The EU-operated DDoS-Guard alternative, with a free plan

An EU operator, and a GDPR file you can actually assemble

If your customers are in the EU, your processor choice is not only a technical decision. You need a Data Processing Addendum, a current sub-processor list, a documented retention period for every category of personal data you hand over, a route for erasure requests, and a defensible answer about where the data physically goes. Itnetic publishes all of that in full rather than on request, and it is operated by a named Czech entity you can email directly.

• Operator: Petr Chlíbek, IČO 21210756, Czech Republic.
• Every retention period in the policy is enforced by a database TTL index, not a clean-up job that can silently stop running.
• DPA, sub-processors, retention and incident-response policies published in full.
• Erasure requests delete every record keyed to your account, across every collection.

Layer-7 mitigation that reads the shape of an attack

Volumetric floods are the easy half of the problem — they are loud, and the backbone absorbs them. The attacks that actually take sites down look like visitors: slow-drip request floods, credential stuffing, fake checkouts, scrapers rotating through residential addresses. Itnetic profiles every request by path, header shape and TLS fingerprint, and flips a host into challenge mode within a second of a spike, at the edge, without waiting for a control-plane round trip.

• Behavioral signatures match the shape of an attack, not just its volume.
• Repeat offenders are dropped in the kernel, so they cost nothing per request.
• Real visitors solve an invisible proof-of-work — never a CAPTCHA, never an image grid.
• An anomaly layer learns each host's own baseline, so a large site is never punished for being large.

Per-request logs, so you can audit the mitigation yourself

A protection service that only shows you aggregate graphs asks you to take its word for what it blocked. Itnetic keeps unsampled per-request logs on every plan, each entry carrying the TLS fingerprint, the client signature, the cookie echo class, the WAF verdict, the cache result, the serving origin and the origin timing. That is what lets you prove a cutover happened, find a bypass path hitting your origin directly, and tell a scraper apart from a customer instead of guessing.

A free plan, and no sales call to start

Signup is self-serve. The Starter plan is free, takes no card, and is not a feature-stripped demo — it is the same edge, the same pipeline and the same protections as the paid plans, including the waiting room, the WAF, the API and the logs. That matters most when you are evaluating under pressure: you can be protected while you are still deciding.

Switching from DDoS-Guard

Both services sit in front of your origin as a reverse proxy, so migration is a DNS change rather than a re-architecture. Add the domain, verify it, point two records — your nameservers and registrar stay where they are, which also means you can move one hostname across and leave the rest of the zone alone while you watch it behave. Most customers are fully protected within five minutes, and per-request logs let you confirm the cutover happened rather than assume it. Remember to firewall your origin to the edge afterwards, or the old direct path stays open.

Other comparisons

Same method, different provider — feature availability by plan, with the date it was checked.

• Itnetic vs Cloudflare
• Itnetic vs WEDOS Protection
• Itnetic vs CDN77