Business VPN & Zero Trust Access
Cloudflare Zero Trust
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Cloudflare, Inc. · www.cloudflare.com
Compare with Proton VPN for Business → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Cloudflare Zero Trust at a glance
- Vendor
- Cloudflare, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates Cloudflare Zero Trust 3.5/5, the mean of 6 judges. Cloudflare Zero Trust scored strongest on identity and policy and access and connectivity, both at 7 to 8: the bench credits deny-by-default per-application policies built from Include, Require and Exclude rules, single sign-on with Microsoft Entra ID, Google, Okta and GitHub, SCIM revocation that forces re-attestation, agentless browser access, and encryption documented down to MASQUE over TLS 1.3 with hybrid ML-KEM. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Cloudflare Zero Trust scored strongest on identity and policy and access and connectivity, both at 7 to 8: the bench credits deny-by-default per-application policies built from Include, Require and Exclude rules, single sign-on with Microsoft Entra ID, Google, Okta and GitHub, SCIM revocation that forces re-attestation, agentless browser access, and encryption documented down to MASQUE over TLS 1.3 with hybrid ML-KEM. Visibility and audit also lands at 7 to 8, with retention stated per plan — admin logs kept eighteen months on every plan, access logs up to 180 days on Enterprise — though requests matching a Bypass policy are not logged. Pricing transparency is the outlier at 4: beyond the Free Plan at "$0 forever" with a 50-user limit, the Contract Plan is an "Annual custom price per user", and we found no public per-user price for paid tiers or add-ons. Sovereignty spreads 5 to 6 as judges weighed Cloudflare, Inc. under California law against the Data Localization Suite and the published subprocessor list. Weighted totals span 6.1 to 7.0; no criterion spans more than one point.
Speaks for it
- Deny-by-default per-application policies built from Include, Require and Exclude rules, with device posture checked on every request
- Revoking a user in the identity provider forces re-attestation of their attributes over SCIM, ending leaver access
- Encryption documented to the protocol level: MASQUE over TLS 1.3 with hybrid ML-KEM from the device, IPsec ESP off-ramps, post-quantum hops between data centres
- Configuration managed as code through a documented REST API and Terraform provider, with scoped API tokens and a dashboard read-only lock
- Retention stated per plan, with admin logs kept eighteen months on every plan and Logpush to a SIEM or cloud storage on the Contract Plan
Held against it
- The Contract Plan is an "Annual custom price per user" and we found no public per-user price for the paid tiers or add-ons
- The contracting party is Cloudflare, Inc. of San Francisco under California law, and information is primarily stored in the United States and the European Economic Area
- Requests matching a Bypass policy are not logged, and free-tier access logs are kept only 24 hours
- We found no public information on MDM deployment of the client, multi-tenant administration, or a self-hosted edition
- We found no public information on a bug bounty, a public status page, or what happens to existing connections when the control plane is down
Best for
- You need per-application, identity-first access for a small team — the Free Plan is $0 forever with a 50-user limit and includes ZTNA, SWG, CASB and the connector and device client software
- Your team wants every change to flow through the API or Terraform, with the dashboard locked read-only
- You must show an auditor who reached which application and when, with admin logs kept eighteen months on every plan
- You bring on contractors without managed devices — agentless browser access needs no client install
Avoid if
- You need a computable annual cost before committing — beyond the Free Plan the Contract Plan is quoted only as an "Annual custom price per user", taxes are excluded and fees are nonrefundable
- You need an EU contracting entity or EU governing law — the contracting party is Cloudflare, Inc. of San Francisco under California law, and we found no public information on an EU contracting entity or EU representative
- You need primary storage outside the United States — information is stated to be primarily stored in the United States and the European Economic Area
- You must log every request without exception — requests matching a Bypass policy are not logged
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3.5 of 5 |
| Identity, access policy & device posture | 4 of 5 |
| Logs, audit trail & incident response | 3.5 of 5 |
| Deployment, API & administration | 3.5 of 5 |
| Architecture, reliability & security assurance | 3.5 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 2 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
This is proper per-application access rather than a whole-network tunnel: Access is deny by default with allow and block rules per application, and the on-ramps are the Cloudflare One Client, agentless browser access or an IPsec appliance, with Tunnel and IPsec off-ramps on our side — connector and client software are included on every plan. The protocols are unusually well documented (MASQUE over TLS 1.3 with hybrid ML-KEM, IPsec ESP keyed over a TLS-secured control plane). We found no public information on dedicated static egress IPs for the supplier portal, per-operating-system client coverage, or always-on behaviour in the captured pages. 1 4 7 21 22
The DevOps Engineer
This is per-application access rather than whole-network VPN: identity-first ZTNA to private apps and infrastructure, with cloudflared tunnel off-ramps carrying any protocol, a device client connecting over MASQUE with hybrid ML-KEM, agentless browser access for contractors, and split tunnelling in the device management API. SSH policies can even pin allowed UNIX usernames per policy. We found no public information on client platform lists, always-on behaviour, or connectors specific to Kubernetes, so it sits below the very top. 1 22 21 6 4 7
The MSP Technician
Access is per application with deny-by-default policies, three on-ramps including agentless browser access and the device client, a tunnel off-ramp needing no inbound ports, and protocols documented down to MASQUE over TLS 1.3 with hybrid ML-KEM and IPsec with IKEv2. Site-to-site arrives via Cloudflare WAN with layer 3/4 firewalling. We found no public information on always-on behaviour, split DNS or the client platforms. 1 4 21 22
The Operations Manager
Access is per application rather than whole networks, and agentless browser access to self-hosted applications means a freelancer on their own laptop needs no managed device or client install — exactly the contractor case I run. The device client, IPsec on-ramps and tunnel off-ramps are documented with their protocols and encryption (MASQUE, TLS 1.3 with hybrid ML-KEM, IPsec ESP). We found no public information on per-platform client lists, always-on behaviour, or named gateway regions — the pages describe a global network without naming where. 22 1 7 6 2
The Information Security Officer
The per-application model is exactly what I want instead of network-level grants: deny-by-default policies per application with selectors for SaaS, self-hosted and non-HTTP apps, clientless browser access for people without a managed device, IPsec site-to-site on-ramps and off-ramps, and a protocol stack documented in detail (MASQUE over TLS 1.3 with hybrid ML-KEM, IPsec ESP) alongside split tunnel configuration through the device API. We found no public information on client platforms, always-on behaviour, named gateway regions or connectors for the major clouds and Kubernetes, so the documented evidence stops short of the top band. 1 4 6 7 22
The Skeptic
Per-application zero trust access with agentless browser entry for people without a managed device, a device client over MASQUE with TLS 1.3 and hybrid ML-KEM, IPsec on-ramps for site-to-site, and a tunnel connector off-ramp that needs no inbound ports — the protocols and even the post-quantum key exchange are documented. I found no public information on named gateway regions, always-on or auto-connect behaviour, split DNS, gateway failover and throughput figures, or any path to run this network on self-hosted components. 1 6 7 21 22
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Sign-in with Microsoft Entra ID, Google, Okta or a SCIM-provisioning identity provider is documented, with deny-by-default policies per application, Include/Require/Exclude rule logic, and device posture checked from the client or a third-party provider — and a user revoked in the IdP is forced to re-attest, which is the same-day leaver handling I need. Identity and device posture are checked per request, and non-identity signals are polled continuously during the session; policies run as code through the API and Terraform. We found no public information on just-in-time approvals, session re-authentication, or named MDM or EDR tools feeding posture in the captured pages. 1 2 4
The DevOps Engineer
Deny-by-default per-app policies with Include/Require/Exclude logic, single sign-on against Entra ID, Google, Okta and SCIM-provisioning providers, and device posture checked continuously from the client or a third-party service — the policy model is documented in enough depth to actually run least privilege. Policies are manageable as code through API and Terraform, non-identity attributes are re-evaluated on every request, and revoking a user in the identity provider forces attribute re-attestation over SCIM. We found no public information on just-in-time approval flows or named EDR and MDM integrations. 4 6 1 20
The MSP Technician
Single sign-on with Entra ID, Google, Okta and GitHub is documented, SCIM revocation forces re-attestation of a user's attributes, policies are deny-by-default per application with Include, Require and Exclude rules, and device posture from the client or a third-party provider is polled continuously during the session, manageable as code with Terraform. The third-party posture providers are not named on the captured pages, and we found no public information on just-in-time access with approval. 1 4 6 20
The Operations Manager
Deny-by-default with per-application Allow policies is precisely "reach one project system and nothing else", and single sign-on with Microsoft Entra ID, Google, Okta plus SCIM provisioning means revoking a freelancer in the identity provider re-attests their attributes and ends access — the contract-end scenario I need. Device posture signals are checked continuously per request from the client or a third-party provider, and non-identity attributes are re-evaluated during the session. We found no public information on just-in-time approval flows or named EDR/MDM posture sources. 4 1 6
The Information Security Officer
Access follows identity and the device rather than the network: single sign-on with Microsoft Entra ID, Google and Okta, SCIM provisioning that forces re-attestation when a user is revoked in the identity provider, deny-by-default per-application policies composable from Include, Require and Exclude rules, posture signals checked continuously against each request, and policies manageable as code through the API and Terraform. We found no public information on just-in-time access with approval, session re-authentication, or named EDR and MDM integrations for posture, which keeps it below the higher band. 1 4 20
The Skeptic
Single sign-on with Entra ID, Google, Okta and GitHub, SCIM deprovisioning that forces attribute re-attestation when a user is revoked, deny-by-default policies with Include/Require/Exclude logic, and device posture signals polled continuously with each request — identity-first access is documented in depth. The third-party posture integrations are named only generically, no just-in-time approval workflow is described, and enforcement on SaaS applications stops at initial sign-on and session reissue. 1 4 20
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
Retention is stated per service and per plan — access logs from 24 hours on Free up to 180 days on Enterprise, admin logs 18 months on all plans — with Log Explorer datasets for access requests, gateway DNS/HTTP/network traffic and device posture, Logpush to SIEM or cloud storage on the contract plan, an audit log API, and webhook and PagerDuty alerting. The 1.1.1.1 resolver is stated not to log personal information, while requests matched by a Bypass policy are not logged. 4 5 6 7 9
The DevOps Engineer
Retention is published per plan and per log type — 18 months for admin audit logs, up to 180 days for access logs on the enterprise plan — with Logpush to SIEM or cloud storage on contract plans, webhook and PagerDuty alerting APIs, and a Log Explorer spanning access requests, DNS, HTTP, network, session and device posture datasets. One caveat that matters to me: requests matching a Bypass policy are not logged. We found no public information on a live session view with the ability to terminate connections. 5 7 6 4
The MSP Technician
Access, DNS, HTTP, network, session and admin logs are retained per plan with the periods stated — access logs up to 180 days and admin logs 18 months — queryable in Log Explorer, storable in an R2 bucket, and streamed to a SIEM or cloud storage on the contract plan, with webhook and PagerDuty alerting available. The pages also state what is not logged (Bypass requests) and which personal data the logs contain. That is what I need to show a client after an incident. 4 5 6 7 10
The Operations Manager
Access, admin, DNS, HTTP, network, device posture and session logs exist with retention stated per plan — 24 hours on the free tier, up to 180 days for access logs on Enterprise, 18 months for admin logs — plus Logpush to SIEM or cloud storage on the contract plan and a webhook and PagerDuty alerting API. That lets me prove which freelancer touched which system and when. We found no public information on a live session view with the ability to disconnect a user. 5 7 6 10
The Information Security Officer
For my auditor's question — who reached which application, when — the pages are concrete: access, device posture, DNS, HTTP and network logs with retention stated per plan, admin audit logs kept eighteen months on every plan, Logpush streaming to a SIEM or cloud storage, and webhooks with PagerDuty for alerting, plus an audit log API. The pages also state plainly what is not logged — requests matching a Bypass policy are not logged — but free-tier access logs are kept just 24 hours, and we found no public information on signed or tamper-evident logs or a documented log schema. 4 5 6 7
The Skeptic
Access, DNS, HTTP, network and device-posture logs with retention spelled out per plan, admin logs kept 18 months on every plan, Logpush to a SIEM or cloud storage, an audit-log API and webhook or PagerDuty alerting — a genuine trail. But access logs top out at 180 days even on Enterprise, the documentation states plainly that requests matching a Bypass policy are not logged at all, and I found no statement that logs are signed or tamper-evident. 4 5 6 7
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
The API and Terraform management is real and well documented, with a dashboard read-only mode that forces every change through code and scoped API tokens so a teammate can only touch the Zero Trust settings; support channels are listed per plan, from community forums and Discord on Free to phone, chat and ticket on contract. We found no public information in the captured pages on pushing the client through Intune or another MDM, admin role granularity beyond Super Administrators, a multi-tenant console, or a self-hosted edition — and for a three-person team the MDM gap is the one that bites. 6 7 20
The DevOps Engineer
A Terraform provider and a documented REST API cover applications, policies, tunnels, devices and identity providers, and the dashboard can be locked read-only so every change flows through API or Terraform — exactly the GitOps discipline I want for our shared bastion replacement. Scoped API tokens let automation touch only Zero Trust settings, and support channels are stated per plan. We found no public information on MDM client deployment, a multi-tenant console for service providers, or a self-hosted edition. 20 4 6 2 7
The MSP Technician
The entire Zero Trust configuration is manageable through a documented REST API and a Terraform provider, with scoped API tokens, a dashboard read-only lock forcing changes through code, and support channels stated per plan. For a service provider the gaps matter: we found no public information on a multi-tenant console, per-tenant billing, or MDM deployment of the client. 2 6 7 20
The Operations Manager
A central dashboard with a read-only lock for Super Administrators, management through API or Terraform, scoped API tokens limited to Zero Trust settings, and self-service termination from the account dashboard is a set-up I could hand to our external provider without specialist knowledge. Support channels are stated per plan — community forums and Discord on free, chat and ticket on pay-as-you-go, phone, chat and ticket on contract. We found no confirmed details on MDM-based client rollout, multi-tenant administration, or time to first connection. 20 6 7 8
The Information Security Officer
The automation depth suits a small team under audit pressure: a documented REST API and Terraform provider covering Zero Trust configuration, scoped API tokens that confine a team member to Zero Trust settings alone, and a dashboard read-only mode that forces every change through the API or Terraform, with support channels stated per plan and self-service termination in the dashboard. We found no public information on MDM client deployment with preconfigured settings, multi-tenant administration, a self-hosted edition, staged update rollouts or support response times. 2 6 7 8 20
The Skeptic
A central dashboard that Super Administrators can lock read-only so every change flows through the API or Terraform, scoped API tokens, a deep public REST API, and support channels stated per plan. I found no public information on deploying the client through MDM, on a multi-tenant console for service providers, on granular admin roles beyond the Super Administrator, or on any self-hosted edition. 2 6 7 8 20
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
The encryption story is the best documented I have read — MASQUE and TLS 1.3 with hybrid ML-KEM from the device, post-quantum hops inside Cloudflare's network, IPsec ESP keyed over a TLS-secured control plane — alongside a 100% uptime SLA, a DPA commitment to independent external audit reports no older than thirteen months, and ISO 27001:2022, SOC 2 Type II, German C5 and the EU Cloud Code of Conduct. We found no public information on a whitepaper describing what Cloudflare itself can see, open-source components, a bug bounty, or a public status page and incident history in the captured pages. 7 10 12 22
The DevOps Engineer
The post-quantum design is unusually well published — hybrid ML-KEM on the client on-ramp, post-quantum TLS 1.3 on hops between Cloudflare data centres, IPsec ESP off-ramps, and a public test site — and the pages state plainly that Gateway inspects DNS, network sessions and HTTP as traffic transits Cloudflare's own network, which answers much of my what-can-the-relays-see question. ISO 27001, SOC 2 Type II and C5 are listed with compliance documentation downloadable from the dashboard, alongside a 100% uptime guarantee. We found no public information on open-source components, a bug bounty, control-plane failover behaviour or public incident history. 22 12 7 10 21
The MSP Technician
The encryption architecture is unusually well documented — on-ramps, off-ramps, hops between the vendor's data centres, and post-quantum key agreement end to end — and the assurance stack is broad: ISO 27001, SOC 2 Type II, FedRAMP High and the German BSI's C5 catalogue, with compliance documentation downloadable from the dashboard, an independent auditor report no older than thirteen months under the data processing agreement, and a 100% uptime SLA. We found no public information on a status page, a bug bounty, control-plane failover or open-source components. 7 10 12 22
The Operations Manager
A 100% uptime guarantee (SLA) appears on the pricing page, encryption is documented in real depth (end-to-end post-quantum protection on private network traffic, TLS 1.3 with hybrid ML-KEM on internal hops, a testable public test site), and ISO 27001:2022, SOC 2 Type II and the German C5:2020 catalogue are stated with compliance documentation downloadable from the dashboard. The data processing agreement commits to an independent external audit report no older than thirteen months. We found no public information on a bug bounty, a public status page with incident history, or what happens to existing connections when the control plane is down. 7 22 12 10
The Information Security Officer
The architecture is documented down to the key exchange — on-ramps and off-ramps, hybrid ML-KEM agreement, an IPsec ESP data plane — and the independent assurance I insist on is stated in substance: SOC 2 Type II, ISO 27001:2022, FedRAMP High and C5:2020, compliance documentation downloadable from the dashboard, and a contractual right to an independent external audit report not older than thirteen months, which is exactly what I would invoke for NIS2. We found no public information on a vulnerability disclosure programme, bug bounty, public status page or incident history, and what happens to existing connections when the control plane is down is not described. 7 10 12 22
The Skeptic
The encryption story is documented better than most — TLS 1.3 with hybrid ML-KEM on every on-ramp and off-ramp, IPsec ESP keyed over a TLS-secured control channel, a public test site — and the pages are honest that traffic transits Cloudflare's own network with gateway HTTPS inspection. But the certifications are announced rather than published, with documents on request or behind a dashboard login, and I found no bug bounty, no public status page or incident history, no documented behaviour of existing connections when the control plane is down, and no self-hosted exit. 7 12 21 22
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The contracting party is Cloudflare, Inc. of San Francisco under California law, information is primarily stored in the United States and the EEA, and support runs through US subprocessors such as Salesforce and Slack — though safeguards are stated (Data Privacy Framework, standard contractual clauses as fallback, the EU Cloud Code of Conduct) and the subprocessor list with locations is published. The Data Localization Suite can restrict storage and log destinations to a specific region including the EU, and traffic inspection can be pinned to EU data centres. No EU contracting entity or EU representative is shown on the captured pages, so the chain is workable for us but not European. 5 8 9 10 11 12
The DevOps Engineer
The contracting entity is Cloudflare, Inc. of San Francisco under California law, primary storage is the United States and the European Economic Area, and support subprocessors such as Salesforce and Slack are located in the US. On the European side, the Data Localization Suite can restrict storage and log destination to an EU region, the subprocessor list publishes names and locations with 30 days notice and objection rights, a data processing agreement is published, and ISO 27001 and SOC 2 are stated. An EU storage option alongside a US entity and US governing law puts this mid-table for us. 8 9 11 10 12 5
The MSP Technician
The contracting entity is Cloudflare, Inc. of San Francisco under California law with AAA arbitration, primary storage is the United States and the EEA, and support runs through US subprocessors such as Salesforce and Slack. Offsetting that, the Data Localization Suite can restrict storage to an EU region, the subprocessor list is published with locations including EEA entries, and a versioned data processing agreement with SCC fallback and Data Privacy Framework certification is available — a documented chain, but not a European one. 5 8 9 10 11 12
The Operations Manager
The contracting entity is Cloudflare, Inc. of San Francisco under California law and arbitration, and information is primarily stored in the United States and the European Economic Area — for a European consultancy that is the wrong default direction. Against that, the subprocessor list is published with locations and a change RSS feed, a versioned data processing agreement is published, and the Data Localization Suite can restrict storage to a specific geographic region including control over which EU data centres inspect traffic and where logs go. We found no public information on an EU contracting entity or EU representative; the pipeline marked the sovereignty dimensions unknown on the vendor's own pages. 8 9 11 10 5 12
The Information Security Officer
Logs and account data can be kept in Europe — the Data Localization Suite restricts storage to a chosen region, and EU traffic inspection and log destinations are controllable — and every subprocessor is listed with its location under a published data processing agreement with a named data protection officer. But the contracting party is Cloudflare, Inc. of San Francisco under California law, primary storage is described as the United States and the European Economic Area, and no EU contracting entity or representative appears on the captured pages, with customer support and account management running through US subprocessors. 5 8 9 10 11 12
The Skeptic
The contracting party is Cloudflare, Inc. of San Francisco under California law, with primary storage in the United States and the European Economic Area — an American chain at the top. Credit where due: the data processing agreement is published with standard contractual clauses as fallback, the subprocessor list is public with named locations and thirty days' notice of changes, and the Data Localization Suite can pin this product's data to a region including the EU. The entity, the governing law and the default storage remain non-EU even with logs localised, so this lands between middling and strong. 5 8 9 10 11 12
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
The Free Plan is "$0 forever" with a 50-user limit, billing is monthly, annual or pay-as-you-go by credit card, taxes are excluded and fees are nonrefundable, and the inclusions and add-ons per tier are listed clearly. But the Contract Plan is an "Annual custom price per user" and no per-user figure for the paid tiers appears in the captured pages, so I cannot compute the annual cost for 140 people before the budget round. 7 8
The DevOps Engineer
The free tier is concrete — "$0 forever" with a 50-user limit — and plan inclusions, log retention and add-ons are tabulated, but the contract plan is quoted only as an "annual custom price per user". We found no public information on the pay-as-you-go per-user price or on figures for the add-ons such as Remote Browser Isolation, email security and Log Explorer. VAT treatment is stated (charges exclude taxes, the customer pays them) and monthly, annual and pay-as-you-go billing exist, but a real annual cost is not computable from these pages alone. 7 8
The MSP Technician
The free tier is priced at $0 forever for up to 50 users, and VAT treatment, billing cadence (monthly, annual or pay-as-you-go by credit card) and the no-refund rule are public. But the contract plan is an annual custom price per user, every add-on (email security, remote browser isolation, full DLP, Log Explorer) is unpriced, and the pay-as-you-go plan carries no per-user figure on the captured pages — so I cannot quote a client without contacting the vendor. 7 8
The Operations Manager
The free plan is completely clear — "$0 forever", a 50-user limit, with ZTNA, SWG, DEX, network flow monitoring, CASB, connector software and the device client included — which happens to match my headcount, though with only 24-hour log retention. Beyond that the pages give no per-user price for the pay-as-you-go tier, the contract plan is an "Annual custom price per user", and add-ons like Remote Browser Isolation, full DLP, Log Explorer and email security are named but unpriced, so the real annual cost cannot be computed. Taxes are excluded and billed to the customer, and fees are nonrefundable. 7 8
The Information Security Officer
The free plan is priced at "$0 forever" with a 50-user limit, plan inclusions and add-ons are published per tier, and taxes, billing methods, the no-refund rule and the thirty-day price-change notice are stated in the terms. However, the contract plan is an "Annual custom price per user", and we found no public per-user price for the paid tiers and no prices for the add-ons, so a buyer cannot compute the real annual cost from the captured pages alone. 4 7 8
The Skeptic
The Free Plan is "$0 forever" with a fifty-user limit and the inclusions per tier are unusually detailed — retention, CASB integrations, DLP, support channels — but the Contract Plan is an "Annual custom price per user", and no public figure appears for the pay-as-you-go tier or for add-ons like Remote Browser Isolation, Log Explorer or email security. With taxes excluded and fees nonrefundable, a buyer cannot compute a real annual cost from these pages alone. 2 7 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Cloudflare Zero Trust
Is Cloudflare Zero Trust European?
No. whats-best.ai classifies Cloudflare Zero Trust as Rest of world.
Where does Cloudflare Zero Trust store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does Cloudflare Zero Trust have a free plan?
Yes. Cloudflare Zero Trust has a free plan, per the vendor’s page captured 5 Nov 2026.
What are the best alternatives to Cloudflare Zero Trust?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Firezone (3.5/5) and Tailscale (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Cloudflare Zero Trust alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting location, Hosting options, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 172 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Features page (Access, zero trust network access) www.cloudflare.com Checked 5 Nov 2026 Details →
- 2 Documentation developers.cloudflare.com Checked 5 Nov 2026 Details →
- 3 Documentation (device client) developers.cloudflare.com Checked 5 Nov 2026 Details →
- 4 Documentation (access policies) developers.cloudflare.com Checked 5 Nov 2026 Details →
- 5 Documentation (logs) developers.cloudflare.com Checked 5 Nov 2026 Details →
- 6 API documentation developers.cloudflare.com Checked 5 Nov 2026 Details →
- 7 Pricing page www.cloudflare.com Checked 5 Nov 2026 Details →
- 8 Terms of service (self-serve subscription agreement) www.cloudflare.com Checked 5 Nov 2026 Details →
- 9 Privacy policy www.cloudflare.com Checked 5 Nov 2026 Details →
- 10 Data processing agreement (dpa) www.cloudflare.com Checked 5 Nov 2026 Details →
- 11 Subprocessor list www.cloudflare.com Checked 5 Nov 2026 Details →
- 12 Security / trust page www.cloudflare.com Checked 5 Nov 2026 Details →
- 13 Access model & connectivity — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →
- 14 Access model & connectivity — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →
- 15 Identity, access policy & device posture — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →
- 16 Identity, access policy & device posture — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →
- 17 Logs, audit trail & incident response — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →
- 18 Logs, audit trail & incident response — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →
- 19 Deployment, API & administration — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →
- 20 Deployment, API & administration — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →
- 21 Architecture, reliability & security assurance — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →
- 22 Architecture, reliability & security assurance — found from sitemap developers.cloudflare.com Checked 5 Nov 2026 Details →