Cloudflare One

Cloud SASE with SWG, CASB and ZTNA

Enterprise evidence

Procurement review needed

Public information covers sso & provisioning, auditability, reliability & support. Still unresolved: security assurance, access controls, data handling.

8 official sources · Fresh page review · Not independently tested

Sources reviewed 2026-10-24

3 / 7 areas with published evidence · 0 independently verified

Evidence & checks

Security assuranceMixed claims — review

# SOC 2 Type IIReviewed 2026-10-24View source

Cloudflare's SOC 2 Type II report covers security, confidentiality, and availability controls to protect customer data and is available to download from the Cloudflare dashboard.Reviewed 2026-10-24View source

SOC 2 FAQs | CloudflareReviewed 2026-10-24View source

What is SOC 2 Type II?Reviewed 2026-10-24View source

Before relying on it
Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.

SSO & provisioningCompany-published

It assumes familiarity with concepts such as identity providers (IdPs), user directories, single sign-on (SSO), and data loss prevention (DLP) technologies.Reviewed 2026-10-24View source

Before relying on it
Test SSO enforcement, user removal and privileged-account recovery.

Access controlsNot found

Before relying on it
Test least-privilege roles and cross-tenant access with separate test accounts.

AuditabilityCompany-published

“Customer Account Information” means the information Customer provides upon subscribing to the Service, audit logs, and Customer account settings.Reviewed 2026-10-24View source

Before relying on it
Verify administrative and data-access events, retention and export.

Data handlingMixed claims — review

“Data Processing Addendum” or DPA means the then current data processing addendum at https://www.cloudflare.com/cloudflare-customer-dpa/.Reviewed 2026-10-24View source

To view the security measures Cloudflare offers for the protection of personal data, including personal data transferred from Japan to the U.S., please see Annex 2 of our standard DPA.Reviewed 2026-10-24View source

- Breach Notification: Without undue delay, Cloudflare notifies impacted customers upon Personal Data Breaches (as defined in our DPA) and provides such customers with reasonable cooperation and assistance in respect of that Personal Data Breach.Reviewed 2026-10-24View source

Before relying on it
Review DPA, subprocessors, retention, deletion, residency and AI training use.

Reliability & supportCompany-published

PCI DSS 4.0 100% uptime SLA Chat supportReviewed 2026-10-24View source

Business Continuity & Disaster RecoveryReviewed 2026-10-24View source

Before relying on it
Request SLA, incident history, recovery targets and support escalation terms.

Product effectivenessNot found

Before relying on it
Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.

Published claims are not verified controls. No hands-on performance or security testing has been performed.

What we know

Cloudflare One combines ZTNA, SWG, CASB, FWaaS and connectivity; Gartner includes Cloudflare in its SASE platform market.

Worth asking

Can it meet SSL, phishing, sandboxing and private-app requirements?

Sources

Evidence details

Enterprise controls

# SOC 2 Type II Cloudflare's SOC 2 Type II report covers security, confidentiality, and availability controls to protect customer data and is available to download from the Cloudflare dashboard SOC 2 Type II is a security compliance attestation; a report created by independent, third-party auditors that validate and document Cloudflare's commitment to security

Developer access

API availability has not been verified.

Last checked Oct 24, 2026

Company-published evidence, not an independent audit. Unknown means unverified.