Cloud or Endpoint WAF?

I am onsidering switching from Wordfence. however this is what they claim…

“Wordfence runs at the endpoint, your server, providing better protection than cloud alternatives. Cloud firewalls can be bypassed and have historically suffered from data leaks. Wordfence firewall leverages user identity information in over 85% of our firewall rules, something cloud firewalls don’t have access to. And our firewall doesn’t need to break end-to-end encryption like cloud solutions.”

Is Cleantalk Security running at the endpoint or in the cloud?

Plus, are there features of Wordfence not covered in Cleantalk Security? Or features Cleantalk Security has that Wordfecne doesn’t?