Cloudflare Extends Its Ethics Code to Suppliers and Partners
Cloudflare has published a new Third Party Code of Conduct, extending the company's ethics and integrity expectations beyond its own employees to the suppliers, resellers, and other partners that act on its behalf. The move formalizes standards for third parties operating in regions where local laws may not align with the company's baseline requirements.
Why a Separate Code Was Needed
Cloudflare's existing Code of Business Conduct and Ethics, first published during its September 2019 initial public offering, applies to all directors, officers, and employees. All staff undergo legal training on these topics during onboarding and sign an annual acknowledgement. However, that document did not cover the company's external partners.
The new code addresses that gap. Cloudflare works with third parties in countries with high corruption risk, potential political instability, and legal environments that differ from U.S. standards. The code functions as a statement of the company's core values and a requirement that partners share them. Key areas covered include human rights, fair labor, environmental sustainability, anti-bribery and corruption, trade compliance, anti-competition, conflicts of interest, data privacy and security, and government contracting.
The practical concerns behind these provisions include ensuring supply chain equipment is sourced from manufacturers who respect human rights and avoid forced or child labor, and keeping environmental sustainability as a priority. The code also aims to prevent situations where resellers might bribe customers to secure agreements, and to eliminate conflicts of interest that could give certain parties an unfair advantage. As a government contractor, Cloudflare also needs assurance that its supply chain excludes telecommunications and video surveillance equipment from prohibited parties, to protect national security interests.
Extending codes of conduct to partners is also a growing industry expectation. As Cloudflare works with more enterprise and Fortune 500 customers, it finds itself reviewing and committing to other organizations' third-party codes in turn.
Enforcement and Implementation
The Third Party Code of Conduct does not replace Cloudflare's terms of service or other contractual agreements. It supplements them, and violations of the code or existing contracts may lead to termination of the relationship with the partner.
Cloudflare plans to roll out the new code to all existing third parties and will include it in the onboarding process for new partners going forward. The code is part of a broader third-party due diligence program that already includes vetting, routine monitoring, and audits of suppliers and partners over the course of the relationship.
