Cloudflare launches Data Localization Suite for regional data control at the edge

Cloudflare today announced the Data Localization Suite, an add-on for Enterprise customers that brings geographic control over data handling to the company's global edge network. The suite is designed to address a growing set of legal and business requirements around data locality, letting organizations keep the performance benefits of a distributed network while restricting where sensitive data is inspected, stored, or otherwise processed.

The company positions the offering as an alternative to the common workaround of locking an application into a single data center or cloud region. That approach introduces performance and reliability trade-offs. Cloudflare's aim is to keep the network distributed while making data handling rules configurable at the edge.

Why data locality is a moving target

Data localization requirements vary by jurisdiction and industry, covering categories such as healthcare, legal, and financial records. Regulatory pressure is rising in regions including the EU, India, and Brazil, and expectations are likely to widen over time.

For many organizations, the challenge is that their internet properties must remain globally accessible. The requirement is not to block access from outside a region but to ensure that data is only handled within specific boundaries. Customers told Cloudflare they need answers to practical questions about how to bake local rules into global operations, keep plaintext traffic local, and ensure personal data and application state stay in approved geographies.

Encryption as the foundation

Data localization controls build on encryption. Cloudflare notes that all traffic in transit to end users and back to origin servers can be forced to use current TLS versions, and inter-datacenter traffic is always encrypted. At rest, everything Cloudflare handles is encrypted, from cached edge files to configuration data in core databases.

That encryption is only as good as the control over the keys. Two existing features give customers direct authority over where private keys can be used:

  • Keyless SSL lets customers store and manage private keys on their own infrastructure, including hardware security modules (HSMs) or their own servers. Cloudflare never holds the key.
  • Geo Key Manager provides granular control over which Cloudflare data centers can store and use a customer's keys, so a business can limit key access to, for example, data centers within the EU.

Controlling inspection points

Cloudflare's security products, including the Web Application Firewall and bot detection, work by terminating TLS at the edge and inspecting HTTPS request and response payloads. For customers with data locality concerns, the question is where that decrypted inspection happens.

Regional Services shifts where inspection occurs. Client traffic is still ingested at the nearest data center on Cloudflare's Anycast network, where L3 and L4 DDoS protection applies. But the traffic is then forwarded securely to Cloudflare data centers inside a customer-chosen region, where HTTP-level inspection is performed.

Keeping logs and analytics local

Operational metadata about traffic passing through the edge is used by Cloudflare to improve its own services, such as refining WAF rules or training bot-detection machine learning models. This data is also delivered to customers as analytics.

Historically, that processing funneled through Cloudflare's US and EU core data centers. That is changing with Edge Log Delivery, which lets Enterprise customers send logs directly from the edge to their own destination of choice — for example, an Azure storage bucket in a preferred region or an on-premise Splunk instance. No log data has to pass through a core data center first.

Edge Log Delivery is in early beta today. Cloudflare says it is working toward giving customers full control over location and retention of their metadata fields.

Geographic constraints for serverless state

For application builders, the hard part of data localization has been keeping application state and code within a region while remaining globally responsive. Traditional multi-region cloud deployments introduce complexity around keeping copies of state in sync.

Cloudflare Workers is designed so developers don't need to think about where code runs, but compliance departments increasingly do. The company announced that Workers Durable Objects — its mechanism for providing globally consistent state to serverless applications — will support Jurisdiction Restrictions. That feature will let users constrain Durable Objects so they cannot run or store data outside a specified jurisdiction. Cloudflare says adapting an existing application could be as simple as tagging a set of Durable Objects, with automatic migration handled by the platform.

The suite arrives as regulations continue to shift. Cloudflare pointed to the European Data Protection Board's new guidance on EU-US data transfers as one recent example and acknowledged that further rules are likely. The Data Localization Suite is intended to give customers more direct control at the edge, allowing them to meet geographic data requirements without surrendering the reach or resilience of a distributed network.