GuardX vs Cloudflare: an EU-based alternative for DDoS protection and WAF

02Company, contract and the law that applies

GuardX is run by Samuel Dierich as a sole proprietorship in Hamburg, Germany, under German law and with no US parent company (details in the imprint). For an EU customer that keeps the contract within one familiar legal system, though it does not settle every legal question. Art. 28 GDPR requires a processor contract for any proxy that handles your visitors' IP addresses; GuardX's data processing agreement is section 10 of its terms of service and applies to every customer without a separate signature.

Self-serve Cloudflare customers contract with Cloudflare, Inc. Cloudflare's privacy policy lists EU subsidiaries in Germany, France, the Netherlands, Portugal and Sweden, but they are not the contracting party under the self-serve agreement. Its DPA (version 6.4, April 2026) relies on Cloudflare's listing under the EU-US Data Privacy Framework, which the US register shows as active, with the next certification due on 15 September 2027, and falls back to standard contractual clauses. Cloudflare also commits to "pursue legal remedies" up to appeal level before producing personal data when a government request raises a conflict of law.

As a US company, Cloudflare is subject to US law, including the CLOUD Act provision covering data in a provider's "possession, custody, or control" wherever it is stored. Its H2 2025 transparency report lists 336 US criminal subpoenas and gives US national-security process only as a band of 0 to 249. Its transparency page also states that Cloudflare has never handed over its or its customers' encryption keys and has never given any law enforcement body a feed of customer content. None of this makes Cloudflare unlawful to use from the EU: the Data Privacy Framework is in force, the General Court upheld it on 3 September 2025, and an appeal is pending. The difference is which legal system your edge provider answers to first.

03Where your traffic is decrypted and logged

With GuardX, a visitor's TLS connection ends on GuardX's own servers in the Netherlands. Requests are inspected and cached there, on the free plan as on any other; request logs are stored in the EU and deleted after 90 days.

With Cloudflare, a request is by default decrypted wherever it enters the network, and logs "may be stored in Cloudflare's core data centers globally". The Data Localization Suite changes that, as an Enterprise-only paid add-on. With Regional Services set to the EU, decryption, cache, WAF and bot management run only in EU data centres, but traffic is still accepted at any Cloudflare data centre worldwide, where layer 3 and 4 DDoS mitigation is applied, and HTTP/3 is not compatible. With the Customer Metadata Boundary set to the EU, customer logs are sent only to Cloudflare's core data centre in the EU; dashboard users whose sessions are routed outside that region may see no analytics or log data unless "Allow out-of-region access" is turned on.

04DDoS mitigation, WAF and bot protection

On attack billing there is no difference: both include unmetered DDoS mitigation on every plan and neither charges more when an attack hits. The difference is scale. Cloudflare's network spans 348 cities and it states 500 Tbps of network capacity; GuardX runs from one location today and publishes no capacity figure. For very large volumetric attacks, that matters.

GuardX's WAF combines managed rules against scans, path traversal and exploit probes with custom rules that block, allow, challenge or log, and separate rate-limit rules. Cloudflare's WAF is capable but tiered: a free plan gets 5 custom rules and 1 rate-limiting rule, and its strongest bot detection and advanced rate limiting are Enterprise features. GuardX includes bot protection and serves its own challenge and captcha pages, as Cloudflare does with its challenge pages and Turnstile.

Outside HTTP, Cloudflare is ahead. Spectrum covers SSH and Minecraft from Pro as a paid add-on, with any TCP or UDP application on Enterprise, and Magic Transit protects whole networks on Enterprise. GuardX's GRE transit is announced but cannot be ordered yet.

05Price and support

Both free plans include a CDN, a WAF and unmetered DDoS mitigation. Above that the comparison stops: Cloudflare Pro costs USD 20 a month billed annually and Business USD 200, with a 100% uptime SLA from Business, while GuardX's paid plans are not on sale yet. GuardX prices in euros.

Support is where a small provider differs most. On GuardX's free plan you can email the people who run the platform, though GuardX publishes no response-time promise. Cloudflare's free plan gets the community forums and documentation, with support cases only for billing, account and registrar issues; tickets start on Pro, chat on Business, and 24x7 phone support on Enterprise.

06Where GuardX is the better fit

• You want TLS termination, inspection and logs on EU servers without negotiating an Enterprise contract
• Your edge provider should be a German business under German law, with no US parent
• You want up to 100 custom firewall rules and 100 rate-limit rules that count by header, cookie, ASN or country on a free plan; Cloudflare's free plan has 5 custom rules and 1 rate-limiting rule, and counting by those keys needs Enterprise
• You want to reach the people who run the platform by email, even on the free plan

07Who should stay on Cloudflare

We use Cloudflare ourselves for the guardx.to website, panel and nameserver records today, while they move to GuardX's own infrastructure. For other EU-based options, see the list of European Cloudflare alternatives.

• Your visitors are spread across continents, or you need to absorb attacks larger than one location can take
• You need an uptime SLA or published certifications today
• You build on Workers, R2, Pages, Turnstile or Cloudflare's Zero Trust products
• You need IPv6 or HTTP/3 at the edge, or protection for non-HTTP services now
• Procurement requires a large listed vendor with 24x7 phone support
• Your domain is on Cloudflare Registrar and you do not want to transfer it

08How to switch from Cloudflare to GuardX

• Create a free account and add the domain
• Export the zone from Cloudflare (DNS, Records, Import and Export) and import the file in the GuardX DNS panel; the import reads Cloudflare's proxied tags and turns proxying on for those hostnames
• If DNSSEC is on, remove the DS record at your registrar and wait for its TTL to expire; a domain on Cloudflare Registrar must be transferred out first
• New domains start in Flexible mode, which connects to the origin over plain HTTP: switch to Full (strict) with a publicly trusted origin certificate, because Cloudflare Origin CA certificates are trusted only by Cloudflare
• Allow GuardX's edge addresses, listed in the panel, in your origin firewall next to Cloudflare's ranges, and add the panel's secret origin header check (how to hide your origin IP)
• GuardX sends the visitor's address in X-Real-IP and X-Forwarded-For and also sets CF-Connecting-IP, so code written for Cloudflare keeps working; update your server's trusted proxy list (reverse proxy headers)
• Recreate WAF and rate-limit rules, then change nameservers at the registrar and watch the delegation with a DNS lookup