Cloud networking, built on OpenStack

Yes. Volumetric attacks are detected automatically and the affected traffic is redirected to a high-capacity scrubbing system before it reaches your instances. It is on by default, with nothing to configure and no separate charge. Application-layer filtering (L7 / WAF) is not part of the platform — you run it in front of your own services.

Security groups filter traffic at each instance on every interface, so you control what one machine accepts from another. The FWaaS edge firewall covers traffic to and from the internet; it doesn't yet filter between private networks (east-west).

Yes, if you choose an HA flavour. The flavour sets both size and topology: a single amphora, or an active-standby pair on separate hypervisors with VRRP failover. Six flavours are published in the price list — medium, large and xlarge, each in non-HA and HA.

No. The networking is standard OpenStack: private networks, routers, security groups, Octavia and FWaaS. The same API calls and configs run on any OpenStack cloud offering the same services, so you can move without rebuilding.

CloudFerro’s depth makes the difference: ISO 27001, BSI C5, and NATO, EU and ESA facility security clearances at company level, plus the clouds behind Copernicus and CODE-DE. Classified workloads themselves run on Private or Edge Cloud.

In the EU only. The entire network — regions, control plane, routing and network logs — sits on EU territory and is subject to EU law. CloudFerro runs regions in Warsaw, Frankfurt and Łódź; where your resources sit is where they stay.

CloudFerro is a Polish, EU-owned company with data centres only in the EU and no US entity. That puts it outside the reach of US laws like the CLOUD Act, which can compel US-owned providers to disclose data.

Private networks, subnets, routers, security groups and the FWaaS edge firewall are free. Traffic inside a project is free; traffic between projects and internet egress are billed per GB. The load balancer is billed at a flat monthly rate.

Yes. Every network object is a standard OpenStack API resource, so the upstream Terraform OpenStack provider works unchanged — set use_octavia = true for the load balancer. A separate CloudFerro provider covers Managed Kubernetes clusters.

Yes, dual-stack. IPv6 is included in the service price with no separate charge. A few things work differently from IPv4 by design: IPv6 addresses are routed to instances directly instead of through NAT, so there is no floating-IP equivalent and access is controlled with security groups