Cloudflare One provides separate controls for where Cloudflare processes supported traffic and where Cloudflare stores supported logs. These controls have different settings and supported regions.
| Control | What it controls | Current availability |
|---|---|---|
| Processing region (Regional Services for Gateway) | Where Gateway decrypts HTTPS traffic and performs HTTP inspection | Available for supported on-ramps and regions |
| Connection locations | Where cloudflared, the Cloudflare One Client, and Direct CNI connect |
Earth, United States, or FedRAMP High |
| Processing region for Access | Where Cloudflare processes reverse proxy requests for Access-protected applications | Team domain: FedRAMP Moderate Compliant (Domestic). Public hostnames: any managed region available for Regional Hostnames |
| Processing region for Browser Isolation | Where Cloudflare processes supported Browser Isolation traffic | US FedRAMP region only |
| Log region (Customer Metadata Boundary) | Where Cloudflare stores supported Customer Logs | European Union and United States for selected datasets |
| Email Security regional processing | Where Email Security examines messages for supported deployment types | Refer to the Email Security documentation |
This guide describes the current scope of Cloudflare One data residency controls.
Customers that require a FedRAMP-authorized Cloudflare One deployment should use the applicable Cloudflare One FedRAMP environment ↗︎. Product and feature availability varies between FedRAMP environments. Contact your account team to select and configure the appropriate environment.
Processing region (Regional Services for Gateway) controls where Cloudflare Gateway decrypts HTTPS traffic and performs HTTP inspection. Gateway HTTP inspection requires TLS decryption.
Processing region for Gateway does not apply to Gateway DNS or network policy processing. Gateway DNS or network policy processing occurs at the Cloudflare data center where traffic is received.
Processing region for Gateway is configured at the Cloudflare One account level. The selected region applies to Gateway HTTP traffic from supported on-ramps for the account.
Cloudflare One applies this behavior to traffic sent to Gateway through these on-ramps:
- Cloudflare One Client in Traffic and DNS mode
- Cloudflare Mesh
- Cloudflare WAN connected through IPsec, GRE, or Direct CNI
Cloudflare WAN requires unified routing for this support.
These on-ramps create a connection that may terminate at a Cloudflare data center outside the selected region (for example, Cloudflare One Client creates a MASQUE tunnel that may terminate outside the region). HTTPS traffic carried inside the connection remains encrypted until Gateway forwards it to the selected region for TLS decryption and HTTP inspection.
For connection termination locations, refer to Connection locations.
Processing region for Gateway is available in these regions:
- European Union
- Exclusive of Hong Kong and Macau
- Exclusive of Russia and Belarus
- FedRAMP Moderate Compliant (Domestic)
- FedRAMP Moderate Compliant (International)
- IRAP Protected
- NATO
- Schengen Area
- United States of America
Refer to Region support for region definitions. Contact your account team to configure or inquire about the availability of other regions.
You can bring your own certificate to Gateway, but the certificate cannot be restricted to a specific region.
File Sandboxing processes quarantined files in the United States, regardless of the selected Gateway processing region. Using File Sandboxing with a non-US processing region sends those files outside the selected region.
Processing region for Gateway supports predefined and custom DLP profiles that do not use EDM, custom wordlists, document entries, or AI prompt topics, or pattern entries with custom functions. AI context analysis and OCR are also unsupported.
Feature availability in dedicated FedRAMP environments may differ from these Gateway limitations. Contact your account team for current FedRAMP feature support.
Regional Services and egress policies are separate controls. Regional Services controls where Gateway decrypts HTTPS traffic and performs HTTP inspection. Dedicated egress IPs provide predictable, account-specific source IP addresses after traffic leaves Gateway for its destination. Customers can use them for origin allowlisting or to associate Gateway traffic with a selected IP geolocation.
Use dedicated egress IPs and Gateway egress policies to select these source IP addresses for Gateway traffic.
The following connection locations are separate from processing region:
- Cloudflare Tunnel connects globally by default. The
--region usoption restricts tunnel connections to data centers in the United States. In FedRAMP High environments, the tunnel token automatically routescloudflaredto FedRAMP data centers and no--regionflag is required. - Cloudflare One Client connects to the global environment by default. The
fedramp_highsetting connects the client to the FedRAMP High environment. - Direct CNI terminates a physical connection at the facility selected during provisioning. This is a physical topology choice that is made by the customer.
Cloudflare Access uses different connection paths depending on the application type:
- The user connects to the Access team domain, such as
<team>.cloudflareaccess.com, to authenticate. - For a public application, the user connects to the protected application hostname, such as
app.example.com, to access the application. - For a private application, the user reaches the application's private IP or hostname through the Cloudflare One Client, Cloudflare WAN, or Browser Isolation. Cloudflare evaluates the Access application policies before allowing traffic to reach the application.
The Access team domain supports processing in the FedRAMP Moderate Compliant (Domestic) region. Contact your account team to configure the Access team domain as regionalized.
A public application hostname can use any managed region available for Regional Hostnames. Configure the region on the proxied DNS hostname using one of the documented ways to use Regional Services.
For a private application hostname reached through Cloudflare Tunnel, the cloudflared --region us setting restricts the connector's Cloudflare connections to data centers in the United States. In FedRAMP High environments, the tunnel token routes cloudflared to FedRAMP data centers and no --region flag is required. The Tunnel region setting is configured separately from the processing region for eligible Gateway HTTP traffic.
When Customer Metadata Boundary is set to the European Union, Access does not store Access User Logs and the dashboard appears empty. Use Logpush to retain these logs. For more information, refer to Log region.
If the protected application hostname uses a supported custom certificate, configure Geo Key Manager to restrict where Cloudflare stores the private TLS key for that hostname. This setting applies to the hostname's TLS certificate, not to Cloudflare One.
Processing region does not control where Browser Isolation sessions run. Browser Isolation supports regional processing only in the US FedRAMP region. Contact your account team to set up a FedRAMP account.
CASB does not support regional processing through Regional Services or regional log storage through Customer Metadata Boundary.
Customer Metadata Boundary is an account-level setting that stores supported Customer Logs in the European Union or United States. It is configured independently from the processing region.
Support varies by dataset. In the CMB-supported Logpush dataset list, Respects CMB indicates whether the dataset's logs are stored only in the selected region. If a dataset is unavailable in the selected CMB region, Logpush does not deliver data for that dataset.
For datasets marked as respecting CMB, Cloudflare stores the logs and initiates Logpush delivery from the selected CMB region to a destination you control. CMB does not restrict the destination's location.
Refer to the current lists of CMB-supported Logpush datasets and CMB-supported GraphQL datasets for coverage.
Some Cloudflare One products provide additional product-specific controls for reducing or protecting logged data.
Use Gateway logging controls to exclude supported personally identifiable information fields or select which events appear in Cloudflare One activity logs.
Gateway activity logs are unavailable in the dashboard when Customer Metadata Boundary is enabled. Enterprise users can still export logs through Logpush.
Gateway DLP inspection applies to HTTP traffic through Gateway HTTP policies and requires TLS decryption.
Configure DLP payload and AI prompt logging to encrypt matched content with a customer-provided public key. Only the customer holds the private key required to decrypt the protected content.
SSH command logs can encrypt downloadable logs with a customer-provided public key for local decryption. This encryption only applies to downloadable SSH logs, not to logs exported through Logpush.