SaaS Infrastructure, Without the Plumbing

For SaaS providers, the core promise is keeping customers online, fast, and secure. But delivering on that promise often means building and maintaining complex infrastructure that has little to do with the actual product being sold. For years, Cloudflare has offered SSL for SaaS to help these companies manage customer certificates and performance, but it was locked behind the Enterprise paywall. That’s changing: the solution has been renamed to Cloudflare for SaaS and is now available to everyone, with a beta open for signups.

The move reflects a product that has grown beyond its original scope. While it started as a certificate management tool, Cloudflare for SaaS now bundles security features like DDoS mitigation, a WAF, and bot management, along with performance tools. Providers can pass these protections and speed benefits down to their end customers, so a single misconfiguration or attack on one tenant doesn’t risk the whole platform. With over 10 million applications already inheriting Cloudflare’s network through SaaS providers, the infrastructure behind the product is proven at scale for tenants and their customers alike.

Why Vanity Domains Are a Hidden Burden

Many SaaS businesses give customers a branded experience by letting them use their own domain names. What sounds like a simple feature is actually one of the hardest infrastructure problems to solve. Supporting vanity domains requires custom TLS certificate provisioning, renewal, and storage for every single tenant, which means building a pipeline with many states to manage just to avoid certificate failures.

The effort doesn't stop at certificates. Once tenancy is set up, the origin must respond to traffic that arrives across many different domains, and the application must juggle different security and performance profiles. This is a major engineering investment that takes focus away from the product itself.

HubSpot is a case in point. The company rolled out an internal SSL solution in 2015, using shared certificates to handle customer domains. That worked for a while, but as the business scaled, the system became slow to deploy certificates and left customers with a subpar experience. Moving to Cloudflare's managed service allowed HubSpot to secure thousands of domains without dedicating significant engineering resources to certificate logistics.

Beyond Certificates

Certificate management is the entry point, but SaaS uptime relies on more. When a provider adopts Cloudflare for SaaS, its underlying security settings are inherited by every customer domain. This means that if an attacker targets a specific tenant, the provider — and the rest of their customers — stay shielded. Similarly, since Cloudflare’s anycast network spans data centers in over 100 countries, the origin can sit in one region while customers on the other side of the world still get accelerated load times. Pair that with features like caching and Argo Smart Routing, and the performance improvement can reach 30%.

Built on Workers

When Cloudflare opened up an early beta in January, the team expected interest from typical SaaS companies. Instead, roughly 80% of the beta users were building their applications on Cloudflare Workers. That synergy is central to the product's evolution. With Cloudflare for SaaS, developers on Workers get a managed path for custom domains, certificates, and security without the complexity of maintaining origin infrastructure or deploying code to external servers.

Three startups showcase this pattern:

  • Statusflare built a status page and monitoring platform entirely on Workers. Initially, they open-sourced their scripts and asked customers to deploy them on their own, a process that quickly broke down when updates rolled out. With Cloudflare for SaaS, Statusflare now manages custom domains, certificate issuance, and updates through simple integrations, leaving the team free to build product features instead of maintain infrastructure.
  • PLUMA, a platform for publishing blogs, podcasts, and privacy-focused analytics, runs its entire application on Workers. Using Workers KV for session data and static files, PLUMA avoids cold starts. A top user request was for branded custom domains, and Cloudflare for SaaS provides those with TLS certificates built into the flow.
  • Plink, which makes universal links for podcasts, also integrated custom domains for customers. As an early-stage startup, Plink avoided the cost of standing up external systems by using Cloudflare for SaaS along with Workers and Workers KV to offer a fully branded tenant experience, with the client reporting that the API integration was seamless.

The through-line across these examples is that building SaaS on Cloudflare removes the biggest operational burdens: certificate chains, scaling concerns, certificate authority integrations, and provisioning servers. Providers can write the code that matters, letting Cloudflare handle the rest. Whether you’re a giant building on the platform or a startup just getting traction, the infrastructure is now the easy part.

Custom Domains for Every SaaS Builder

Building a SaaS application comes with a long list of infrastructure concerns that divert engineering time away from the core product. For developers aiming to build the next major platform, managing the underlying network and security layers for every customer is a significant drain on resources. That infrastructure burden is what Cloudflare for SaaS is designed to remove, allowing teams to focus their efforts on product development instead of operational overhead.

With the beta announced today, this capability is now open to a much wider audience. The service lets SaaS providers offer custom hostnames to their own end customers, handling the associated SSL, DNS, and performance requirements through Cloudflare's edge network. For each domain, the beta will allot 20 custom hostnames, with customers admitted on a rolling basis.

Interested developers can submit a request to join the beta program. This self-service approach means that even early-stage startups can provide a polished, custom-domain experience to their users without having to build the underlying certificate management and routing logic themselves.

What's Next for Larger Deployments

While this expansion makes the core offering accessible to a broader set of builders, the team acknowledges that large Enterprise customers often require more specialized features. Work is currently underway on new capabilities tailored to these demanding environments, with an additional announcement expected in the near future. These forthcoming updates will address the unique needs of high-volume, established operations looking to scale their SaaS offerings further.