Ask HN: How does your startup handle DDoS attacks?

Hi! That's a subject I'm pretty curious about, since most startups can't afford specialised equipment to mitigate medium/large-scale denial of service attacks. I haven't seen a lot of startups being very open about the subject too. Do you use Cloudflare? What service level? Is it good? Does it affect your users? Do AWS/DO/Linode/Rackspace have sufficient built-in protection? Have you ever had the plug pulled for too much/malicious traffic? Maybe your application/infrastructure can sustain handling a lot of requests and therefore doesn't need specific protection? In general, how do DDoS attacks affect your online business and how often are you subject to them? Tell us everything!