Docs
What the product does, in the order you meet it. Every page matches the current app. Where something is partial, the page says so.
Start
Count to promote
Promote Copilot
Promote, Hold, or Needs allowlist. The decision order, the reasons, and the “what would change this” line. You still click Promote.
Tuning and the count window
The Tuning timeline runs to 7 days. Promote still uses the latest 24-hour rollup. A missing series says not confirmed.
Allowlists
Needs allowlist means a known-good path was sampled. You save an exact path. Copilot does not write it, and the allowlist is not a block.
Promote, confirm, and undo
Preview the rule, confirm when it counted hits, then undo by switching it back to count. Nothing auto-rolls back.
Change history
A read-only per-site log of protection changes. Events from before recording started are not reconstructed. Full IP addresses are not stored.
Virtual patch advisories
A fixed catalog (2026.10.1) maps threat classes to managed groups you can add in count. It does not say a site is vulnerable.
Watch
Alerts and the weekly digest
Spike mail at 200 blocked requests an hour, a 6-hour cooldown, and a weekly email. Copilot never blocks from an alert.
Ready-to-promote email
One email when a new rule looks safe to promote. It lists ready, hold, and needs-allowlist. The same set does not send again.
Trial recap
Trialing accounts see requests, threats, the top attack class, and rules waiting for Promote. A missing series says not confirmed.
Estate Brain
A read-only multi-site rollup: who needs a human, which attack classes hit more than one site, and which virtual-patch groups are off.
Protection report
A printable per-site report of go-live state, traffic, Copilot, and allowlists. Missing numbers stay “not confirmed.”
Free scan and the report grade
A passive public check of edge protection, HTTPS, six security headers, and version leaks. Grades run from A at 90 to F below 55.
Account
Account and DNS credentials
Email or Google or Apple sign-in, authenticator MFA, owner-invited admins, and hidden Cloudflare or GoDaddy credentials.
Billing and trial
$150/site/month or $1,650/year. 14-day trial. No self-serve volume discount. The old founder promo is not the price.
Multi-site and enterprise
Several sites on one account, a what-needs-you queue, Estate Brain, client labels, and a support fleet console that customers do not get by signing up.
Security and privacy
What the account stores, how Copilot masks IP addresses, and the optional origin-verify header. The privacy policy is the legal notice.
Limits
What we never do
No automatic blocking, no automatic rollback, no automatic allowlist. Promote is a click. Copilot only recommends.
Limitations and FAQ
What this version does not do: no volume discount, no live CVE feed, no stored trial countdown, and no promise that every attack is stopped.
Changelog
Customer-visible changes taken from git history. Internal build, cache, and deploy commits are left out.