Repository navigation
Conversation
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://docs-cf1-data-localization.previews.developers.cloudflare.com (commit 67abb5b)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
AI Review✅ Reviewed 👉 Fix in your agent 👈Fix the following review findings in PR #34346 (https://github.com/cloudflare/cloudflare-docs/pull/34346).
Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification.
- If you disagree, explain why.
- If you need clarification before deciding, ask those questions.
- Then share your plan for which issues to tackle and in what order.
After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.
The comment must come before the commit because the next review reads PR comments.
## Style Guide
- S-01bd1db1 | src/content/docs/data-localization/how-to/zero-trust.mdx:74 | Wrap the two-step configuration procedure in `<Steps>`
This is a `how-to` page, and the numbered list at lines 74–75 is a configuration procedure introduced by "Both Access connections require configuration:". Per the Steps rule, multi-step procedures on how-to pages must use the `<Steps>` component rather than a plain numbered list.Style GuideSkipped: no new docs content changes since the last review.
Commands
|
Review coverage🟡 1 ownership area needs approval. Suggested reviewers: @cferike @mathew-cf @umeshgtank
CODEOWNERS mappings for displayed areas (1)
|
| | [Customer Metadata Boundary (CMB)](#customer-metadata-boundary) | Where Cloudflare stores supported Customer Logs | European Union and United States | | ||
| | [Access with Regional Services](#access) | Where Cloudflare processes reverse proxy requests for Access-protected applications | FedRAMP Moderate Compliant (Domestic) only | | ||
| | [Browser Isolation for FedRAMP accounts](#browser-isolation) | Where Cloudflare processes supported Browser Isolation traffic | US FedRAMP region only | | ||
| | [Email Security regional processing](/cloudflare-one/email-security/reference/regional-processing/) | Where Email Security examines messages for supported deployment types | Refer to the Email Security documentation | |
There was a problem hiding this comment.
Refer to the Email Security documentation
This should have a link
| | [Email Security regional processing](/cloudflare-one/email-security/reference/regional-processing/) | Where Email Security examines messages for supported deployment types | Refer to the Email Security documentation | | ||
|
|
||
| ## Gateway | ||
| This guide describes the current scope of Cloudflare One data localization controls. |
There was a problem hiding this comment.
Having CF Tunnel mentioned above, but not the other connectors, feels odd. Maybe we can mention other connectors do not have the ability (yet?) to only terminate within region?
| ### HTTP policies | ||
| - [Cloudflare One Client](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) in [Traffic and DNS mode](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#traffic-and-dns-mode-default) | ||
| - [Cloudflare Mesh](/cloudflare-one/networks/connectors/cloudflare-mesh/) | ||
| - [Cloudflare WAN](/cloudflare-one/networks/connectors/cloudflare-wan/) using IPsec |
There was a problem hiding this comment.
using IPsec
it also works for GRE and CNI, it's independent
The noteworthy aspect is that it requires Mark III (aka unified routing)
| - [Cloudflare WAN](/cloudflare-one/networks/connectors/cloudflare-wan/) using IPsec | ||
|
|
||
| As part of Regional Services, Cloudflare Gateway will only perform [TLS decryption](/cloudflare-one/traffic-controls/http-policies/tls-decryption/) when using the [Cloudflare One Client](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) (in default [Traffic and DNS mode](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/)). | ||
| Connections from these on-ramps may terminate at a Cloudflare data center outside the selected region. For supported HTTPS traffic, Gateway forwards the still-encrypted HTTPS request to the selected region before TLS decryption and inspection. |
There was a problem hiding this comment.
For supported HTTPS traffic
What would be "unsupported" HTTPS traffic?
There was a problem hiding this comment.
+1 on the clarification for "unsupported" HTTPS traffic.
And we should clarify better what "on-ramps may terminate at a Cloudflare data center outside the selected region" actually means; that this is separate to the content (HTTP payload) inspection in itself, so we forward the encrypted content to the in-region configured location, right?
| - United States of America | ||
|
|
||
| You are able to [log the payload of matched DLP rules](/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#log-the-payload-of-matched-rules) and encrypt them with your public key so that only you can examine them later. | ||
| Refer to [Region support](/data-localization/region-support/) for region definitions. Contact your account team to inquire about the availability of other regions. |
There was a problem hiding this comment.
Contact your account team to inquire about the availability of other regions.
I would bold that
| Support varies by dataset. Refer to the current lists of [CMB-supported Logpush datasets](/data-localization/metadata-boundary/logpush-datasets/) and [CMB-supported GraphQL datasets](/data-localization/metadata-boundary/graphql-datasets/). | ||
|
|
||
| The [`--region` parameter](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#region) in `cloudflared` controls where the tunnel connector establishes its connection to Cloudflare. This setting is separate from Regional Services, which controls where user traffic is decrypted and processed. | ||
| Some Cloudflare One dashboards and APIs cannot retrieve data stored with EU CMB. For supported datasets, use [Logpush](/logs/logpush/) to send a copy of the logs to a destination you control. |
There was a problem hiding this comment.
This doesn't look great, but I'm afraid we can't do better than just saying "some won't work", right?
Also, this is making it unclear whether logpush happens in-region or out of region
| @@ -116,16 +116,13 @@ The tables below show whether each Cloudflare product is compatible with each DL | |||
|
|
|||
| ## Zero Trust | |||
There was a problem hiding this comment.
The other page keeps saying Cloudflare One, and even below we say it, so this saying Zero Trust is confusing?
Although the Dashboard is actually saying Zero Trust and no longer Cloudflare One, so I'm confused
There was a problem hiding this comment.
Agreed – personally, I'd prefer if we renamed it to product name: Cloudflare One.
However, I have customer's who are confused about product names and prefer industry-terms like "Zero Trust". So we should mention it in the description or something; could also be helpful for SEO/AEO.
| | DLP | ⚫️ [^19] | ⚫️ [^19] | 🚧 [^31] | | ||
| | Gateway | 🚧 [^20] | 🚧 [^21] | 🚧 [^22] | | ||
| | Cloudflare One Client | ⚫️ | ⚫️ | 🚧 [^1] | | ||
| Cloudflare One compatibility depends on the DLS control, traffic path, on-ramp, and dataset. The following table summarizes current support. Refer to [Data localization for Cloudflare One](/data-localization/how-to/zero-trust/) for supported regions, configuration, and product-specific behavior. |
There was a problem hiding this comment.
I appreciate the attempt to change the style of the content, but it's not great to end up with this state where some areas/products are kept in the old style, and others are in this new style. Should be all redone together IMO.
There was a problem hiding this comment.
Agree we should revamp and improve the entire compatibility page. fyi @cferike
| | DLS control | Current Cloudflare One coverage | | ||
| | - | - | | ||
| | **Geo Key Manager** | For an Access-protected application that uses a supported custom certificate, Geo Key Manager can restrict where Cloudflare stores the private TLS key for the protected application hostname. Refer to [Geo Key Manager](/data-localization/how-to/zero-trust/#geo-key-manager). | | ||
| | **Regional Services** | Gateway decrypts and inspects supported HTTPS traffic within the selected region when traffic is sent through the Cloudflare One Client in Traffic and DNS mode, Cloudflare Mesh, or Cloudflare WAN using IPsec. Access supports the FedRAMP Moderate Compliant (Domestic) region. Browser Isolation supports the US FedRAMP region. Separately, [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#region) uses its own region setting for Global or United States connections. Refer to [Regional Services for Gateway](/data-localization/how-to/zero-trust/#regional-services-for-gateway), [Access](/data-localization/how-to/zero-trust/#access), and [Browser Isolation](/data-localization/how-to/zero-trust/#browser-isolation). | |
There was a problem hiding this comment.
Some of my comments from the other page apply here as well
| | [Customer Metadata Boundary (CMB)](#customer-metadata-boundary) | Where Cloudflare stores supported Customer Logs | European Union and United States | | ||
| | [Access with Regional Services](#access) | Where Cloudflare processes reverse proxy requests for Access-protected applications | FedRAMP Moderate Compliant (Domestic) only | | ||
| | [Browser Isolation for FedRAMP accounts](#browser-isolation) | Where Cloudflare processes supported Browser Isolation traffic | US FedRAMP region only | | ||
| | [Email Security regional processing](/cloudflare-one/email-security/reference/regional-processing/) | Where Email Security examines messages for supported deployment types | Refer to the Email Security documentation | |
There was a problem hiding this comment.
Why do we have Email Security here but, let's say, not CASB or DEX?
| --- | ||
|
|
||
| import { Render } from "~/components"; | ||
| Cloudflare One provides separate controls for where Cloudflare processes supported traffic and where Cloudflare stores supported logs. These controls have different settings and supported regions. |
There was a problem hiding this comment.
Let's directly link and reference Cloudflare One or /cloudflare-one/
| ## Regional Services for Gateway | ||
|
|
||
| ### Egress policies | ||
| Regional Services controls where Cloudflare Gateway performs HTTP and Transport Layer Security (TLS) inspection. Gateway decrypts and inspects supported HTTPS traffic only within the selected region. |
There was a problem hiding this comment.
We should specify that TLS decryption is required for Gateway HTTP/S inspection.
Additionally, not sure if we want to be very clear here that "Regional Services for Gateway" only applies to Gateway HTTP, and NOT Network and DNS?
| The following sections describe how to configure Zero Trust products with the Data Localization Suite, including which features support Regional Services and Customer Metadata Boundary. | ||
| | Control | What it controls | Current availability | | ||
| | - | - | - | | ||
| | [Regional Services for Gateway](#regional-services-for-gateway) | Where Gateway decrypts and inspects supported HTTPS traffic | Available for supported on-ramps and Cloudflare One regions | |
There was a problem hiding this comment.
The regions are listed in the "Regional Services for Gateway" section; so we should probably explicitly link it also here, no?
|
|
||
| You can [bring your own certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) to Gateway but these cannot yet be restricted to a specific region. | ||
| 1. The user connects to the [Access team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name), such as `<team>.cloudflareaccess.com`, to authenticate. | ||
| 2. The user connects to the protected application hostname, such as `app.example.com`, to access the application. |
There was a problem hiding this comment.
Do we want to specify that this applies only when it is a public hostname, right?
And if that's the case, that regionalization for reverse proxy is possible via one of these ways.
| ## Customer Metadata Boundary | ||
|
|
||
| To ensure that all reverse proxy requests for applications protected by Cloudflare Access will only occur in FedRAMP-compliant data centers, you should use [Regional Services](/data-localization/regional-services/regional-hostnames/) with the region set to FedRAMP. | ||
| [Customer Metadata Boundary](/data-localization/metadata-boundary/) is an account-level setting that stores supported Customer Logs in the European Union or United States. It is configured independently from Regional Services. |
There was a problem hiding this comment.
Customer Metadata Boundary (CMB) - let's add the acronym here.
| 1. Contact your account team to configure the Access team domain. | ||
| 2. Assign the FedRAMP Moderate Compliant (Domestic) region to the protected application hostname using [Regional Services](/data-localization/regional-services/regional-hostnames/). | ||
|
|
||
| #### Verify regional map application |
There was a problem hiding this comment.
Do we want to add a "Verification" section in the Configuration Overview section?
Similar to here: https://developers.cloudflare.com/data-localization/how-to/zero-trust/#verify-regional-map-application
| Use Gateway logging controls to [exclude supported personally identifiable information fields](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/manage-pii/) or [select which events appear in Cloudflare One activity logs](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/#selective-logging). | ||
|
|
||
| ### Split Tunnels | ||
| ### DLP payload and AI prompt logging |
There was a problem hiding this comment.
I believe we should re-add this part:
DLP detection entries are not available outside US region when using Customer Metadata Boundary.
Or did something change?
Plus that AI Prompt profiles uses Workers AI in the background, which are not regionalized today, correct?
| This guide describes the current scope of Cloudflare One data localization controls. | ||
|
|
||
| Regional Services can be used with Gateway in all [supported regions](/data-localization/region-support/). Be aware that Regional Services only apply when using the Cloudflare One Client in Traffic and DNS mode. | ||
| ## Regional Services for Gateway |
There was a problem hiding this comment.
Can we re-add this part:
File Sandboxing (an add-on that quarantines and scans suspicious files in an isolated environment) is incompatible with DLS.
Or did something change?
| ### Geo Key Manager | ||
|
|
||
| ## Access | ||
| If the protected application hostname uses a supported custom certificate, [configure Geo Key Manager](/ssl/edge-certificates/geokey-manager/setup/) to restrict where Cloudflare stores the private TLS key for that hostname. |
There was a problem hiding this comment.
This section GKM is under "Access" only, but what about Gateway?
We need a Gateway GKM section too. Before we said:
You can bring your own certificate to Gateway but these cannot yet be restricted to a specific region.
But this is changing now, no?
| ### DLP payload and AI prompt logging | ||
|
|
||
| [Split Tunnels](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/) allow you to decide which IP addresses/ranges and/or domains are routed through or excluded from Cloudflare. | ||
| [Configure DLP payload and AI prompt logging](/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/) to encrypt matched content with a customer-provided public key. Only the customer holds the private key required to decrypt the protected content. |
There was a problem hiding this comment.
Do we want to also clarify that DLP can only be used as part of Gateway HTTP Policies?
Plus, what is the situation now with Workers integration? https://blog.cloudflare.com/programmable-gateway-dlp/
|
|
||
| {/* TODO: Reintroduce */} | ||
| {/* <Render file="gateway/disable-udp" product="cloudflare-one" /> */} | ||
| Regional Services for Gateway is available in these regions: |
There was a problem hiding this comment.
Include new managed Region Schengen Area – See DLS-676.
4 participants
Summary
Updates the Data Localization Suite documentation for Cloudflare One. Clarifies the scope of traffic processing, tunnel connections, private-key location, and supported log storage on the zero-trust page. For the compatability matrix, moves to a text-based explanation of what each feature does and how they work together, rather than relying on confusing emojis and footnotes.
Fixes #34345
Documentation checklist