Cloudflare gives enterprises a way to keep HTTP processing inside chosen regions
Cloudflare has announced Regional Services, a new offering that lets Enterprise customers restrict where their traffic receives application-layer processing, while still leveraging the entirety of the company's global Anycast network for basic protection and delivery.
The company's network spans more than 200 cities, with identical software stacks deployed everywhere. That homogeneity means a single configuration change applies to all locations within seconds, and anycast routing automatically directs each end user to the nearest data center. For most customers, that is exactly the desired behavior. However, some organizations have contractual or regulatory obligations that require data processing to stay within specific geographic boundaries. Regional Services is designed for those cases.
The split between network-level and HTTP-level handling
Regional Services does not reduce network capacity. Instead, it separates two tiers of traffic handling. All ingress still lands on the closest Cloudflare data center, where DDoS protection and network-layer acceleration are applied. From there, legitimate traffic is forwarded to data centers inside the customer's chosen region, and only those regional data centers execute layer 7 functions.
That means the following HTTP-layer features operate solely within the selected region:
- Content caching and retrieval
- WAF inspection of HTTP payloads
- Bot Management detection and blocking
- Workers script execution
- Access policy enforcement
- Load Balancer decisions about origin selection
TLS keys are stored and used exclusively within the designated region, preventing data centers outside it from decrypting or inspecting customer traffic. The global network still absorbs and mitigates distributed denial-of-service attacks at the edge before any traffic is forwarded inward.
Available regions and configuration
Regional Services is available to Enterprise customers as an add-on to their contracts. Cloudflare is launching with two preconfigured regions — the United States and the European Union — with plans to add more based on customer demand.
The maps below show how traffic flows differ per region. Purple dots mark data centers that handle DDoS mitigation and network acceleration; orange dots mark data centers that also process layer 7 traffic.
