Cloudflare: DPA, subprocessors and data location

Where to find the Cloudflare DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: cdn, dns, security and edge platform. The table is the short version; the sections below add detail.

Cloudflare at a glance

Notes on Cloudflare

Cloudflare's DPA (version 6.4, effective April 3, 2026) sits under whichever agreement you have with Cloudflare, and takes effect from the date you signed or the parties otherwise agreed.

Section 4.4 gives 30 days between adding a sub-processor to the list and the sub-processor starting work, and 10 days to object. If Cloudflare can serve you without the sub-processor and decides to, you have no further rights. Otherwise you can terminate the Order Form, only for the affected Services.

The Services list names AI providers (Anthropic, OpenAI, X.AI, Groq) as sub-processors for AI Gateway, and processing locations differ by service. A separate professional-services list exists, and the services list offers an RSS feed.

Cloudflare DPA: where to find it and how it is accepted

Read the DPA on www.cloudflare.com. The DPA applies where you have an Enterprise Subscription Agreement, Self-Serve Subscription Agreement or other written or electronic agreement with Cloudflare. It takes effect from the date you signed or the parties otherwise agreed. The page shows Version 6.4, effective April 3, 2026..

Plans covered: Customers under the Enterprise or Self-Serve Subscription Agreement, or another written or electronic agreement for the Services

Named in the DPA's opening paragraph. The page does not list pricing plans.

Cloudflare subprocessors: the list and how change notices reach you

Cloudflare's subprocessor list (12 entries on the check date).

The Cloudflare Services list (Last Updated: October 1, 2025) names 12 third-party sub-processors, among them Google, Oracle, AWS, CoreWeave, Anthropic, OpenAI, X.AI and Groq for AI Gateway and Workers AI. Cloudflare Group companies are listed separately and not counted. A separate professional-services list exists, and the page offers an RSS feed for changes.

How changes are announced: Update to the sub-processor list; the page offers an RSS feed (section 4.4).

Notice before a new subprocessor starts: 30 days.

Section 4.4: Cloudflare adds new and replacement sub-processors to its list at least thirty (30) days before they start processing Personal Data.

You can object within 10 days. The parties seek a good-faith resolution. If Cloudflare can provide the Service without the sub-processor and decides to, you have no further rights under the clause. If it requires the sub-processor and cannot resolve your objection, you may terminate the applicable Order Form, only for the Services that use it (section 4.4).

Section 4.4: object in writing within ten (10) days of the notification, on reasonable grounds related to data protection.

Where Cloudflare stores data

• United States
• European Economic Area
• United Kingdom
• Japan
• Australia
• Canada
• India
• Singapore

The DPA states no data location. Locations here come from the sub-processor list and vary by service: for example Google processes Developer Platform, Zero Trust and AI Gateway data in the EEA, US, Australia and India, and Oracle lists the US, EEA, UK, Japan, Australia, Canada and Singapore for Developer Platform and Cache Reserve. AWS (Email Security) lists the US and EEA.

How Cloudflare moves data outside the EU and UK

• DPF
• SCCs (Modules 2 and 3)
• UK Addendum
• Swiss FADP terms

Section 6.4: Cloudflare says it complies with the Data Privacy Framework and will notify you if that lapses, in which case section 6.2 applies. Section 6.2: EU SCCs with Module Two or Three, Option 2 of Clause 9 using the section 4.4 notice period, German law as the fallback in Clause 17, plus UK Addendum version B1.0 and Swiss terms with Swiss governing law.

Is Cloudflare a processor or a controller?

Processor: it handles your customers' data on your instructions.

Section 2.3: you are the controller (or a processor for a third-party controller) and Cloudflare is a processor (or sub-processor).

Is Cloudflare GDPR compliant?

We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Cloudflare's own documents say:

• A DPA is published: The DPA applies where you have an Enterprise Subscription Agreement, Self-Serve Subscription Agreement or other written or electronic agreement with Cloudflare. It takes effect from the date you signed or the parties otherwise agreed. The page shows Version 6.4, effective April 3, 2026.
• A subprocessor list is published.
• Notice of new subprocessors: 30 days. Section 4.4: Cloudflare adds new and replacement sub-processors to its list at least thirty (30) days before they start processing Personal Data.
• Transfer mechanisms named: DPF, SCCs (Modules 2 and 3), UK Addendum, Swiss FADP terms.
• Data locations named: United States, European Economic Area, United Kingdom, Japan, Australia, Canada, India, Singapore.

What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.

Add Cloudflare to your own subprocessor list

This row uses the facts above. Change the purpose to match how you use Cloudflare, then paste it into your list, or open it in the generator to add your other vendors.

| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Cloudflare | CDN, DNS, security and edge platform | United States; European Economic Area; United Kingdom; Japan; Australia; Canada; India; Singapore | DPF; SCCs (Modules 2 and 3); UK Addendum; Swiss FADP terms | [DPA](https://www.cloudflare.com/cloudflare-customer-dpa/) | [Subprocessors](https://www.cloudflare.com/gdpr/subprocessors/) |

Add to my list

If you add or replace Cloudflare: what to tell your customers

Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.

Cloudflare states 30 days of notice before it adds a subprocessor. Section 4.4: Cloudflare adds new and replacement sub-processors to its list at least thirty (30) days before they start processing Personal Data. If your own customers were promised a longer notice, you have a gap to plan for.

Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.

What changed

2026-10-17

First check: facts recorded from Cloudflare's customer DPA (version 6.4, April 3, 2026) and its Cloudflare Services sub-processor list (last updated October 1, 2025).

Related vendors

• Hosting and deployment
• Vercel Application hosting and deployment
• Supabase Database hosting and authentication
• Hetzner Servers and cloud hosting
• Railway Application hosting and deployment
• All vendors

Sources and method

• https://www.cloudflare.com/cloudflare-customer-dpa/ checked 2026-10-17
• https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/ checked 2026-10-17

Facts come from Cloudflare's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: www.cloudflare.com.