# Cloudflare Zero Trust — Business VPN & Zero Trust Access

Cloudflare Zero Trust by Cloudflare, Inc. holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Cloudflare, Inc. (https://www.cloudflare.com/plans/zero-trust-services/)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-vpn/cloudflare-zero-trust
- Alternatives: https://whats-best.ai/software/business-vpn/cloudflare-zero-trust/alternatives ([markdown](https://whats-best.ai/software/business-vpn/cloudflare-zero-trust/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Cloudflare, Inc.
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Yes, per the vendor’s own page [S7]

## The panel's verdict

Cloudflare Zero Trust scored strongest on identity and policy and access and connectivity, both at 7 to 8: the bench credits deny-by-default per-application policies built from Include, Require and Exclude rules, single sign-on with Microsoft Entra ID, Google, Okta and GitHub, SCIM revocation that forces re-attestation, agentless browser access, and encryption documented down to MASQUE over TLS 1.3 with hybrid ML-KEM. Visibility and audit also lands at 7 to 8, with retention stated per plan — admin logs kept eighteen months on every plan, access logs up to 180 days on Enterprise — though requests matching a Bypass policy are not logged. Pricing transparency is the outlier at 4: beyond the Free Plan at "$0 forever" with a 50-user limit, the Contract Plan is an "Annual custom price per user", and we found no public per-user price for paid tiers or add-ons. Sovereignty spreads 5 to 6 as judges weighed Cloudflare, Inc. under California law against the Data Localization Suite and the published subprocessor list. Weighted totals span 6.1 to 7.0; no criterion spans more than one point.

**Speaks for it:**
- Deny-by-default per-application policies built from Include, Require and Exclude rules, with device posture checked on every request
- Revoking a user in the identity provider forces re-attestation of their attributes over SCIM, ending leaver access
- Encryption documented to the protocol level: MASQUE over TLS 1.3 with hybrid ML-KEM from the device, IPsec ESP off-ramps, post-quantum hops between data centres
- Configuration managed as code through a documented REST API and Terraform provider, with scoped API tokens and a dashboard read-only lock
- Retention stated per plan, with admin logs kept eighteen months on every plan and Logpush to a SIEM or cloud storage on the Contract Plan

**Held against it:**
- The Contract Plan is an "Annual custom price per user" and we found no public per-user price for the paid tiers or add-ons
- The contracting party is Cloudflare, Inc. of San Francisco under California law, and information is primarily stored in the United States and the European Economic Area
- Requests matching a Bypass policy are not logged, and free-tier access logs are kept only 24 hours
- We found no public information on MDM deployment of the client, multi-tenant administration, or a self-hosted edition
- We found no public information on a bug bounty, a public status page, or what happens to existing connections when the control plane is down

**Best for:**
- You need per-application, identity-first access for a small team — the Free Plan is $0 forever with a 50-user limit and includes ZTNA, SWG, CASB and the connector and device client software
- Your team wants every change to flow through the API or Terraform, with the dashboard locked read-only
- You must show an auditor who reached which application and when, with admin logs kept eighteen months on every plan
- You bring on contractors without managed devices — agentless browser access needs no client install

**Avoid if:**
- You need a computable annual cost before committing — beyond the Free Plan the Contract Plan is quoted only as an "Annual custom price per user", taxes are excluded and fees are nonrefundable
- You need an EU contracting entity or EU governing law — the contracting party is Cloudflare, Inc. of San Francisco under California law, and we found no public information on an EU contracting entity or EU representative
- You need primary storage outside the United States — information is stated to be primarily stored in the United States and the European Economic Area
- You must log every request without exception — requests matching a Bypass policy are not logged

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 3.5/5 | 4/5 | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Identity, access policy & device posture | 4/5 | 4/5 | 4/5 | 4/5 | 3.5/5 | 3.5/5 |
| Logs, audit trail & incident response | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Deployment, API & administration | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Architecture, reliability & security assurance | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 |
| European sovereignty | 3/5 | 2.5/5 | 3/5 | 3/5 | 2.5/5 | 3/5 |
| Pricing transparency | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| **Weighted verdict** | **3/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3/5** | **3/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit report: independent external audit report · 13 [S10]
- Beta no liability: no [S8]
- Breach notification: without undue delay [S10]
- BSI ddos: BSI qualified DDoS mitigation provider · yes [S12]
- C5: C5:2020 · yes [S12]
- California notice: yes [S9]
- Cbpr certification: Global CBPR System · Global PRP System [S9]
- CCPA commitments: yes [S10]
- Critical infrastructure regulations: NIS 2 [S12]
- Csa star: CSA STAR · yes [S12]
- Customer metadata boundary: restrict data storage to a specific geographic region · yes · Data Localization Suite [S5]
- Cyber essentials: Cyber Essentials · yes [S12]
- Data controller role: yes · Customer Logs · Administrative User Audit Logs · some account settings information [S9]
- Data protection regulations: APPI (Japan) · Australia Privacy Act · LGPD (Brazil) · DPDP (India) · GDPR · PDPA (Singapore) · PIPA (South Korea) · US Privacy Laws [S12]
- Dispute resolution: free · TRUSTe [S9]
- Dns privacy examination: 1.1.1.1 Public DNS Resolver Privacy Examination [S12]
- DPA: data processor or sub-processor · yes [S8]
- Dpf certification: EU-U.S. DPF · UK Extension to the EU-U.S. DPF · Swiss-U.S. DPF [S9]
- Dpf certification: yes [S10]
- Ens: ENS (Spain) · yes [S12]
- EU cloud code of conduct: EU Cloud Code of Conduct · yes [S12]
- Fedramp high: FedRAMP High · yes [S12]
- Financial services regulations: EU DORA · UK Operational Resilience · APRA (Australia) [S12]
- GDPR reference: yes [S1]
- Global cbpr: Global CBPR · yes [S12]
- Global cbpr certified: yes · yes [S10]
- Global prp: Global PRP · yes [S12]
- Govramp: GovRAMP · yes [S12]
- HIPAA: contact account team for AoC · HIPAA · yes [S12]
- Irap: IRAP (Australia) · yes [S12]
- Ismap: ISMAP (Japan) · yes [S12]
- ISO 27001: ISO 27001:2022 · yes [S12]
- ISO 27017: ISO 27017:2015 · yes [S12]
- ISO 27018: ISO 27018:2019 · yes [S12]
- ISO 27701: ISO 27701:2019 · yes [S12]
- Korea ISMS: Korea ISMS-P (KISA) · yes [S12]
- Language controls: English [S9]
- Min age: 18 [S9]
- No marketing use: yes [S10]
- No sell rent: no [S9]

**Data**
- Cancellation access: yes [S8]
- Customer content ownership: yes [S8]
- Log retention: 24 hours · 6 months + Logpush to SIEM/cloud storage · 30 days [S7]
- Retention deletion: yes [S9]
- Subject request handling: yes · yes [S10]
- Termination self service: account dashboard · yes [S8]
- Two factor recommended: yes [S8]

**Hosting**
- Entity: Cloudflare, Inc. [S12]
- Storage regions: United States · European Economic Area [S9]

**Integrations**
- API reference: yes [S20]
- API terraform: API · Terraform [S2]
- Dashboard access: Compliance documentation downloadable from dashboard [S12]
- Logpush: yes [S5]
- Logpush: Contract · yes [S7]
- Terraform provider: yes [S20]

**Legal**
- Agreement name: Self-Serve Subscription Agreement between Cloudflare and the customer [S8]
- Arbitration administrator: American Arbitration Association [S8]
- Beta services: one year · yes [S8]
- Changes notice: yes [S8]
- Data importer address: Cloudflare, Inc. · 101 Townsend Street, San Francisco, CA 94107, USA [S10]
- DPA conflict precedence: yes [S10]
- DPA party: Cloudflare, Inc. · Main Agreement [S10]
- DPA version: 6.4 · 2026-04-03 [S10]
- English version binding: English [S8]
- Entity: Cloudflare, Inc. · 101 Townsend St., San Francisco, California 94107 [S8]
- Governing law: San Francisco County, California · California [S8]
- Government request commitments: never turned over encryption/authentication keys [S10]
- Ip indemnification: US or EU patent or registered copyright · yes [S8]
- Last updated: 2025-09-12 [S8]
- Liability cap: amounts paid in the 12 months prior to the claim [S8]
- No class actions: yes [S8]
- Policy effective date: 2025-11-04 [S9]
- Policy update korea: Addendum applicable to users in South Korea · 2025-10-31 [S9]
- Previous name: Magic WAN [S21]

**Pricing**
- Billing methods: monthly · annual · pay-as-you-go · credit card [S8]
- Contract plan: Contract Plan · annual custom price per user [S7]
- Enterprise preview: Enterprise customers can preview as a non-contract service with full access, free of metered usage fees and limits [S2]
- Free price: 0 · Free Plan · forever [S7]
- Free services: free or trial versions offered from time to time, no liability for Free Services [S8]
- Network firewall included: yes [S21]
- No refunds: no [S8]
- Price changes notice: 30 [S8]
- Taxes: yes · yes [S8]
- Usage based preauthorization: yes · yes [S8]

**Product**
- Access API: yes · Zero Trust Access API for applications, policies, groups, service tokens, identity providers and SCIM [S6]
- Access deny by default: yes [S4]
- Access identity enforcement: Cloudflare Access used for identity-based policy enforcement [S22]
- Access log retention: 24 hours · 30 days · 24 hours · 30 days · 180 days [S5]
- Access one action per policy: yes [S4]
- Access policy actions: Allow · Block · Bypass · Service Auth [S4]
- Access policy rule types: Include · Require · Exclude [S4]
- Account self service: access · correct · export · update · yes [S9]
- Admin log retention: 18 · 18 · 18 · 18 · 18 · 18 [S5]
- AI gateway API: yes · AI Gateway API for gateways, logs, provider keys, dynamic routing, credits and top-ups [S6]
- AI search API: yes · AI Search API with namespaces, instances, indexing jobs, items, search and chat completions [S6]
- API documentation: Cloudflare publishes public API documentation at developers.cloudflare.com/api [S6]
- API management: yes · yes [S20]
- API terraform management: yes · yes [S4]
- Appliance mlkem min version: 2026.2.0 [S22]
- Application connector software: application connector software · device client (agent) software [S7]
- Assistance dpia: yes · yes [S10]
- Audit logs API: yes · Audit log API for accounts and users [S6]
- Benchmarking: yes · must include information necessary to replicate tests [S8]
- Browser pqc tls13: TLS 1.3 with post-quantum key agreement · modern browser supporting post-quantum key agreement [S22]
- Bypass incompatibilities: Zaraz enabled for zone · a Worker intercepts the request [S4]
- Bypass no identity selectors: no [S4]
- Bypass no logging: no · yes [S4]
- Bypass reverts zone settings: yes [S4]
- Capabilities included: ZTNA · SWG · DEX · network flow monitoring · CASB [S7]
- Casb API integrations: up to 2 read-only · unlimited out-of-band (add-on) · up to 2 read-only [S7]
- Cloudflare one definition: Cloudflare One replaces legacy corporate security perimeters with Cloudflare's global network [S22]
- Cloudflare one description: single-vendor SASE platform combining workspace security and network services (Cloudflare WAN, Firewall) [S7]
- Connection context per policy: yes [S4]
- Connection context settings by app type: allowed UNIX usernames · clipboard controls · file transfer controls [S4]
- Credit card storage: no [S9]
- Dashboard read only mode: Super Administrators · all users prevented from UI configuration changes; updates only via API or Terraform · yes [S20]
- Data aggregation sharing: yes [S9]
- Data categories: audit log IP addresses · email addresses · IP addresses · Zero Trust end user names · email addresses [S10]
- Data deletion or return: yes · yes [S10]
- Data localization: Regional data center control for traffic inspection and log location, including EU [S12]
- Data localization API: yes · Data Localization Suite API for regions, regional services and prefix bindings [S6]
- Device posture log retention: 30 days · 30 days · 30 days · 30 days · 30 days [S5]
- Device posture selector: Cloudflare One Client · third-party service provider · Device posture · yes [S4]

**Subprocessors**
- Anthropic: Anthropic PBC · AI Gateway · United States [S11]
- Apnic: APNIC · anonymous 1.1.1.1 resolver logs shared pursuant to a Research Cooperative Agreement [S9]
- Aws: Amazon Web Services (AWS) · Cloudflare Email Security (formerly Area 1) · United States, European Economic Area [S11]
- Change notification: RSS feed · yes [S11]
- Coreweave: CoreWeave, Inc. · Workers AI · United States [S11]
- Google: Google LLC · Cloudflare Developer Platform, Cloudflare Zero Trust and AI Gateway · European Economic Area, United States, Australia, India [S11]
- Groq: Groq, Inc. · AI Gateway · United States [S11]
- Group entities: 18 · Cloudflare Ltd. (United Kingdom) · Cloudflare Pte. Ltd. (Singapore) · Cloudflare Australia Pty Ltd (Australia) · Cloudflare Germany GmbH (Germany) · Cloudflare Portugal, Unipessoal Lda. (Portugal) · Cloudflare France SAS (France) · Cl… [S11]
- Group role: Cloudflare Group affiliates act as sub-processors for account and engineering support [S11]
- List URL: 30 · 10 · https://www.cloudflare.com/gdpr/subprocessors/ [S10]
- Nebius: Nebius BV · Workers AI · England [S11]
- Openai: OpenAI, Inc. · AI Gateway · global via cloud infrastructure providers [S11]
- Oracle: Oracle America, Inc. · Cloudflare Developer Platform and Cache Reserve · United States, European Economic Area, UK, Japan, Australia, Canada, Singapore [S11]
- Professional services list: yes [S11]
- Salesforce: Salesforce, Inc. · Customer support and account management · United States [S11]
- Slack: Slack Technologies, Inc. · Customer support communications · United States [S11]
- Updated: 2025-10-01 [S11]
- Xai: X.AI Corp. · AI Gateway · United States [S11]
- Zendesk: Zendesk, Inc. · Customer support and account management · United States, European Economic Area, Japan, Australia [S11]

**Support**
- Contract channels: phone · chat · ticket · add-on [S7]
- Free channels: community forums · Discord server [S7]
- Pay as you go channels: chat · ticket [S7]

88 more facts on the canonical page: https://whats-best.ai/software/business-vpn/cloudflare-zero-trust

## Questions

### Is Cloudflare Zero Trust European?

No. whats-best.ai classifies Cloudflare Zero Trust as Rest of world.

### Where does Cloudflare Zero Trust store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does Cloudflare Zero Trust have a free plan?

Yes. Cloudflare Zero Trust has a free plan, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/19344).

### What are the best alternatives to Cloudflare Zero Trust?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Firezone (3.5/5)](https://whats-best.ai/software/business-vpn/firezone) and [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Cloudflare Zero Trust alternatives](https://whats-best.ai/software/business-vpn/cloudflare-zero-trust/alternatives).

## Head-to-head

- [Cloudflare Zero Trust vs Proton VPN for Business](https://whats-best.ai/compare/cloudflare-zero-trust-vs-proton-vpn-business.md)

## What this page leaves out

- 172 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 10 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Features page (Access, zero trust network access): https://www.cloudflare.com/sase/products/access/ (checked 2026-11-05)
- [S2] Documentation: https://developers.cloudflare.com/cloudflare-one/ (checked 2026-11-05)
- [S3] Documentation (device client): https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/ (checked 2026-11-05)
- [S4] Documentation (access policies): https://developers.cloudflare.com/cloudflare-one/access-controls/policies/ (checked 2026-11-05)
- [S5] Documentation (logs): https://developers.cloudflare.com/cloudflare-one/insights/logs/ (checked 2026-11-05)
- [S6] API documentation: https://developers.cloudflare.com/api/ (checked 2026-11-05)
- [S7] Pricing page: https://www.cloudflare.com/plans/zero-trust-services/ (checked 2026-11-05)
- [S8] Terms of service (self-serve subscription agreement): https://www.cloudflare.com/terms/ (checked 2026-11-05)
- [S9] Privacy policy: https://www.cloudflare.com/privacypolicy/ (checked 2026-11-05)
- [S10] Data processing agreement (dpa): https://www.cloudflare.com/cloudflare-customer-dpa/ (checked 2026-11-05)
- [S11] Subprocessor list: https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/ (checked 2026-11-05)
- [S12] Security / trust page: https://www.cloudflare.com/trust-hub/compliance-resources/ (checked 2026-11-05)
- [S13] Access model & connectivity — found from sitemap: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-wan/zero-trust/cloudflare-tunnel/ (checked 2026-11-05)
- [S14] Access model & connectivity — found from sitemap: https://developers.cloudflare.com/cloudflare-one/networks/connectors/ (checked 2026-11-05)
- [S15] Identity, access policy & device posture — found from sitemap: https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/entra-id/ (checked 2026-11-05)
- [S16] Identity, access policy & device posture — found from sitemap: https://developers.cloudflare.com/cloudflare-one/access-controls/policies/temporary-auth/ (checked 2026-11-05)
- [S17] Logs, audit trail & incident response — found from sitemap: https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/ (checked 2026-11-05)
- [S18] Logs, audit trail & incident response — found from sitemap: https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/admin-activity-logs/ (checked 2026-11-05)
- [S19] Deployment, API & administration — found from sitemap: https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/deployment/mdm-deployment/ (checked 2026-11-05)
- [S20] Deployment, API & administration — found from sitemap: https://developers.cloudflare.com/cloudflare-one/api-terraform/ (checked 2026-11-05)
- [S21] Architecture, reliability & security assurance — found from sitemap: https://developers.cloudflare.com/cloudflare-wan/security/ (checked 2026-11-05)
- [S22] Architecture, reliability & security assurance — found from sitemap: https://developers.cloudflare.com/ssl/post-quantum-cryptography/pqc-and-zero-trust/ (checked 2026-11-05)

---

Cite as: whats-best.ai, "Cloudflare Zero Trust — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/cloudflare-zero-trust

Corrections: https://whats-best.ai/correct/1599?target=page