# Cloudflare One

Cloud SASE with SWG, CASB and ZTNA

Research: https://www.safecli.org/company/cloudflare.com
Company: https://cloudflare.com

## Evidence status

Procurement review needed
Source review: 2026-10-24T16:10:09.729Z
API: Unknown

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Mixed claims — review

> # SOC 2 Type II

Source: https://www.cloudflare.com/trust-hub/compliance-resources/soc-2/
Reviewed: 2026-10-24T16:10:09.729Z

> Cloudflare's SOC 2 Type II report covers security, confidentiality, and availability controls to protect customer data and is available to download from the Cloudflare dashboard.

Source: https://www.cloudflare.com/trust-hub/compliance-resources/soc-2/
Reviewed: 2026-10-24T16:10:09.729Z

> SOC 2 FAQs | Cloudflare

Source: https://www.cloudflare.com/trust-hub/compliance-resources/soc-2/
Reviewed: 2026-10-24T16:10:09.729Z

> What is SOC 2 Type II?

Source: https://www.cloudflare.com/trust-hub/compliance-resources/soc-2/
Reviewed: 2026-10-24T16:10:09.729Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Company-published

> It assumes familiarity with concepts such as identity providers (IdPs), user directories, single sign-on (SSO), and data loss prevention (DLP) technologies.

Source: https://developers.cloudflare.com/reference-architecture/design-guides/zero-trust-for-saas/
Reviewed: 2026-10-24T16:10:09.729Z

- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Not found


- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Company-published

> “Customer Account Information” means the information Customer provides upon subscribing to the Service, audit logs, and Customer account settings.

Source: https://www.cloudflare.com/en-au/enterpriseterms/
Reviewed: 2026-10-24T16:10:09.729Z

- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Mixed claims — review

> “Data Processing Addendum” or DPA means the then current data processing addendum at https://www.cloudflare.com/cloudflare-customer-dpa/.

Source: https://www.cloudflare.com/en-au/enterpriseterms/
Reviewed: 2026-10-24T16:10:09.729Z

> To view the security measures Cloudflare offers for the protection of personal data, including personal data transferred from Japan to the U.S., please see Annex 2 of our standard DPA.

Source: https://www.cloudflare.com/trust-hub/appi/
Reviewed: 2026-10-24T16:10:09.729Z

> - Breach Notification: Without undue delay, Cloudflare notifies impacted customers upon Personal Data Breaches (as defined in our DPA) and provides such customers with reasonable cooperation and assistance in respect of that Personal Data Breach.

Source: https://www.cloudflare.com/trust-hub/appi/
Reviewed: 2026-10-24T16:10:09.729Z

- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> PCI DSS 4.0 100% uptime SLA Chat support

Source: https://cloudflare.com/
Reviewed: 2026-10-24T16:10:09.729Z

> Business Continuity & Disaster Recovery

Source: https://www.cloudflare.com/security-exhibit/
Reviewed: 2026-10-24T16:10:09.729Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Not found


- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: