Cloudflare
CDN edge · cloudflare.com · last read 2026-11-09
At a glance
- Is Cloudflare GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Cloudflare itself publishes, each answer linked to its source and the date we read it.
- Does Cloudflare have a data processing agreement (DPA)?
- Yes. Cloudflare publishes a data processing agreement at cloudflare.com. It gives 30 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
- Which version of the Cloudflare DPA is current?
- On 2026-11-09, Cloudflare's DPA at cloudflare.com printed “Version 6.4, effective April 3, 2026”. Source and date
- Does Cloudflare have a SOC 2 report?
- Cloudflare states SOC 2 Type 2 on its own page, but does not say there how to get a report. In Cloudflare's words: “SOC 2 Type II Certification to attest to Security, Confidentiality, and Availability controls in place in accordance to the AICPA Trust Service Criteria.” We read this on 2026-10-26. Source and date
- Is Cloudflare ISO 27001 certified?
- Cloudflare states ISO/IEC 27001 (2022 edition, as Cloudflare names it) on its own page, but does not say there how to get the certificate. In Cloudflare's words: “ISO 27001:2022 Implementation of an Information Security Management System (ISMS) and security risk management processes certification.” We read this on 2026-10-26. Source and date
- Where is Cloudflare's trust center?
- Cloudflare publishes a page it calls “Trust Hub” at cloudflare.com/trust-hub. Its front page shows no request or sign-in step; documents further in may still have one. The page mentions SOC 2 and ISO 27001. We read it on 2026-11-03. Source and date
- How does Cloudflare transfer personal data out of the EU?
- Cloudflare's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. Cloudflare, Inc. is on the official Data Privacy Framework List (status: Active). Source and date
- Does Cloudflare offer EU data residency?
- An EU location exists but only on the enterprise tier. Plan it needs: Enterprise. Source and date
- Who are Cloudflare's subprocessors?
- Cloudflare lists 12 third-party subprocessors; 11 of them name at least one processing country outside the EEA. We last read the list on 2026-10-05. Source and date
- How do you report a security vulnerability to Cloudflare?
- Cloudflare publishes a security.txt at www.cloudflare.com naming https://hackerone.com/cloudflare or https://www.cloudflare.com/abuse/. The file falls short of RFC 9116: no Expires field. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Cloudflare, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | 5493007DY18BGNLDWU14 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | cloudflare.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Cloudflare data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Enterprise only | Enterprise | developers.cloudflare.com | 2026-09-18 |
EU: The page labels the Data Localization Suite an "Enterprise-only paid add-on". It says organizations subject to GDPR can use it to control where encryption keys, traffic metadata and logs are kept.
The same question for every vendor: where SaaS vendors store EU data.
Subprocessor chain
12 third parties · 18 of the vendor's own group companies · 11 with a country outside the EEA · all read 2026-10-05
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services (AWS) | US, EU | Cloudflare Email Security (formerly Area 1) |
| Anthropic PBC | US | AI Gateway |
| CoreWeave, Inc. | US | Workers AI |
| Google LLC | EU, US, AU, IN | Cloudflare Developer Platform, Cloudflare Zero Trust and AI Gateway |
| Groq, Inc. | US | AI Gateway |
| Nebius BV | GB | Workers AI |
| OpenAI, Inc. | — | AI Gateway |
| Oracle America, Inc. | US, EU, GB, JP, AU, CA, SG | Cloudflare Developer Platform and Cache Reserve |
| Salesforce, Inc. | US | Customer support and account management |
| Slack Technologies, Inc. | US | Customer support communications |
| X.AI Corp. | US | AI Gateway |
| Zendesk, Inc. | US, EU, JP, AU | Customer support and account management |
Cloudflare's own group companies listed as subprocessors (18)
| Company | Country | Purpose |
|---|---|---|
| Area 1 Security, LLC | US | Account and engineering support |
| Cloudflare (Canada) Information Technology Co., Ltd. | CA | Account and engineering support |
| Cloudflare Australia Pty Ltd | AU | Account and engineering support |
| Cloudflare Capability Center (India) Private Limited | IN | Account and engineering support |
| Cloudflare France SAS | FR | Account and engineering support |
| Cloudflare Germany GmbH | DE | Account and engineering support |
| Cloudflare India Private Limited | IN | Account and engineering support (for India customers only) |
| Cloudflare Japan K.K. | JP | Account and engineering support |
| Cloudflare Korea LLC | KR | Account and engineering support |
| Cloudflare Ltd. | GB | Account and engineering support |
| Cloudflare Malaysia Sdn. Bhd. | MY | Account and engineering support |
| Cloudflare Mexico S. de R.L de C.V. | MX | Account and engineering support |
| Cloudflare Middle East FZ-LLC | AE | Account and engineering support |
| Cloudflare Netherlands B.V. | NL | Account and engineering support |
| Cloudflare Portugal, Unipessoal Lda. | PT | Account and engineering support |
| Cloudflare Pte. Ltd. | SG | Account and engineering support |
| Cloudflare Sweden AB | SE | Account and engineering support |
| Cloudflare Switzerland GmbH | CH | Account and engineering support |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · cloudflare.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | At least 30 days before processing begins, by adding new sub-processors to the list at https://www.cloudflare.com/gdpr/subprocessors/ |
| If you object to one | Customer may object to sub-processors under the EU SCCs in the manner set out in clause 4.4 of the DPA |
| If you object to one | Object in writing on reasonable data-protection grounds within 10 days of the notice. The parties then try to resolve it in good faith. If it can't be resolved and Cloudflare still needs the sub-processor, the customer may terminate the affected Order Form for the affected Services. If the customer doesn't object in time, it is deemed to consent. |
| Obligations passed to subprocessors | Written contract with sub-processors imposing data protection obligations no less protective than this DPA; Cloudflare remains liable for sub-processor breaches |
| Breach notification | without undue delay after becoming aware |
| Deletion when the service ends | After termination or expiry of the Main Agreement or completion of the Service, deletes or returns all Personal Data, including copies, at Customer's choice, except as needed to comply with applicable law |
| Getting your data back | After termination or expiry of the Main Agreement or completion of the Service, Customer can choose to have all Personal Data returned instead of deleted |
| Requests from data subjects | Promptly notifies Customer of data subject requests it receives (where it can verify the data subject is associated with Customer) and does not respond without Customer's prior written consent, except to confirm the request relates to Customer; provides reasonable assistance at Customer's cost |
| Audit | Audit right under the EU SCCs exercised as set out in, and subject to, clause 5 of the DPA |
| Audit | Independent external audit report no older than 13 months, plus information on request. If data is subject to the EU SCCs and that information is insufficient, one onsite audit per year under clause 5.3. |
| Audit | Review of audit reports; if insufficient (EU SCCs data), one onsite audit per annual period, scope agreed in advance; Cloudflare may charge a reasonable-cost fee |
| Transfer impact assessment | Reasonable assistance with customer's transfer adequacy assessment, to the extent able, at customer's cost |
| Processing on your instructions | Only for the purpose of providing the Services and in accordance with Customer's written instructions in the Main Agreement and DPA, unless required by Union or Member State law (Customer informed beforehand unless prohibited) |
| Confidentiality of staff | Only authorized personnel have access; authorized persons under contractual or statutory obligations of confidentiality |
| Security measures | Appropriate technical and organizational measures, including the Security Measures set out in Annex 2; updates may not degrade overall security |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
On 2026-11-09, the agreement printed: Version 6.4, effective April 3, 2026
at cloudflare.com
Version 6.4 · In effect from 2026-04-03
This version is in our copies from 2026-10-09.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Does Cloudflare have a SOC 2 report?
Cloudflare states SOC 2 Type 2 on its own page, but does not say there how to get a report. We read this on 2026-10-26.
- Claimed “SOC 2 Type II Certification to attest to Security, Confidentiality, and Availability controls in place in accordance to the AICPA Trust Service Criteria.”
Source: cloudflare.com, 2026-10-26
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Cloudflare ISO 27001 certified?
Cloudflare states ISO/IEC 27001 (2022 edition, as Cloudflare names it) on its own page, but does not say there how to get the certificate. We read this on 2026-10-26.
- Claimed “ISO 27001:2022 Implementation of an Information Security Management System (ISMS) and security risk management processes certification.”
Source: cloudflare.com, 2026-10-26
On the same list Cloudflare also names ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701. Each standard's page says how it relates to ISO/IEC 27001.
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| Global CBPR · APECCBPR | Certificate published | — | cloudflare.com | 2026-10-26 |
| Global PRP · APECPRP | Certificate published | — | cloudflare.com | 2026-10-26 |
| C5:2020 · C5 | Claimed | — | cloudflare.com | 2026-10-26 |
| CSA STAR · CSA | Certificate published | — | cloudflare.com | 2026-10-26 |
| Cyber Essentials · CyberEssentials | Certificate published | — | cloudflare.com | 2026-10-26 |
| ENS | Claimed | — | cloudflare.com | 2026-10-26 |
| EU Cloud Code of Conduct · EUCloudCoC | Certificate published | — | cloudflare.com | 2026-10-26 |
| FedRAMP High · FedRAMP | Claimed | — | cloudflare.com | 2026-10-26 |
| GovRAMP | Claimed | — | cloudflare.com | 2026-10-26 |
| HIPAA | Available on request | — | cloudflare.com | 2026-10-26 |
| IRAP | Claimed | Cloudflare for Government-Australia | cloudflare.com | 2026-10-26 |
| ISMAP | Claimed | Cloudflare for Government-Japan | cloudflare.com | 2026-10-26 |
| ISO 27001:2022 · ISO27001 | Claimed | — | cloudflare.com | 2026-10-26 |
| ISO 27017:2015 · ISO27017 | Claimed | — | cloudflare.com | 2026-10-26 |
| ISO 27018:2019 · ISO27018 | Claimed | — | cloudflare.com | 2026-10-26 |
| ISO 27701:2019 · ISO27701 | Claimed | — | cloudflare.com | 2026-10-26 |
| 1.1.1.1 Public DNS Resolver Privacy Examination | Certificate published | whether the 1.1.1.1 resolver was effectively configured to meet Cloudflare’s privacy commitments | cloudflare.com | 2026-10-26 |
| BSI Qualification | Certificate published | qualified provider of DDoS mitigation services | cloudflare.com | 2026-10-26 |
| ISMS | Claimed | — | cloudflare.com | 2026-10-26 |
| Korea ISMS | Claimed | issued under the ISMS-P scheme administered by the Korea Internet & Security Agency (KISA) | cloudflare.com | 2026-10-26 |
| ProcessUnity Global Risk Exchange | Available on request | — | cloudflare.com | 2026-10-26 |
| PCI DSS 4.0 · PCIDSS | Claimed | — | cloudflare.com | 2026-10-26 |
| SOC 2 Type II · SOC2T2 | Claimed | Security, Confidentiality, and Availability controls in place in accordance to the AICPA Trust Service Criteria | cloudflare.com | 2026-10-26 |
| WCAG 2.1 AA and Section 508 · VPAT | Available on request | Cloudflare's dashboard | cloudflare.com | 2026-10-26 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Cloudflare, Inc. | Active | HR data, non-HR data | 2027-09-15 | 2026-11-02 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Cloudflare, Inc. | Active | HR data, non-HR data | 2027-09-15 | 2026-11-02 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Cloudflare, Inc. | Active | HR data, non-HR data | 2027-09-15 | 2026-11-02 |
| ENS certificates of conformity (CCN, Spain) | Los Sistemas de Información que soportan los servicios de Cloudflare, Inc. enumerados en la página del Anexo del Certificado y ubicados en Centros de Datos externalizados localizados en las regiones de Países Bajos, Estados Unidos, así como el perímetro de la red global de Cloudflare. · Cloudflare Inc | certified | ENS ALTA | 2026-12-23 | 2026-11-02 |
| EU Cloud Code of Conduct (GDPR Art. 40) | Cloudflare Inc. (cloudflare.com) · Cloudflare Inc. | adherent | Level 2 | 2027-03-28 | 2026-11-02 |
| FedRAMP Marketplace (US) | Cloudflare for Government · Cloudflare | FedRAMP Authorized | Moderate | — | 2026-11-02 |
| FedRAMP Marketplace (US) | Cloudflare for Government - High · Cloudflare | Agency In Process | High | — | 2026-11-02 |
| Global LEI Index (GLEIF) | CLOUDFLARE, INC. · CLOUDFLARE, INC. | ISSUED | US-DE | 2026-12-08 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-02, no entry under Cloudflare; Cloudflare, Inc.
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Cloudflare; Cloudflare, Inc.
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Cloudflare; Cloudflare, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-26, no entry under Cloudflare; Cloudflare, Inc.
- Data Privacy Framework List (US): checked 2026-11-02, 3 entries under Cloudflare; Cloudflare, Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-02, 1 entry under Cloudflare; Cloudflare, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-02, 1 entry under Cloudflare; Cloudflare, Inc.
- FedRAMP Marketplace (US): checked 2026-11-02, 2 entries under Cloudflare; Cloudflare, Inc.
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Cloudflare; Cloudflare, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-02, no entry under Cloudflare; Cloudflare, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Cloudflare (SaaS) | — | Service only | unknown | cloudflare.com | 2026-09-18 |
| Cloudflare One Client | 12 months | Declared | unknown | developers.cloudflare.com | 2026-10-11 |
| cloudflared | 12 months | Declared | unknown | developers.cloudflare.com | 2026-10-11 |
Vulnerability reporting: hackerone.com, cloudflare.com (security.txt, no Expires field; read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is Cloudflare's trust center?
Cloudflare publishes a page it calls “Trust Hub” at cloudflare.com/trust-hub. Its front page shows no request or sign-in step; documents further in may still have one. The page mentions SOC 2 and ISO 27001. We read it on 2026-11-03. Open cloudflare.com/trust-hub
- Name “The Cloudflare Trust Hub”
Source: cloudflare.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-26 |
| dpa | Public | full | 200 | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| lifecycle-2 | Public | full | 200 | 2026-10-11 |
| subprocessors | Public | full | 200 | 2026-09-17 |
| tia | Public | full | 200 | 2026-10-20 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-11-02 | Status Active - Re-certification under Review → Active | the vendor changed it | dataprivacyframework.gov |
| 2026-11-02 | Status Active - Re-certification under Review → Active | the vendor changed it | dataprivacyframework.gov |
| 2026-11-02 | Status Active - Re-certification under Review → Active | the vendor changed it | dataprivacyframework.gov |
| 2026-09-18 | EU data location Not stated → Paid upgrade Minimum plan set to Enterprise Note rewritten | we read a better page | developers.cloudflare.com |
Every reviewed change across the registry, newest first: vendor changes.