Geo Key Manager gets policy-based key storage controls

Encryption key management is a balancing act between performance and compliance. Keys stored closer to users reduce latency, but privacy regulations increasingly dictate where private keys may reside. Cloudflare’s Geo Key Manager, launched in 2017 to let customers restrict key storage to the US, EU, or a set of high-security data centers, is now getting a more flexible foundation.

The new version, available in Closed Beta, replaces the fixed regional model with customer-defined policies. Instead of choosing from a handful of regions, customers can specify storage boundaries by country, by region, or by mixing both.

From static regions to dynamic policies

The original Geo Key Manager served a clear purpose: it launched just before GDPR took effect and supported exactly three regions. Since then, the regulatory landscape has shifted significantly—more than 15 countries now have data protection laws with transfer or localization restrictions. The static regional approach no longer maps cleanly to how compliance rules are written.

There was also a scalability problem. The underlying cryptography relied on a hard-coded data center list for each region. Expanding that list meant overhauling the system. Cloudflare’s network has grown by more than 100 data centers since the original launch, so any new data center that could qualify for key storage was effectively left unused.

The new design solves that by allowing the system to scale dynamically. As data centers are added to or removed from the network, the key distribution can adjust without manual intervention.

Flexibility also extends to the rules themselves. Customers can define an allowlist or blocklist of countries and regions. A policy can be as broad as a continent or as narrow as a single country specified by its two-letter ISO 3166 code. Rules can be combined, for example:

  • Store keys only in the EU and US.
  • Store keys in the EU but exclude France.
  • Store keys globally except in specific countries.

The policy engine is attribute-based rather than purely geographic. Future policies could target compliance standards such as FedRAMP or ISO 27001, letting customers route keys based on data center certifications rather than location alone.

Guarding against availability risks

Granular control introduces a new risk: customers might define a region so small that redundancy suffers. If a data center goes offline for maintenance and keys are stored in only two locations, availability could be seriously degraded.

To address that, the new version includes redundancy restrictions. Policies must include enough data centers to support high availability, preventing customers from accidentally choosing a boundary that is too narrow to operate reliably.

Latency transparency

Geographic key storage has direct performance implications. A customer storing keys only in the US will see latency for requests originating from Asia. With finer-grained regional controls, those effects become easier to trigger and harder to anticipate.

Cloudflare is working on performance metrics that show the latency impact of a policy from two angles: regionally, such as the effect on Asia-based customers, and globally, such as the average impact for requests from anywhere in the world. The goal is to let customers see the trade-off before committing to a configuration, so they can decide whether to segment traffic using a separate domain for regional services.

What’s still in the pipeline

The Closed Beta version is API-only. Cloudflare says a UI is in development to make policy management easier, and it will surface performance warnings when a policy risks degraded latency or redundancy. Future releases will also extend policy-based restrictions to certificates issued through Advanced Certificate Manager and SSL for SaaS, rather than only custom uploaded certificates.

Additional default regions are planned to simplify selection, and Cloudflare is soliciting feedback on which regions and features customers want to see next.