Cloudflare extends EU data localisation to metadata
Cloudflare has introduced the Customer Metadata Boundary, an extension of its Data Localisation Suite that ensures end-user traffic metadata identifying a customer remains within the EU. The move comes amid tightening data sovereignty rules, particularly after the EU’s Schrems II ruling, and addresses customer demands for stricter control over where their data is processed and stored.
Why metadata matters
Metadata—"data about data"—is collected by every internet service, and Cloudflare gathers it to power analytics dashboards, share logs with customers, detect DDoS and bot attacks, and maintain network reliability and performance. Each of Cloudflare’s edge services, from the Firewall and Cache to the DNS Resolver and Workers runtime, emits structured log messages containing fields such as timestamps, URLs, and account and zone identifiers.
These logs do not contain the content of customer traffic—no usernames, passwords, or personal details of end users. However, they can include end-user IP addresses, which are treated as personal data under EU law. That distinction is central to the new boundary.
Framing the EU legal landscape
The GDPR does not mandate that personal data stay inside the EU; it instead provides legal mechanisms, such as Standard Contractual Clauses (SCCs), for ensuring equivalent protections when data is transferred abroad. The Schrems II decision in July 2020 invalidated the EU-U.S. Privacy Shield framework, but it upheld other transfer mechanisms that offer sufficient safeguards against access by U.S. authorities.
Cloudflare says its existing safeguards predate Schrems II, including commitments on government data requests and certifications under ISO 27701, which maps to GDPR requirements. In response to the ruling, the company also updated its Data Processing Addendum (DPA), incorporated the latest SCCs, and aligned with the EDPB’s June 2021 Recommendations on Supplementary Measures. Still, the company acknowledges that customers in regulated sectors—healthcare, law, finance—often want a stronger assurance: that EU personal data stays within EU borders.
Three localisation concerns, three solutions
Cloudflare’s Data Localisation Suite was built to address three major customer concerns:
- Ensuring encryption keys remain in the EU
- Ensuring edge services like caching, WAF, and DDoS protection only run in EU data centers
- Ensuring metadata never leaves the EU
For the first concern, Cloudflare has long offered Keyless SSL and Geo Key Manager, which guarantee that private SSL/TLS key material never leaves the specified region—Keyless SSL ensures Cloudflare never holds the key material at all, while Geo Key Manager uses Keyless SSL under the hood.
The second concern was addressed last year with Regional Services, which restricts Cloudflare from decrypting and inspecting HTTP traffic outside the EU. This means SSL connections are terminated only in EU data centers, and layer 7 security and performance services operate solely within EU infrastructure.
The Customer Metadata Boundary now closes the third gap. When enabled, the edge routes any log message containing a customer’s Account ID exclusively to Cloudflare’s EU core data center, preventing that metadata from being forwarded to the U.S. core data center. The result: logs and analytics visible to the customer stay local.
Metadata flow under the boundary
Cloudflare’s network architecture relies on dozens of services that each emit logs. Under normal operation, these messages flow through the edge into core data centers for processing. The Metadata Boundary leverages the fact that all identifying metadata passes through a single service at the edge before reaching the core. With the boundary active, that service acts as a gatekeeper for EU-based customers, filtering log messages by Account ID and ensuring EU-destined messages never leave the region.
This design ensures that the metadata boundary applies not just to the content Cloudflare inspects, but also to the operational data its systems generate about that traffic.
Roadmap
Currently, the Data Localisation Suite is applied to inbound HTTP traffic products, including Cache, Firewall, DDoS protection, and Bot Management. Cloudflare says it plans to expand the suite globally and extend the Metadata Boundary to its Zero Trust offerings, such as Cloudflare for Teams. The company is also working to make Geo Key Manager and Regional Services work in more regions beyond the EU.
