Web application security, run in your own account.

How much does web application security cost?

Three flat plans per organization, on a 12-month term, billed monthly: Foundation at $395 a month for 3 domains, Protection at $595 a month for 5 domains, and Assurance at $795 a month for 10 domains. Extra domains are $50 a month each. After the first year, plans run month to month with 30 days' notice. A one-time onboarding ($1,500 for Foundation, $2,500 for Protection or Assurance) brings every domain up to the plan. Nonprofits and associations get 25% off every plan. One-time hardening without a plan is priced per domain and hostname from the Findings Remediation list.

Can you help us answer a customer's security questionnaire?

Yes, for the rows our work covers. A plan gives you current answers for encryption in transit, security headers, WAF and abuse protection, email authentication, a vulnerability disclosure contact, and a change log for your edge. Rows about access control and tenant isolation inside your app are covered by Release Verification. FEDLIN builds and evidences the controls; your team answers and signs the questionnaire.

Does this help with SOC 2?

It covers part of the readiness work. The plans build and evidence controls an auditor checks for boundary protection and data in transit (SOC 2 CC6.6 and CC6.7), and Assurance adds a quarterly review record. The SOC 2 attestation itself comes from a CPA firm.

What counts as a domain?

One registered domain with all of its subdomains. example.com, app.example.com, and www.example.com count as one domain, along with the email sent from it.

Does this cover our app and API, or just the website?

It covers everything that reaches the internet through your domains: the app, its API, sign-in and admin pages, the marketing site, and email. Who can sign in and what each role can read is the app itself; Release Verification and Penetration Testing cover that. Internal admin tools that only your team should reach can leave the public edge entirely under Remote Access Hardening.

Do we have to move our DNS to Cloudflare?

For a plan, yes. Plans run on Cloudflare in front of whatever hosts your app (Vercel, AWS, Netlify, or your own servers), and onboarding moves your DNS into your own Cloudflare account with no planned downtime. If you need to stay on Azure, AWS, or GCP edge services, FEDLIN engineers the same controls in native form as one-time hardening. Busy apps on Protection may need Cloudflare's Workers paid plan in your account.

Can you set up Cloudflare security for us?

Yes. Onboarding is a full Cloudflare security setup in your own account: SSL/TLS settings, security headers, WAF and abuse rules, DNS cleanup, and email authentication, each one validated and recorded. Your plan then keeps those settings current and puts them back if anything drifts. Teams that only want the setup can buy it as one-time hardening.

Do you work in our Cloudflare account, or host it yourselves?

In your account, by default. Your domains, DNS, and settings stay in your own Cloudflare account, and you can remove FEDLIN's access at any time; everything we configured stays in place. Teams without a Cloudflare account can have FEDLIN host the zone and move it to theirs later.

What isn't included in a plan?

Anything that lives on your servers: malware scanning and cleanup, backups, and CMS, plugin, or framework updates. Your host or one of our partners covers those, and we coordinate the edge side (blocking, rate limits, DNS rollback) while they work. Application code changes stay with your developers.

How fast do you respond to an incident at the edge?

On the Assurance plan, the first response comes within 4 business hours and edge containment (a WAF or rate-limit rule, or a DNS rollback) happens the same business day. Cleanup on the origin server is referred to your host or partner. Coverage runs on business days.

What do cyber insurers look at on our domain?

Most insurers run an outside-in scan before quoting: whether DMARC is published and enforced, which TLS versions your sites accept, expiring certificates, and services exposed to the internet. Run our free domain check to see the same signals, and a plan keeps them in good shape between renewals.

What is post-quantum key exchange, and do we need it?

Cloudflare offers hybrid key exchange (X25519 with ML-KEM-768) to browsers that support it, a method designed to resist future quantum attacks on recorded traffic. Every plan verifies it end to end, including the connection to your servers where they support it, and records it in your crypto inventory alongside TLS 1.3 and retired older protocols.

How do these controls map to NIST CSF 2.0, NIST 800-53, and SOC 2?

In NIST CSF 2.0 they sit mainly in Protect: PR.DS (data security, including encryption in transit) and PR.PS (platform security, including secure configuration), with edge monitoring supporting DE.CM (continuous monitoring). In NIST 800-53 terms they are SC-7 boundary protection, SC-8 transmission confidentiality and integrity, and SC-13 cryptographic protection. For SOC 2 they support CC6.6 (boundary protection) and CC6.7 (data in transit). The evidence is the audit results, change records, and quarterly memos, in a form a reviewer or GRC platform can take in.

What does an A+ on Mozilla Observatory mean?

Observatory starts every site at 100, subtracts points for missing or weak security headers and cookie settings, and adds bonuses for things like HSTS preload or a strict Content Security Policy. A+ means a score of 100 or more. Some customer security reviews use it as a quick outside benchmark.