Cloudflare: application security, network protection and operating boundaries

Cloudflare supplies network, application-security and delivery infrastructure that can sit between a financial firm’s customers and its online services. The relevant services span websites, APIs, private workforce access and non-web network traffic. A deployment is assembled around those traffic paths; a website plan does not automatically include every network or security product.[11][5]

For a firm’s internal systems, Access authenticates users reaching applications, while Secure Web Gateway filters DNS, network and HTTP traffic. Cloudflare Tunnel establishes outbound connections from the customer’s infrastructure, and the Cloudflare One Client can apply device-related policies. These components address workforce access and network security around the application.[5]

Cloudflare’s HTTP protection depends on requests passing through its proxy. A proxied A, AAAA or CNAME record resolves to Cloudflare addresses and enables the relevant security and caching configurations. A DNS-only record exposes the origin address and does not apply that HTTP inspection. Email, verification and other non-HTTP records can require different handling, so the DNS zone needs to be mapped by function.[6]

Automation can use API tokens scoped to an account or particular zones, with read or edit permissions and optional client-IP and expiry restrictions. Account tokens provide a service identity where the selected endpoints support them; user tokens remain another option. This lets configuration access be bounded by the specific resources and operations an integration needs.[19]

Cloudflare’s Terraform provider supports storing configuration in a source repository, reviewing changes and rolling them back. The documented configuration areas include DNS, HTTPS settings, WAF rules, rate limits, redirects and Workers. For a team running several environments, that creates a repeatable configuration path alongside the dashboard.[20]

A WebSocket connection has a particularly relevant inspection boundary for live financial interfaces. Cloudflare applies WAF checks to the initial HTTP upgrade request, but does not keep inspecting messages after the connection is established. Network software releases can also terminate existing WebSocket sessions. Applications therefore need their own message validation, connection recovery and appropriate keepalive behaviour.[8]

Website plans are billed per domain, while ordinary subdomains do not count as separate billable domains. Two domains upgraded to Pro therefore create two plan charges. Add-on subscriptions are billed monthly, and taxes can apply. This charging unit matters when a broker operates separate brands, regional domains or other independently subscribed properties.[12]

Workers has a separate account-level charging model. The Paid plan starts at US$5 monthly and Standard usage includes ten million requests and thirty million CPU milliseconds. Additional usage costs US$0.30 per million requests and US$0.02 per million CPU milliseconds. CPU time is a separate meter from request count; a low-request but computationally intensive workload can still incur charges. Other storage and data products have their own rates.[10]

Origin configuration is part of the deployment. Full (strict) TLS validates the origin certificate as well as encrypting the connection: the certificate must be unexpired, match the hostname and be issued by a trusted authority or Cloudflare Origin CA. The origin must accept HTTPS. A certificate mismatch can produce a 526 error even when the visitor-facing certificate is valid.[7]

The origin also needs an access policy. Cloudflare documents outbound-only Tunnel connections, authenticated origin pulls and network allowlisting as different mechanisms. Tunnel requires the cloudflared daemon. With authenticated origin pulls, the supplied Cloudflare certificate establishes that a request came from Cloudflare’s network; a customer-specific certificate is needed for a narrower trust boundary. These mechanisms affect how traffic can reach the application behind the proxy.[21]

Security controls execute in a fixed sequence. A blocking or challenge action ends evaluation before later phases, and a Skip action can bypass specified later checks. Basic Bot Fight Mode sits outside the Ruleset Engine and cannot be skipped through those custom rules. An exception intended for an authorised API client must therefore be designed against the actual enabled bot product and execution order.[9]

Logpush sends logs in batches to a configured destination; it is not itself a storage or search service. The current documentation says delivery cannot backfill historical data and that logs generated while a job fails or is disabled are lost. Dataset access depends on the subscribed products, and the current per-zone limit is four jobs. A central logging integration consequently needs a working destination and delivery-health monitoring from the start.[18]

Support access and initial-response commitments are plan-specific. Paid customers can submit cases; Free-plan case support is limited to account, billing and registrar matters. The published urgent-incident initial response is two hours for standard Enterprise and one hour for Premium. Pay-as-you-go and Free plans have no response SLA. Those measures describe the first response rather than the time to restore an application.[13]

Enterprise service-credit claims have their own process. The general SLA requires notice of the incident and intention to claim within five business days, followed by a claim before the end of the next billing month. It excludes specified customer-side problems and beta or trial services unless agreed otherwise. Service-specific SLAs take precedence for their products. A headline availability commitment must therefore be read with its measurement, exclusions and remedy.[14]

Cloudflare’s subscription terms make the customer responsible for determining whether its service use meets the customer’s compliance obligations. The services covered here provide technical controls around applications and networks; a financial institution still defines the permissions, data handling and operating processes of its own business. The self-service agreement also requires appropriate rights and permissions for content transmitted through the service.[22]

The Data Processing Addendum applies where Cloudflare handles covered personal data on the customer’s behalf. Where the customer is itself a processor, it warrants that the underlying controller has authorised the relevant instructions and appointment. This makes the data-processing chain a contractual part of the deployment, alongside the configuration of regional controls.[15]

The current Data Processing Addendum identifies Cloudflare, Inc. and gives its San Francisco address. It forms part of the applicable enterprise, self-service or other written agreement. The service commitment should therefore be tied to the agreement and products in use, rather than inferred from a general company or compliance page.[15]

Cloudflare’s acquisition record includes security, observability and developer-tool businesses. The dated index records Human Native and the Astro team in January 2026 and VoidZero in June 2026. These changes expand the group’s technology base; the inclusion of an acquired business does not by itself specify which functions are available under an existing customer subscription.[24]

On 9 October 2026, Cloudflare announced that the Deno team was joining to work on self-hosting Workers and Durable Objects, including the workerd and celld efforts. This is a stated development direction. It should be separated from the operational capabilities and delivery commitments of a presently purchased service.[25]

Operator

Cloudflare, Inc.

Service scope

Network delivery, application and API security, private access and developer infrastructure.

Customer types

Financial institutions; Online businesses; Technology and platform operators

Delivery

SaaS; API; Managed service

Pricing publication

Public and quoted pricing

Headquarters

San Francisco, United States

Pricing scope

Public website and usage tariffs, plus contracted services and paid additions.

Implementation

Traffic routing, DNS, origin security, scoped access and product-specific configuration.

Support

Support channels and initial-response commitments vary by plan and success package.

Permissions and regulatory scope

Technical services with contractual data-processing and customer compliance responsibilities.

Provider metadata checked 21 Oct 2026Source 11Source 5Source 1Source 15Source 6Source 13Source 22

Replicate’s founders confirmed that the company became part of Cloudflare on 1 December 2025. The business brings tooling for running machine-learning models. Its group relationship is relevant when considering Cloudflare’s wider AI portfolio, while product access and contractual entitlements still need to be identified for the selected service.[26]

Some Enterprise features can be activated as a 30-day product preview. Cloudflare’s billing guide says that enabling such a feature does not make it a contracted service until it is purchased. An operational design should distinguish those previews from the capabilities included in the executed order.[23]

For recurring self-service subscriptions, cancellation must occur before the next scheduled billing date to stop renewal. The billing policy says the cancellation month is charged in full, and a downgrade takes effect at the end of the current service period. Traffic routing, stored configurations and any separately billed add-ons therefore need to be considered when changing a deployment.[12]