Every verdict is explainable
If we filter a click, the log says which signal decided it — the ASN, the fingerprint mismatch, the request cadence. A black-box score is indistinguishable from a coin flip you cannot audit.
About
We built the layer we kept having to build by hand.
CloakShield Pro is a security layer for teams already routing traffic through Cloaking House, Keitaro, Voluum or something home-grown. It scores the click before your router sees it, and it watches the page after the click lands.
Why it exists
In 2021 the four of us were running acquisition for a payments client and losing about a fifth of the budget to traffic that was never going to convert — scraper fleets, compliance sweeps, residential proxy pools rented by the hour. The router did its job perfectly. It just had no idea what it was routing.
So we wrote a scoring service in front of it. Then we wrote it again for the next client, and again for the one after that, each time re-deriving the same ASN lists, the same TLS fingerprint checks, the same timezone-versus-carrier comparison. The fourth rewrite became the product.
The design constraint has never changed: we sit beside your stack, not on top of it. If you turn CloakShield Pro off tomorrow, your campaigns keep running. That is deliberate — a filtering layer you cannot remove is a filtering layer you cannot trust.
How we run it
- Verdicts are computed across 38 edge PoPs. The p95 is 7.2 ms; the median is 2.4 ms.
- Every verdict is logged with the signal that produced it. No score without a stated reason.
- We store how a request was scored, never your offers, creatives or page contents.
- Signal lists — ASN ranges, datacenter blocks, known crawler fingerprints — update every 30 minutes.
- Rules ship behind a shadow mode first, so you see what a change would have filtered before it filters anything.
- Two engineers carry the pager. Neither of them is an autoresponder.
Principles
Four commitments we will not trade away
Your content stays yours
We hold configuration, verdicts and integrity hashes. We do not store your landing pages, your creatives or your offer terms, so a breach of us is not a breach of your campaign strategy.
Leaving is one DNS record
Onboarding is a CNAME. Offboarding is deleting it. There is no proprietary tag buried in your funnel and no migration project waiting for you at the end of a contract.
Pricing that does not punish success
Plans are priced per month, not per click. A campaign that suddenly works should not generate a surprise invoice, and you should never have to choose between filtering traffic and affording to filter traffic. The multi-month discounts on the pricing page are the whole discount structure — there is no enterprise pricing conversation where the real numbers live.
People
Eleven people, six countries, one pager rotation
Small enough that the person who answers your ticket wrote the code it is about.
Marek Kowalczyk
Co-founder · Engineering
Wrote the first scoring service in a hotel lobby in Kraków. Owns the edge runtime and the parts of the verdict pipeline nobody else wants to touch.
Rasha Abdelnour
Co-founder · Product
Ran paid acquisition for eight years before this. Decides what ships based on whether it would have saved her old budget, which is a harsher filter than it sounds.
Toby Nkemelu
Signals research
Maintains the ASN and fingerprint corpus. Spends an unreasonable share of his week reading TLS handshakes and arguing that a heuristic is not evidence.
Ines Saltzmann
Security & compliance
Runs the SOC 2 programme, the annual pen test and the subprocessor register. Also the reason shadow mode exists before every rule change.
Diego Varela
Support lead
Answers Telegram. Has migrated more Keitaro and Voluum setups than the rest of the team combined and will tell you honestly if yours is a bad fit.
Six more
Engineering & operations
Edge infrastructure, integrations, integrity monitoring and the on-call rotation across CET, GMT and PST.
Security & compliance
What we can show you before you sign anything
SOC 2 Type II
ISO 27001
GDPR & UK GDPR
CCPA
US · EU · APAC residency
TLS 1.3 · AES-256
Documents we will send you
- SOC 2 Type II report, current audit window, under a mutual NDA.
- Data processing agreement with the EU Standard Contractual Clauses and UK IDTA appended.
- Subprocessor register, with 30 days' notice before anyone is added.
- Latest independent penetration test summary letter.
- Architecture note describing exactly which fields leave your edge and which never do.
Reporting a vulnerability
Mail Cloakshield.pro@outlook.com with SECURITY in the subject. We acknowledge within one business day and give you a triage decision within five.
We will not pursue legal action against good-faith research that stays within a test account, avoids other customers' data, and gives us 90 days before disclosure. We credit reporters by name unless you would rather we did not.
Breach notification is 72 hours from awareness, to you and to the relevant supervisory authority, in line with the privacy notice.
Support
What "we will get back to you" actually means
Starter
Email and Telegram, answered within 24–48 hours on business days. Full documentation and the integration guides for every supported router.
Professional
Priority queue, first response inside 8 business hours, and a shared Telegram channel with the engineers on rotation rather than a ticket robot.
Enterprise
A named engineer, a 1-hour response target for anything affecting live traffic, and a quarterly review of your verdict mix against your conversion data.
When something is actually broken
Incidents affecting verdict delivery page the on-call engineer immediately, regardless of plan — a filtering layer that fails quietly is worse than no filtering layer. Status and postmortems go to every affected account by email, including the ones on Starter.
Contact
Talk to someone who has seen your setup before
Tell us what you route with and where the traffic comes from. If we are a bad fit for it we will say so — that conversation is cheaper for both of us than a refund.
Telegram
Fastest route to a human. Usually answered within the hour.
Cloakshield.pro@outlook.com
Sales, support, billing, security reports and DPA requests.
See the workspace first
The verdict log, integrity monitor and latency view, before you sign up.
Company details
- Legal entity
- CloakShield Pro Ltd
- Registered office
- Unit 4, 71–75 Shelton Street, London WC2H 9JQ, United Kingdom
- Engineering
- ul. Lubicz 17, 31-503 Kraków, Poland
- Support hours
- Monday–Friday, 07:00–21:00 UTC. On-call paging is 24/7 for live-traffic incidents.
- Billing
- Cryptocurrency only — BTC, ETH, SOL and USDT on ERC-20, TRC-20 or BEP-20. Invoices issued on request.
- Data protection
- Cloakshield.pro@outlook.com, subject line DPO
Start with one campaign and one CNAME.
Create an account in two fields, choose a term, pay in crypto. Rolling back is deleting a DNS record.