Zero Trust security with built-in privacy guardrails

Cloudflare runs its internal corporate network on its own Zero Trust products. That means the same services the company sells to customers—Cloudflare Access, the Zero Trust agent, Gateway, Magic WAN, and Cloud Email Security—are what protect its own globally distributed workforce. But deploying security tools that inspect employee traffic raises a fundamental tension: how do you enforce strong security without eroding user privacy?

Cloudflare's approach rests on four privacy principles: retain the minimum data necessary, de-identify personal data where possible, communicate transparently with employees about security measures, and keep required data only for the shortest time needed.

Organizational and technical controls

Securing a hybrid workforce requires both policy and technology. On the organizational side, Cloudflare relies on an Acceptable Use Policy, jurisdiction-specific privacy notices for employees, annual and new-hire privacy and security training, role-based access controls (RBAC), and least-privilege principles. These set expectations that technical controls then enforce and logging verifies.

On the technology side, Cloudflare uses its own Cloudflare One services. Cloudflare Access serves as the Zero Trust Network Access (ZTNA) layer, verifying identity, enforcing multi-factor authentication with security keys, and evaluating device posture via the Zero Trust client on every request. The Zero Trust agent and Magic WAN route traffic into the Secure Web Gateway (Gateway) to protect against online threats.

What Gateway visibility enables

With forward-proxied Internet traffic, Cloudflare's security teams gain several capabilities:

  • Granular HTTP controls: HTTPS inspection blocks access to malicious sites flagged by the security team, runs antivirus scanning, and enforces identity-aware browsing policies.
  • Selective browser isolation: Remote browser isolation (RBI) runs web code on Cloudflare's network, away from local devices. Cloudflare currently isolates social media, news, personal email, and other risky categories, with employee feedback loops to refine those categories.
  • Geography-based logging: Outbound request origins help security teams understand workforce distribution, including presence in high-risk areas.
  • Data Loss Prevention: Flagged sensitive data in outbound HTTP/S traffic is identified and prevented from leaving the corporate network.
  • Cloud Access Security Broker: Monitors SaaS applications for misconfigurations and potentially exposed sensitive data.

Email security with isolation

Cloud Email Security protects against phishing and business email compromise. A key feature is email link isolation, which opens potentially suspicious links in an isolated browser using RBI. This lets the security team be less aggressive with blocking suspicious links without increasing risk, reducing false positives for both employees and the security team.

The privacy side of the equation

These security tools can see a lot of data, which is exactly why privacy controls must be built into the products themselves. Cloudflare's product teams work with product and privacy counsel to practice privacy by design.

A concrete example is PII management in Gateway logs. Administrators can choose to exclude PII from Gateway logs entirely, redact PII from logs, or control access to PII using the dedicated Zero Trust PII Role.

Transparency with employees is equally important. Cloudflare's security and privacy teams built an internal wiki page that plainly explains which data the security tools collect and why, along with the privacy choices available. This matters especially for bring-your-own-device (BYOD) employees who install endpoint management and the Zero Trust client on personal mobile devices to access Cloudflare systems. The wiki spells out what traffic on those devices Cloudflare teams can see and how employees can protect their privacy when using devices for purely personal purposes.

Access to Zero Trust service data is restricted to team members who need it as an essential part of their job. Those with access must complete training on handling sensitive data responsibly, and all queries against the relevant database are logged with the identity of the person who ran them. Employees also have mechanisms to ask questions or raise concerns about how their data is used, including direct access to the leaders responsible for the tools.

Balancing security and privacy

Cloudflare's position is that strong security and data privacy are not mutually exclusive. For organizations looking to secure their own networks, the company recommends choosing security products with built-in personal data protections and making sure policies are transparent and accessible. Employees should understand that on corporate systems they generally have lower privacy protections than on personal accounts and devices, and organizations should communicate those differences clearly. Where privacy champions, works councils, or other employee representation groups exist, engaging with them early and often helps employees understand what controls they have over their data.