> For the complete documentation index, see [llms.txt](https://waf-doc.inext.checkpoint.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://waf-doc.inext.checkpoint.com/concepts/waf-as-a-service-waf-saas.md).
# WAF-as-a Service (WAF SaaS)
## Overview
CloudGuard WAF SaaS (also known as WAF-as-a-Service or WAFaaS) is a fully managed, cloud-native Web Application & API Firewall delivered over the internet.
You simply update your DNS to route traffic through our global points of presence (PoPs). They handle SSL termination (issuing and renewing certificates), DDoS and bot mitigation, and then securely forward legitimate traffic to your servers
The SaaS service implements a Reverse proxy function with CloudGuard WAF's security.
Using standard SSL/TLS technology ensures traffic remains secure and confidential from the moment it leaves the application client until it reaches you. Initially, data is transmitted and encrypted from the application client. Upon arrival at our WAF SaaS entry point, the data is decrypted for security inspection. Once inspected, it is re-encrypted and transmitted to the application securely.
{% hint style="info" %}
CloudGuard WAF SaaS supports elastic scaling for any bandwidth requirements. If you need bandwidth higher than 250 Gbps, please contact Check Point Support.
{% endhint %}
## Data Regions and Points of Presence (PoPs)
When creating an account to manage your security, a Data Region was selected. Data Residency refers to physical region where your configuration and logs are stored. Data Regions are currently available in:
* EU
* US
* India
* Australia
* Canada
With WAF SaaS there are also Points of Presence (PoPs). They are the physical locations where WAF workloads are deployed and traffic is actually inspected . For optimal performance, it is recommended to choose a PoP as close to your application servers as possible - this proximity ensures optimal latency.
Current available PoPs:
## DDoS Protection
CloudGuard WAF SaaS provides comprehensive L3-L7 DDoS Protection, see here:
{% content-ref url="/pages/PknEzxSz7EH2nw0cGBdV" %}
[DDoS Protection](/concepts/ddos-protection.md)
{% endcontent-ref %}
## Prerequisites
* Ownership of the DNS configuration for the protected domain.
* Accessibility - You must be able to configure your internal web server to be accessible from the IP addresses of WAF SaaS PoPs.
* Limiting access to your backend - you must be able to limit access to your back-end from WAF SaaS PoPs only so it is not exposed directly to the Internet.
For deployment instructions see here:
{% content-ref url="/pages/cNU6kl3aRd7rIdpu3RTT" %}
[WAF-as-a-Service (WAF SaaS)](/getting-started/deploy-enforcement-point/waf-as-a-service-waf-saas.md)
{% endcontent-ref %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://waf-doc.inext.checkpoint.com/concepts/waf-as-a-service-waf-saas.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.