Limitations and FAQ
These are limits in the current product, not a roadmap. If a screen does not do something described here, the screen is the source of truth.
Product limits
- No self-serve volume discount. Quantity times list price.
- No published Campus Estate price.
- No live CVE feed. The virtual-patch list is a fixed catalog.
- No automatic promote, undo, or allowlist.
- No reconstruction of change history from before recording started.
- No stored trial-end timestamp, so the recap does not count days down.
- Analytics samples are not exact population totals. A full log warehouse is not in this version.
- One-click DNS credentials exist only for Cloudflare and GoDaddy.
- The free scan is passive. It is not a penetration test.
- Bot management is usage-priced by AWS and the product copy says it is included on the plan. Application DDoS protection is also usage-priced by AWS, starts in count, and is not on by default.
- The edge SLA is 99.9% for Live sites. Credits are requested by email. There is no public status page and no self-serve credit button.
Answers
Will you block attacks on day one?
No. Rules start in count. After the watch window, Copilot may say Promote. You click. Until that click, matching requests are counted, not blocked.
Is there a cheaper per-site price if I add many sites?
Not on self-serve checkout. The unit stays $150 a month (or $1,650 a year) times the number of sites. Campus Estate is a separate quote, and the price is not published.
Does the founder offer still work?
No. The old founder-era 50% promo is not the current price. A founder offer parameter is ignored at checkout. Refer-a-friend is the live discount.
Why does the trial recap not show days left?
The account record does not store the trial end. The recap says not confirmed instead of guessing from the signup date. The trial length is the one Stripe checkout started.
Does the free scan prove my site is safe?
No. It grades a public response: edge or not, HTTPS, six headers, and version leaks. It does not log in, it does not exploit anything, and it does not see origin software that the edge hides.
Do you store visitor IP addresses in the dashboard?
Copilot samples, change history, and alert mail do not store or send a full client IP. The last octet or IPv6 group is masked. The edge still processes addresses in order to filter, which the privacy policy describes.
Can every managed rule be on at once?
Not always. The WebACL budget is 1,500 WCU, and the dashboard shows the running total. Account takeover and account-creation fraud also need a path configured. Application DDoS protection is off until you add it.
Is the SLA a promise that setup finishes in a day?
No. The SLA is 99.9% monthly edge availability for a site that is already Live, with a service credit if we miss it. It does not cover your origin, your DNS, or the time spent waiting for a certificate.