

Definitions & Parties

"Provider" means CloFix Infotech, a company registered under applicable law, providing WAF and cybersecurity services globally.

"Client" means the legal entity or individual that executes this Agreement or clicks "Accept" on the online order form.

"Service" means the CloFix WAF Dedicated Hosting package selected by the Client, as described in the applicable Order Form.

"Effective Date" means the date the Client's order is confirmed in writing or electronically by the Provider.

"Subscription Term" means the initial contract period (12 months unless otherwise stated) and any renewal periods.

Scope of Services

Provider shall deliver the following under the selected Dedicated Hosting tier:

Dedicated WAF reverse-proxy infrastructure (isolated VM or bare-metal, as specified)
CloFix WAF software license for the contracted number of domains
Full OWASP Core Rule Set (CRS) engine with AI-powered behavioral analysis
DDoS mitigation at L3/L4/L7 layers with volumetric, protocol, and application-layer detection
WASM module execution engine (TinyGo / Rust / C / AssemblyScript)
Lua & JavaScript custom scripting engines
JA3/JA4 TLS fingerprinting and device behavioral analysis
ClickHouse-backed analytics, logging, and real-time dashboards
Monthly maintenance: security patches, rule updates, version upgrades
Initial onboarding, DNS migration support, and SSL provisioning

Deployment & Infrastructure

The Client may elect one of the following deployment models, subject to availability and tier eligibility:

Client's Cloud AWS, GCP, Azure, DigitalOcean, Linode, Vultr, or any VPS provider. Client retains cloud billing. Provider manages the WAF layer.

Provider Datacenter Hosted on CloFix-managed servers. Infrastructure costs included in the annual hosting fee.

On-Premise Client-owned hardware. Provider delivers remote installation, configuration, and ongoing management. Enterprise tier only.

Hybrid Primary on Provider datacenter, failover on Client cloud. Available on Business & Enterprise tiers.

Service Level Agreement (SLA)

Starter

95%

Credit: 5% per hour beyond SLA

Business

98%

Credit: 10% per hour beyond SLA

Enterprise

99%

Credit: Custom per contract

Downtime is measured from the time a verified incident ticket is opened to resolution. Scheduled maintenance windows (notified ≥ 48 hours in advance) are excluded from SLA calculations. Service credits are applied as invoice deductions in the following billing cycle and do not entitle the Client to a cash refund.

Payment Terms & Billing

Annual Hosting & License: Invoiced annually in advance on the Effective Date anniversary.
Monthly Maintenance: Invoiced on the 1st of each calendar month.
Setup Fee: Invoiced on the Effective Date; due before provisioning begins.
Payment Window: Net-7 days from invoice date.
Late Payment: 1.5% per month (18% per annum) on overdue balances.
Currencies Accepted: BDT (Bangladeshi Taka), USD, EUR, GBP, SGD.
Payment Methods: Bank transfer (SWIFT / local), bKash, Nagad, Payoneer, Wise, Stripe.
Taxes: All fees are exclusive of applicable taxes (VAT, GST, withholding tax). Client is responsible for taxes in their jurisdiction.
Price Adjustments: Provider may adjust pricing with 60 days' written notice prior to renewal. No mid-term price increases.

Term, Renewal & Termination

Initial Term: 12 months from the Effective Date, unless a custom term is specified in the Order Form.
Auto-Renewal: Automatically renews for successive 12-month periods unless either party provides written notice of non-renewal at least 30 days before the term end.
Early Termination by Client: Client may terminate with 30 days' written notice. No refund of pre-paid annual fees; monthly maintenance ceases at termination date.
Termination for Cause: Either party may terminate this Agreement under the following conditions: CloFix. reserves the right to terminate the Service immediately at its sole discretion, including for policy violations, misuse, non-payment, or security risks. The Client may terminate the Agreement by providing a minimum of thirty (30) days prior written notice, provided that all outstanding payments and obligations have been fully cleared before termination becomes effective..
Data Handling: Upon termination, all Client data will be permanently destroyed at the end of the notice period.

Support Channels & Response Times

Severity	Description	Starter	Business	Enterprise
P1 Critical	Service down / active breach	8 business hrs	1 hr (24/7)	15 min (24/7)
P2 High	Major feature impaired	1 business day	4 hrs (24/7)	1 hr (24/7)
P3 Medium	Degraded performance	3 business days	1 business day	4 hrs
P4 Low	General questions / config help	5 business days	2 business days	1 business day

Channels: Starter - Email; Business - Email + WhatsApp; Enterprise - Email + WhatsApp + Phone + Dedicated Slack Channel + Named Engineer.

Security, Compliance & Data Protection

All Dedicated plans are eligible for PCI-DSS v4.0, HIPAA, SOC 2 Type II, and ISO 27001 compliance assistance. Compliance audit reports available upon request under NDA.
Data at rest is encrypted using AES-256. Data in transit uses TLS 1.2 minimum (TLS 1.3 preferred).
Provider undergoes annual third-party penetration testing. Executive summary reports shared with Business & Enterprise Clients.
Vulnerability disclosure: Provider will notify Client within 72 hours of any confirmed breach affecting Client data.

Intellectual Property & License

Provider grants Client a non-exclusive, non-transferable, revocable license to use the CloFix WAF software solely for Client's own internal business operations during the Subscription Term. All source code, algorithms, rule sets, and product documentation remain the exclusive property of CloFix Infotech. Client may not: (a) reverse-engineer the software; (b) sublicense or resell without a valid Reseller Agreement; (c) remove or obscure proprietary notices.

Limitation of Liability & Indemnification

To the maximum extent permitted by applicable law:

Provider's total aggregate liability under this Agreement shall not exceed the total fees paid by Client in the 12 months preceding the claim.
Client's shall be liable for indirect, incidental, consequential, punitive, or special damages own servers.
Provider shall indemnify Client against third-party intellectual property infringement claims, unauthorized access incidents, and policy violations relating to the CloFix WAF software itself.

Force Majeure

Neither party shall be liable for delays or failures in performance resulting from causes beyond its reasonable control, including acts of God, war, terrorism, government actions, internet backbone failures, pandemics, or natural disasters. In addition, CloFix shall not be liable for any issues, failures, or damages arising from the Client’s application, code, configuration, or misuse of the service.

Governing Law & Dispute Resolution

Primary Jurisdiction: The laws of the People's Republic of Bangladesh shall govern this Agreement.
International Clients: Parties may mutually agree in the Order Form to apply the laws of Singapore, England & Wales, or the State of Delaware (USA) for cross-border engagements.
Dispute Resolution: Parties shall first attempt good-faith negotiation and both parties will cooperate in good faith to identify and resolve the issue and take reasonable steps to prevent recurrence in the future.
Language: All proceedings shall be conducted in English and Bangla.

Confidentiality

Each party agrees to keep confidential all non-public information of the other party designated as confidential, or that a reasonable person would understand to be confidential. Confidentiality obligations survive termination for 3 years. Exclusions apply to information that is: (a) publicly known without breach; (b) already known to the recipient; (c) independently developed; (d) required to be disclosed by law or court order (with prior notice to the disclosing party where legally permissible).

Acceptable Use Policy (AUP)

Client shall not use the Service to:

Launch offensive attacks or penetration tests against third parties without explicit authorization
Distribute malware, spam, or illegal content
Engage in cryptocurrency mining or resource-intensive activities unrelated to WAF operations
Violate any applicable export control laws or sanctions (OFAC, EU, UN)
Resell or sublicense the Service without a written Reseller Agreement from Provider
Violate any applicable laws or regulations of the Client’s own country or jurisdiction

Violation of this AUP may result in immediate suspension with no refund, and may be reported to relevant authorities.

Amendments & Entire Agreement

This Agreement, together with the applicable Order Form and any addenda (DPA, NDA, Reseller Agreement), constitutes the entire agreement between the parties and supersedes all prior negotiations, representations, or agreements relating to its subject matter. Provider may update these terms with 30 days' notice via email or dashboard notification. Continued use of the Service after the notice period constitutes acceptance. Any modification requires written consent of both parties.