Data Privacy & Protection Compliance · Cloudflare Feature Trail

Mar 2026Introducing Custom Regions for precision data controlIntroduces Custom Regions for Cloudflare's Regional Services, allowing users to define their own geographical boundaries for traffic processing using expressions based on country codes. Expands managed regions to include Turkey, UAE, IRAP, and ISMAP. Details the mechanism for defining region membership, calculating optimal in-region routing via Quicksilver, and enforcing the boundary at the edge. The core mechanism remains the same: TLS termination and Layer 7 processing only happen inside the chosen region. Custom Regions are initially set up collaboratively with account teams.

Mar 2025Detecting sensitive data and misconfigurations in AWS and GCP with Cloudflare OneThis post announces the expansion of Cloudflare One's CASB product to include Data Loss Prevention (DLP) functionality for AWS S3 and Google Cloud Storage. It introduces the ability to scan these cloud storage services for sensitive data (like PII and financial information) and misconfigurations (IAM, bucket settings). The post details the serverless architecture used for efficient and secure scanning within the customer's cloud environment and highlights the benefits of posture management features for identifying cloud security issues.

Mar 2025Improving Data Loss Prevention accuracy with AI-powered context analysisThis post introduces a significant advancement in Cloudflare's Data Loss Prevention (DLP) solution: AI-powered context analysis. This new capability leverages Workers AI and Vectorize to analyze the context of potential data matches, significantly reducing false positives and improving detection accuracy. The post details the technical implementation, the benefits of AI-driven learning from customer feedback, and the integration with Cloudflare's developer platform. It also outlines current limitations and future plans for expanding this AI-powered feature across other security products.

Feb 2025Preserving content provenance by integrating Content Credentials into Cloudflare ImagesThis post introduces the integration of the Coalition for Content Provenance and Authenticity (C2PA) standard into Cloudflare Images, enabling content creators to preserve the entire provenance chain of their digital media. This feature allows for cryptographic signing of image transformations, ensuring tamper-evidence and enabling verification of content origin and edits, thereby enhancing data privacy and combating misinformation.

May 2024Expanding Regional Services configuration flexibility for customersThis post announces the expansion of Cloudflare's Regional Services to include new defined regions (Austria, Brazil, Cloudflare Green Energy, Exclusive of Hong Kong and Macau, Exclusive of Russia and Belarus, France, Hong Kong, Italy, NATO, the Netherlands, Russia, Saudi Arabia, South Africa, Spain, Switzerland, and Taiwan). It introduces the concept of Software Defined Regionalization (SDR) as the future of data localization, enabling granular control over where traffic is inspected and processed. The post also details how Regional Services works by forwarding raw TCP streams to data centers within the selected region for Layer 7 product application, ensuring data processing occurs within specified jurisdictional boundaries.

Mar 2024Announcing two highly requested DLP enhancements: Optical Character Recognition (OCR) and Source Code DetectionsThis post announces two significant enhancements to Cloudflare's Data Loss Prevention (DLP) service: Optical Character Recognition (OCR) for extracting sensitive data from images and predefined source code detections for various programming languages. These features aim to provide more granular control and reduce risks of data breaches and non-compliance by enabling inline blocking of sensitive information in both image and code formats, and integrating with existing DLP policies for data in transit and at rest.

Jan 2024Reflecting on the GDPR to celebrate Privacy Day 2024This post contributes to the Data Privacy & Protection Compliance thread by discussing the application of GDPR to cross-border data transfers and IP addresses. It argues that data localization can negatively impact cybersecurity measures and that IP addresses should not always be classified as personal data, especially when entities lack the ability to link them to individuals. The post advocates for a more nuanced interpretation of 'personal data' to prevent the fragmentation of the internet and maintain effective cybersecurity practices.

Dec 2023Have your data and hide it too: an introduction to differential privacyThis post introduces differential privacy (DP) as a crucial enhancement to private aggregation protocols like DAP. It explains how DP adds noise to aggregates to prevent attackers from inferring individual data points, addressing the limitations of multi-party computation alone. The post highlights the risks of deanonymization attacks on census data and LLMs, and demonstrates how DP can protect against these by providing a rigorous mathematical framework for privacy guarantees, complementing existing privacy-preserving measurement efforts.

Sep 2023Privacy-preserving measurement and machine learningThis post introduces Cloudflare's active participation in the IETF Privacy Preserving Measurement working group and their implementation of the Distributed Aggregation Protocol (DAP). It details the principles behind DAP, including data minimization and the use of secret sharing and multi-party computation (MPC) to aggregate data without revealing individual measurements. The post also discusses challenges like input validation, addressed by zero-knowledge proofs (ZKPs), and the potential for non-linear aggregation, highlighting Cloudflare's commitment to privacy-preserving data collection and machine learning.

Sep 2023Cloudflare One for Data ProtectionAnnounced Cloudflare One for Data Protection, a unified suite combining DLP, CASB, ZTNA, SWG, RBI, and cloud email security services. This suite is architected to address modern data risks, including those posed by AI tools and source code exposure. The post highlights three common customer use cases: securing AI tools and developer code, gaining visibility into data exposure, and ensuring compliance with regulations like GDPR, CCPA, HIPAA, and GLBA. It emphasizes how Cloudflare One simplifies management, improves effectiveness, enhances productivity, and increases organizational agility in data protection.

Sep 2023What’s next for Cloudflare One’s data protection suiteThis post details the evolution of Cloudflare's Data Protection Suite, focusing on Data Loss Prevention (DLP) and Cloud Access Security Broker (CASB) capabilities. It recaps enhancements made over the past year, including custom DLP policies (MIP labels, custom profiles, match count controls), deeper detection capabilities (context analysis, file type control, expanded predefined profiles), and more detailed logging. CASB enhancements include expanding API integrations to 18 SaaS apps, improving findings management, and converging DLP and CASB for scanning SaaS apps for sensitive data. The post previews upcoming features such as Exact Data Match with custom wordlists, predefined DLP profiles for source code and PHI, and API-driven CASB & DLP for data-at-rest protections in Microsoft 365 and GitHub.

Jul 2023DLP Exact Data Match beta now availableIntroduces Exact Data Match (EDM) as a new feature within Cloudflare's Data Loss Prevention (DLP) suite. EDM allows customers to upload datasets of specific sensitive data (e.g., credit card numbers, names, addresses) which are then hashed in the browser before reaching Cloudflare. Cloudflare scans traffic and repositories for matches against these hashes, enabling targeted detection and blocking of specific sensitive data movements, thereby reducing false positives compared to generic pattern matching and enhancing data privacy.

Apr 2023Consent management made easy and clear with Cloudflare ZarazIntroduced Cloudflare Zaraz Consent Manager, a feature that simplifies gathering and managing user consent for third-party tools. It provides an opt-in consent modal, customizability to match brand identity, and automatically re-emits pageview events for scripts once consent is granted, preventing data loss. The feature aims to ensure compliance with privacy regulations like GDPR and ePrivacy Directive.

Mar 2023Helping protect personal information in the cloud, all across the worldThis post announces Cloudflare's achievement of the EU Cloud Code of Conduct compliance mark, demonstrating GDPR compliance for 47 services. It details the significance of codes of conduct in privacy law, the requirements of the EU Cloud CoC (e.g., assisting with data protection impact assessments, effective encryption), and how Cloudflare meets these requirements. It also highlights existing privacy certifications (ISO 27001, 27018, 27701) and mentions upcoming interest in the Global Cross Border Privacy Rules (CBPR) certification.

Mar 2023One-click ISO 27001 certified deployment of Regional Services in the EUIntroduced a new region for Regional Services specifically for ISO 27001 certified data centers within the EU. Relaunched the Data Localization Suite UI to allow per-hostname region configuration, moving away from zone-wide settings. Added a self-serve UI for configuring log flow destinations. This enhances flexibility and ease of use for data localization and compliance requirements.

Mar 2023Cloudflare One DLP integrates with Microsoft Information Protection labelsThis post announces the integration of Cloudflare One DLP with Microsoft Purview Information Protection sensitivity labels. It details how CASB can retrieve these labels and use them to build DLP rules within Gateway Firewall Policies. The integration allows for the enforcement of data movement policies based on Microsoft's data classification, extending protection to corporate traffic and SaaS applications beyond the Microsoft environment.

Mar 2023Scan and secure Atlassian with Cloudflare CASBThis post announces the integration of Cloudflare CASB with Atlassian Confluence and Jira. It details how CASB can scan these applications for security issues such as publicly shared content, unauthorized access, account misuse, and overshared files. The integration aims to provide security operators with visibility and control over the security of these SaaS applications.

Jan 2023Inside Geo Key Manager v2: re-imagining access control for distributed systemsIntroduced Geo Key Manager v2 (GeoV2), a significant upgrade to the previous system, by replacing its identity-based broadcast encryption and revocation with Attribute-Based Encryption (ABE). This change addresses inflexibility in access control policies, enabling richer data localization and quicker restriction of access to sensitive key material. GeoV2 also resolves performance issues and manual key rotation challenges faced by GeoV1. The post details the architectural challenges of managing private keys in a distributed system and explains how ABE provides a more scalable and flexible solution, avoiding single points of failure. Cloudflare has open-sourced its ABE implementation in CIRCL.

Jan 2023Navigating the changing data localization landscape with Cloudflare’s Data Localization SuiteIntroduced self-service APIs for enabling Regional Services on a per-hostname basis and for the Customer Metadata Boundary, significantly improving usability. Expanded Geo Key Manager accessibility to 15 regions. Announced plans to support more regions for Regional Services and Metadata Boundary, and full data localization for Zero Trust products.

Jan 2023Investing in security to protect data privacyThis post emphasizes the critical role of robust security measures, including WAF, DDoS protection, and encryption in transit, in protecting personal data, arguing that effective security is paramount regardless of data location. It highlights how Cloudflare's global network and threat intelligence capabilities enable real-time protection against evolving cyber threats, minimizing the risk of data compromise.

Jan 2023Cloudflare's CASB integration with Salesforce and BoxThis post announces the integration of Cloudflare CASB with Salesforce and Box. It details how IT and security operators can connect their environments to scan for security issues such as publicly shared files, default permissions, and inappropriate sharing. The integration allows for the detection of sensitive business data risks within these SaaS applications.

Jan 2023How Cloudflare CASB and DLP work together to protect your dataThis post details the integration of Cloudflare CASB and DLP, enabling SaaS DLP. It explains how CASB scans SaaS applications for misconfigurations and user activity, while DLP for data-in-transit blocks sensitive data movement over the network. The new synergy allows CASB to scan files within SaaS applications for sensitive data (PII, PCI, custom regex), providing signals to assess and remediate security risks. This expands Cloudflare's data loss prevention story to cover data at rest in SaaS applications.

Jan 2023Announcing Custom DLP profilesThis post introduces custom DLP profiles, enabling users to define their own detection rules using Rust regexes within the Cloudflare Zero Trust dashboard. It details the process of creating a new profile, adding detection entries with regular expressions, and applying these custom profiles to HTTP policies within Cloudflare Gateway. The post also outlines the current roadmap for DLP features, including PDF scanning and upgraded file name logging.

Dec 2022A new, configurable and scalable version of Geo Key Manager, now available in Closed BetaIntroduced a new, configurable, and scalable version of Geo Key Manager available in Closed Beta. This version allows customers to define custom policies for private key storage based on country, region, or compliance standards (e.g., 'only store my private keys in India', 'only store my private keys in the European Union', 'only store my private keys in FIPS compliant data centers'). Key improvements include enhanced flexibility to mix and match rules (allowlist/blocklist), dynamic scalability to accommodate network expansion without manual intervention, and built-in redundancy restrictions to prevent customers from creating availability concerns. The post also highlights upcoming features like a UI, performance metrics, and extension to other certificate types.

Dec 2022Democratizing access to Zero Trust with Project GalileoThis post announces the extension of Cloudflare's Zero Trust products to all organizations participating in Project Galileo, a program that provides cybersecurity to non-profits and civil society organizations. This initiative democratizes access to enterprise-level security, addressing the digital divide and the limitations of 'one-size-fits-all' security models. The post highlights how Project Galileo participants like the CyberPeace Institute, Information Technology Disaster Resource Center, Meedan, and the Organization of American States are leveraging Cloudflare Zero Trust to secure their operations, protect employees, and focus on their missions.

Nov 2022The Linux Kernel Key Retention Service and why you should use it in your next applicationThis post introduces the Linux Kernel Key Retention Service as a novel approach to protecting cryptographic keys. It highlights how this service, by keeping keys within the kernel's address space, mitigates memory access violations and prevents leaks that can occur in user-space applications, even those written in memory-safe languages. This directly contributes to Cloudflare's data privacy and protection efforts by offering a more robust method for safeguarding sensitive cryptographic material.

Oct 2022Privacy Gateway: a privacy preserving proxy built on Internet standardsThis post introduces Privacy Gateway, a new service built on the Oblivious HTTP (OHTTP) standard and hybrid public-key cryptography. Privacy Gateway acts as a privacy-preserving proxy, encrypting HTTP requests and responses between clients and application servers. This ensures that Cloudflare does not see the content of requests, and application servers do not see the client's IP address or other network identifiers. The post details how Privacy Gateway provides 'request privacy' and 'client privacy,' its architecture, and integration steps for developers. It highlights use cases like privacy-respecting telemetry, healthcare applications, and DNS privacy (Oblivious DNS), positioning it as a specialized tool for sensitive applications.

Oct 2022Stronger than a promise: proving Oblivious HTTP privacy propertiesThis post details the formal, computer-aided security analysis of Oblivious HTTP (OHTTP), a protocol designed to decouple 'who' from 'what' is sent by using end-to-end encrypted requests forwarded through a relay. It explains the protocol's design, its use of HPKE and Binary HTTP, and the simplified model used for analysis, demonstrating how OHTTP prevents linkability between clients and their requests/responses, thereby enhancing data privacy.

Sep 2022Private by design: building privacy-preserving products with Cloudflare's Privacy EdgeThis post introduces Privacy Edge, a suite of products designed to help developers build privacy into their applications. It details four components: Privacy Gateway (using Oblivious HTTP for IP-blinding relays), Code Auditability (verifying code integrity via hashing, exemplified by WhatsApp Web integration), Private Proxy (a platform for proxying traffic with privacy protocols, including token-based authentication and geolocated IP assignment), and Cooperative Analytics (a multi-party computation system based on the Distributed Aggregation Protocol for privacy-preserving analytics).

Sep 2022Regional Services comes to India, Japan and AustraliaThis post announces the general availability of Regional Services in India, Japan, and Australia, expanding the Data Localization Suite's coverage. It details how Regional Services work by forwarding encrypted traffic to data centers within the customer-selected region for decryption and application of Layer 7 products, addressing the limitations of anycast networks in respecting regional borders. The post also highlights the growing global trend towards data localization and Cloudflare's commitment to supporting more regions in the future.

Sep 2022Cloudflare Data Loss Prevention now Generally AvailableThis post announces the General Availability of Cloudflare's Data Loss Prevention (DLP) product. It details how DLP works by inspecting HTTP traffic, decompressing and decoding requests, and scanning for regex matches, with algorithmic validation for numeric patterns. It highlights the integration with Cloudflare One's Zero Trust platform and provides a walkthrough of configuring DLP profiles and applying them via HTTP policies in the Zero Trust Dashboard. The post also mentions planned future enhancements such as custom DLP profiles and more predefined detections.

Jun 2022Announcing Gateway + CASBThis post introduces the seamless integration of Cloudflare's API-driven CASB with its Secure Web Gateway. It enables users to create Gateway policies directly from CASB security findings, facilitating rapid remediation of detected security issues within SaaS applications. For example, a CASB finding about third-party app sign-ins in Google Workspace can be used to quickly create a Gateway policy to block specific activities like uploads or downloads to that application.

Jun 2022Introducing browser isolation for email links to stop modern phishing threatsThis post details the integration of Cloudflare Area 1 email security with Cloudflare Secure Web Gateway and Remote Browser Isolation (RBI). Suspicious email links are rewritten to a Cloudflare prefix URL, and upon clicking, are redirected to a remote browser instance on the Cloudflare network. This isolates any malicious content, preventing it from infecting user devices or compromising identities. The RBI technology uses Network Vector Rendering (NVR) for efficient and scalable browser isolation.

Jun 2022Launching In-Line Data Loss PreventionThis post introduces Data Loss Prevention (DLP) as a native part of the Cloudflare One platform. It addresses customer challenges in understanding data flow, especially with the rise of SaaS tools, and explains how DLP integrates with Zero Trust architecture by identifying data based on keywords, patterns, and file types. The post details the implementation through DLP Profiles and HTTP policies within Cloudflare Gateway, leveraging Cloudflare's global network for scalable DLP solutions.

Jun 2022Area 1 threat indicators now available in Cloudflare Zero TrustThis post details the integration of Area 1's threat indicator data into Cloudflare's product suite, specifically enhancing the Phishing category in Cloudflare Gateway. It describes how Area 1's data pipelines, web crawling tools, and threat research complement Cloudflare's existing threat intelligence, improving proactive identification of phishing infrastructure and campaigns. The combined datasets and approaches aim to provide a more comprehensive defense against sophisticated threat actors.

Jun 2022Cloudflare Zaraz launches new privacy features in response to French CNIL standardsCloudflare Zaraz has launched new privacy features to help organizations comply with GDPR and CNIL standards for third-party analytics tools. These features include: 1. Removing URL query parameters (e.g., UTM, gclid) to prevent fingerprinting. 2. Hiding originating IP addresses from third-party servers, configurable at a tool level or globally. 3. Clearing sensitive information from User Agent strings for server-side integrations. 4. Removing external referrers while preserving same-domain referrals for analytics accuracy. The post provides a step-by-step guide for configuring Google Analytics with these new features, emphasizing server-side loading via Cloudflare Workers and manual cleaning of Google Analytics configurations to avoid personal data collection.

Apr 2022What Cloudflare is doing to keep the Open Internet flowing into Russia and keep attacks from getting outThis post details Cloudflare's actions and observations regarding the internet in Russia following the invasion of Ukraine. It highlights the Russian government's efforts to control internet access and content, contrasting this with Russian citizens' adoption of tools like Cloudflare WARP to maintain access to the open internet and non-Russian news sources. The post also discusses Cloudflare's role in blocking cyberattacks originating from Russia and argues against complete service withdrawal, emphasizing the importance of keeping the Russian internet open for its citizens to access uncensored information.

Mar 2022Cloudflare and CrowdStrike partner to give CISOs secure control across devices, applications, and corporate networksThis post details a new integration between Cloudflare's Zero Trust services (Access and Gateway) and CrowdStrike's endpoint security solutions. This partnership allows for real-time device posture assessments from CrowdStrike to be used as a condition for granting access to applications and networks via Cloudflare's Zero Trust platform. It also highlights Cloudflare's participation in the CrowdXDR Alliance for telemetry sharing and CrowdStrike's role as an incident response partner.

Mar 2022Announcing experimental DDR in 1.1.1.1This post introduces and explains the experimental support for Discovery of Designated Resolvers (DDR) in Cloudflare's 1.1.1.1 service. DDR is a new mechanism that allows clients to automatically discover and upgrade to secure DNS transports (DoH, DoT) from unencrypted UDP/TCP connections, thereby enhancing end-user privacy and driving more encrypted DNS usage on the internet. It details the threat model, the mechanics of DDR using certificate-based authentication and SVCB records, and provides instructions for testing.

Mar 2022iCloud Private Relay: What Cloudflare Customers Need to KnowThis post details Cloudflare's role as a 'second relay' in Apple's iCloud Private Relay service. It explains how Cloudflare's infrastructure and expertise in modern encryption protocols (TLS 1.3, QUIC, MASQUE) enable this privacy-enhancing feature. The post also provides guidance for website operators on handling Private Relay traffic, ensuring geolocation accuracy, maintaining performance, and adapting fraud/bot management systems to shared IP addresses, highlighting that Cloudflare customers require no action as their systems are already equipped to handle this traffic.

Feb 2022HPKE: Standardizing public-key encryption (finally!)This post introduces Hybrid Public Key Encryption (HPKE) as RFC 9180, a new standard for public-key encryption designed for simplicity, reusability, and future-proofing. It details the motivation, design goals (algorithm agility, authentication modes), and construction of HPKE, highlighting its use in emerging privacy-focused internet standards like Encrypted Client Hello and Oblivious DNS-over-HTTPS, and its implementation in Cloudflare's CIRCL library. This contributes to Cloudflare's broader efforts in privacy-enhancing technologies.

Feb 2022Deep dive into a post-quantum key encapsulation algorithmThis post introduces the concept of Key Encapsulation Mechanisms (KEMs) and their importance in secure communication, particularly in the context of post-quantum cryptography. It explains the mathematical underpinnings of KEMs, focusing on the Learning With Errors (LWE) problem and its relation to lattices, and details the construction of FrodoKEM as an example. This contributes to the data privacy thread by addressing the future security landscape and the need for quantum-resistant encryption to maintain long-term data protection.

Feb 2022Deep dive into a post-quantum signature schemeThis post introduces the concept of digital signatures and their importance in authentication, drawing parallels to real-world identity verification. It then dives deep into the technical details of post-quantum signature schemes, specifically CRYSTALS-Dilithium, explaining its mathematical underpinnings (Lattice-based cryptography, SIS problem) and algorithmic construction (identification schemes, Fiat-Shamir transformation). This contributes to the feature thread by detailing a critical cryptographic advancement necessary for future data privacy and protection in the face of quantum computing threats, extending the thread's scope to proactive security research.

Feb 2022Need to keep analytics data in the EU? Cloudflare Zaraz can offer a solutionIntroduces Cloudflare Zaraz as a solution to address GDPR compliance concerns related to third-party tool data transfers, specifically the Austrian Data Protection Authority's ruling on Google Analytics. Zaraz leverages Cloudflare Workers to load third-party tools in the cloud, not the browser, enabling features like IP address masking and Data Loss Prevention (DLP) scanning. It also integrates with Cloudflare's Data Localisation Suite (Regional Services and Customer Metadata Boundary) to provide data residency options for Zaraz services.

Dec 2021Introducing the Customer Metadata BoundaryIntroduced the Customer Metadata Boundary, an expansion of the Data Localisation Suite, to ensure that a customer's end user traffic metadata stays within the EU. This feature ensures that log messages identifying a customer (containing their Account ID) are not sent outside the EU, and are only forwarded to EU core data centers, not US core data centers.

Oct 2021Privacy-Preserving Compromised Credential CheckingThis post introduces MIGP (Might I Get Pwned), a new privacy-preserving compromised credential checking protocol. It details the motivation for such a protocol, the threat of data breaches and credential stuffing, and the limitations of existing services. The post explains the MIGP protocol's advancements, including its ability to check for similar passwords (not just exact matches) and its privacy-preserving properties (no password information leaked, minimal username information leaked). It also discusses breach extraction attacks and countermeasures. Finally, it announces the public demo and open-sourced Go implementation of MIGP, and its deployment within Cloudflare's infrastructure.

Oct 2021Exported Authenticators: The long road to RFCThis post introduces Exported Authenticators (EAs) as a new extension to TLS, designed to enhance authentication possibilities. It explains how EAs provide application-layer authentication as strong as TLS peer authentication, allowing for features like multiple certificates or passwordless logins. The post details the design and standardization process of EAs within the IETF, highlighting their close adherence to TLS 1.3 design principles and the importance of channel binding for security. This contributes to the broader theme of data privacy and protection by advancing the security of internet communications.

Oct 2021Privacy Pass v3: the new privacy bitsThis post announces Privacy Pass v3.0, detailing significant improvements to the browser extension and the underlying protocol. Key contributions include refactoring the extension for better maintainability and modularity, enabling easier integration of future service providers. It also highlights progress on standardizing the Privacy Pass protocol at the IETF and introduces the concept of metadata in tokens to combat 'hoarding' or 'farming' attacks, proposing key rotation as a potential solution with its own limitations. The post emphasizes the ongoing effort to balance user privacy with bot mitigation.

Aug 2021Introducing Zero-Knowledge Proofs for Private Web Attestation with Cross/Multi-Vendor HardwareThis post introduces the development and open-sourcing of a Zero-Knowledge Proof system for private web attestation. This innovation aims to enhance user privacy by allowing websites to verify the authenticity of hardware security keys without learning sensitive information like the manufacturer or model, thereby reducing the risk of user identification and moving beyond the limitations of existing WebAuthn attestation. It represents a significant step in Cloudflare's ongoing efforts to improve privacy across the internet.

Dec 2020Helping build the next generation of privacy-preserving protocolsThis post details Cloudflare's proactive efforts in developing and deploying new privacy-preserving protocols, including Encrypted Client Hello (ECH), Oblivious DNS-over-HTTPS (ODoH), and OPAQUE. It highlights the importance of protecting metadata, not just content, and positions these initiatives as a continuation of Cloudflare's long-standing commitment to building a more private and user-respecting internet, building upon previous work in Universal SSL, TLS 1.3, QUIC, and DNS security.

Dec 2020Improving DNS Privacy with Oblivious DoH in 1.1.1.1This post introduces and explains Oblivious DNS over HTTPS (ODoH), a new proposed DNS standard co-authored by Cloudflare engineers. ODoH enhances DNS privacy by separating IP addresses from queries, ensuring no single entity can see both simultaneously. It achieves this through public key encryption and a network proxy between clients and DoH servers, providing technical guarantees for privacy beyond policy-based trust. Cloudflare is launching support for ODoH in its 1.1.1.1 service with several launch partners.

Dec 2020Introducing the Cloudflare Data Localization SuiteThis post introduces the Cloudflare Data Localization Suite, a new offering for Enterprise customers. Key components include: Keyless SSL (allowing customers to manage their own SSL private keys externally), Geo Key Manager (enabling granular control over where private keys are accessed, with an example of EU-only access), Regional Services (allowing traffic inspection within customer-selected regions), and Edge Log Delivery (in beta, enabling logs to be sent directly from the edge to customer-chosen destinations like Azure storage or on-premise Splunk). A significant new capability is Jurisdiction Restrictions for Workers Durable Objects, ensuring data storage and processing within specified jurisdictions. This suite addresses the growing need for data locality compliance while leveraging Cloudflare's global network.

Sep 2020Are you GDPR-compliant? New phishing message harvests credentials with GDPR lureThis post details a specific phishing campaign that exploits misconceptions about GDPR compliance to harvest credentials. It highlights the technical methods used by attackers, including spoofing email headers and leveraging compromised websites, and underscores the importance of employee education and advanced security solutions to combat such threats. This contributes to the thread by demonstrating a real-world attack vector that targets users' understanding of data privacy regulations, and how Cloudflare (through Area 1 Security) is actively working to detect and prevent these sophisticated attacks.

Jun 2020Introducing Regional ServicesIntroduced Regional Services for Enterprise customers, allowing them to choose a subset of data centers to service traffic at the HTTP level. This enables compliance with data residency requirements while still leveraging Cloudflare's global network for DDoS protection and network acceleration. TLS keys are stored and used only within the chosen region for Layer 7 processing.

Jun 2020UtahFS: Encrypted File StorageThis post introduces UtahFS, a proof-of-concept for end-to-end encrypted file storage. It addresses the need for users to have complete control over their sensitive data, going beyond transport-layer and disk encryption. UtahFS implements features like encrypted directory structure, partial file access without full download/decrypt, and uses object storage, skip lists, Merkle Trees for integrity, and Path ORAM for hiding access patterns. This represents a significant advancement in providing users with granular control and privacy for their stored data.

Apr 2020The Mistake that Caused 1.1.1.3 to Block LGBTQIA+ Sites TodayThis post details a mistake in the initial rollout of '1.1.1.1 for Families', a filtered DNS service. An incorrect content categorization feed led to the inadvertent blocking of LGBTQIA+ sites. The post explains the licensing of categorization data, the intended narrow definition of 'Adult Content' mirroring Google SafeSearch, and the technical challenges in quickly updating data structures across the global network. It highlights the immediate actions taken to create an allow list for affected sites and the subsequent generation and deployment of the corrected data structure. The post also outlines future protections to prevent similar errors.

Apr 2020Announcing the Beta for WARP for macOS and WindowsThis post announces the beta release of WARP for macOS and Windows, extending the privacy and security features of the 1.1.1.1 app to desktop operating systems. It highlights the use of the Wireguard protocol for fast and secure connections, the free basic service, and plans for WARP+ support and eventual Linux client availability. This marks a significant expansion of Cloudflare's user-facing privacy tools beyond mobile devices.

Apr 2020Introducing 1.1.1.1 for FamiliesThis post introduces '1.1.1.1 for Families,' a new offering built upon the existing 1.1.1.1 DNS resolver. It addresses user requests for content filtering by providing two options: one that blocks malware and another that blocks both malware and adult content. This expands the privacy-focused DNS service to include parental controls and enhanced security for home networks, leveraging Cloudflare's site categorization and filtering technology.

Mar 2020Announcing the Results of the 1.1.1.1 Public DNS Resolver Privacy ExaminationThis post announces the results of an independent examination of the 1.1.1.1 public DNS resolver's privacy commitments. It details the examination process, including technical measures like IP truncation and limited data retention, and addresses some initial ambiguities in communication regarding log retention. The post also clarifies and refines the specific privacy commitments for the 1.1.1.1 resolver, emphasizing that personal data will not be sold or shared, source IPs will not be retained in non-volatile storage (except for a small, sampled subset for network troubleshooting), and transaction logs will be deleted within 25 hours. It highlights the importance of proving privacy commitments and encourages other organizations to do the same.

Oct 2019Supporting the latest version of the Privacy Pass ProtocolThis post details the evolution of the Privacy Pass protocol, a privacy-preserving technology developed in collaboration with the academic community. It announces support for Privacy Pass v2.0 with an updated browser extension, improved cryptographic functionality (including hash-to-curve methods and key rotation), and new integrations like hCaptcha. The post also highlights the rollout of a new server backend using Cloudflare Workers and ongoing standardization efforts for Oblivious Pseudorandom Functions (OPRFs) and the Privacy Pass protocol itself.

Nov 20181 Thing You Can Do To Make Your Internet Safer And FasterThis post announces the launch of the 1.1.1.1 mobile app, making Cloudflare's fast and private DNS resolver easily accessible to a wider audience, particularly on mobile devices. It highlights the app's role in protecting users from ISP data selling and improving internet speed, reinforcing Cloudflare's commitment to a better and more private internet for everyone.

Sep 2018Verschlüsselung von SNI: Wie einer der großen Internet-Bugs behoben wurdeThis post introduces and announces the launch of Encrypted SNI (ESNI) across Cloudflare's network, a significant advancement in internet privacy. It explains the vulnerability of the previously unencrypted SNI field, which revealed visited websites to ISPs and eavesdroppers, and details how ESNI encrypts this information. The post highlights Cloudflare's collaboration with industry partners like Mozilla, Apple, and Fastly in developing and standardizing ESNI, positioning it as a new trend to make the encrypted web even more private and secure.

Sep 2018Roughtime: Securing Time with Digital SignaturesThis post introduces Roughtime, a free, high-availability, low-latency authenticated time service. It addresses the critical issue of clock skew in clients, which can lead to TLS certificate errors and security vulnerabilities. Roughtime uses digital signatures to ensure the accuracy and authenticity of time, making it a valuable tool for securing cryptographic operations like TLS certificate validation. Cloudflare's deployment of Roughtime serves to hold themselves accountable for the validity of TLS artifacts and to promote the growth of the Roughtime ecosystem by encouraging independent participation.

Aug 2018Enable Private DNS with 1.1.1.1 on Android 9 PieThis post details the integration of Cloudflare's 1.1.1.1 DNS service with Android 9 Pie's new Private DNS mode, enabling DNS over TLS (DoT) for encrypted DNS queries. It explains the benefits of DoT for user privacy, the configuration steps, and discusses the broader context of internet privacy, including the role of TLS, DNSSEC, and the ongoing effort to encrypt SNI. The post also touches upon the complexities of DNS in an IPv6 world and Cloudflare's efforts to support dual-stack environments.

Jun 2018Introducing DNS Resolver for TorThis post introduces a Tor onion service for Cloudflare's 1.1.1.1 DNS resolver, offering an even higher level of anonymity by preventing the resolver from seeing the client's IP address and obscuring DNS requests from the ISP. It also details the technical implementation of Tor onion services and the security considerations for using such a service, including the use of certificates and Alt-Svc headers for discoverability and trust.

What this trail covers