diff --git a/src/content/docs/data-localization/compatibility.mdx b/src/content/docs/data-localization/compatibility.mdx index 0a7988efad8..a3b0139e17b 100644 --- a/src/content/docs/data-localization/compatibility.mdx +++ b/src/content/docs/data-localization/compatibility.mdx @@ -116,16 +116,13 @@ The tables below show whether each Cloudflare product is compatible with each DL ## Zero Trust -| Product | Geo Key Manager | Regional Services | Customer Metadata Boundary | -| --------------------- | --------------- | ----------------- | -------------------------- | -| Access | 🚧 [^14] | 🚧 [^15] | ✅ [^16] | -| Browser Isolation | ⚫️ | 🚧 [^17] | ✅ | -| CASB | ⚫️ | ⚫️ | ✘ | -| Cloudflare Tunnel | ⚫️ | 🚧 [^18] | ⚫️ | -| Digital Experience | ⚫️ | ⚫️ | 🚧 [^49] | -| DLP | ⚫️ [^19] | ⚫️ [^19] | 🚧 [^31] | -| Gateway | 🚧 [^20] | 🚧 [^21] | 🚧 [^22] | -| Cloudflare One Client | ⚫️ | ⚫️ | 🚧 [^1] | +Cloudflare One compatibility depends on the DLS control, traffic path, on-ramp, and dataset. The following table summarizes current support. Refer to [Data localization for Cloudflare One](/data-localization/how-to/zero-trust/) for supported regions, configuration, and product-specific behavior. + +| DLS control | Current Cloudflare One coverage | +| - | - | +| **Geo Key Manager** | For an Access-protected application that uses a supported custom certificate, Geo Key Manager can restrict where Cloudflare stores the private TLS key for the protected application hostname. Refer to [Geo Key Manager](/data-localization/how-to/zero-trust/#geo-key-manager). | +| **Regional Services** | Gateway decrypts and inspects supported HTTPS traffic within the selected region when traffic is sent through the Cloudflare One Client in Traffic and DNS mode, Cloudflare Mesh, or Cloudflare WAN using IPsec. Access supports the FedRAMP Moderate Compliant (Domestic) region. Browser Isolation supports the US FedRAMP region. Separately, [Cloudflare Tunnel](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#region) uses its own region setting for Global or United States connections. Refer to [Regional Services for Gateway](/data-localization/how-to/zero-trust/#regional-services-for-gateway), [Access](/data-localization/how-to/zero-trust/#access), and [Browser Isolation](/data-localization/how-to/zero-trust/#browser-isolation). | +| **Customer Metadata Boundary** | CMB stores supported Customer Logs in the United States or European Union. Refer to [Customer Metadata Boundary for Cloudflare One](/data-localization/how-to/zero-trust/#customer-metadata-boundary). | [^1]: Logs / Analytics not available outside US region when using Customer Metadata Boundary. @@ -151,24 +148,6 @@ The tables below show whether each Cloudflare product is compatible with each DL [^13]: Logpush available with Customer Metadata Boundary for [these datasets](/data-localization/metadata-boundary/logpush-datasets/). Contact your account team if you need another dataset. -[^14]: Access App SSL keys can use Geo Key Manager. [Access JWT](/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/) is not yet localized. - -[^15]: Can be localized to US FedRAMP Moderate Domestic region only. - -[^16]: Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. EU customers must use Logpush to retain logs. - -[^17]: Currently may only be used with US FedRAMP region. - -[^18]: The [`--region` parameter](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#region) in `cloudflared` controls where the tunnel connector establishes its connection to Cloudflare. This setting is separate from Regional Services. For public hostnames served through a tunnel, Regional Services is configured at the DNS record level and operates independently from the tunnel connector region. For incoming web requests, Regional Services only applies when you have [published applications](/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/) (services exposed to users through the tunnel). In that case, the region associated with the DNS record will apply. - -[^19]: Uses Gateway HTTP and CASB. - -[^20]: You can [bring your own certificate](https://blog.cloudflare.com/bring-your-certificates-cloudflare-gateway/) to Gateway but these cannot yet be restricted to a specific region. - -[^21]: Gateway HTTP (web traffic filtering) supports Regional Services. Gateway DNS (domain name filtering) does not yet support regionalization.
ICMP proxy (forwarding network diagnostic traffic like ping) and Mesh proxy are not available to Regional Services users. [File Sandboxing](/cloudflare-one/traffic-controls/http-policies/file-sandboxing/) (an add-on that quarantines and scans suspicious files in an isolated environment) is incompatible with DLS. - -[^22]: Dashboard Analytics and Logs are empty when using CMB outside the US region. Use Logpush instead. - [^23]: Currently, customers do not have the ability to choose the location of the Cloudflare-managed R2 bucket for Log Explorer. [^26]: You can use Static IP/BYOIP with Regionalized Spectrum Applications. You can also regionalize BYOIP prefixes at the IP layer with [Regionalized IP Bindings](/data-localization/regional-services/ip-bindings/). @@ -181,8 +160,6 @@ The tables below show whether each Cloudflare product is compatible with each DL [^30]: Regular/Generic and Custom Tiered Cache work with Customer Metadata Boundary (CMB). Smart Tiered Caching (where Cloudflare automatically selects intermediate cache data centers) does not work with CMB.
With CMB set to EU, the Zone Dashboard **Caching** > **Tiered Cache** > **Smart Tiered Caching** option will not populate the Dashboard Analytics. -[^31]: DLP is part of Gateway HTTP, however, [DLP detection entries](/cloudflare-one/data-loss-prevention/detection-entries/configure-detection-entries/) are not available outside US region when using Customer Metadata Boundary. - [^33]: If you use [outgoing zone transfers](/dns/zone-setups/zone-transfers/cloudflare-as-primary/) (where Cloudflare sends your DNS records to non-Cloudflare nameservers), those transfers will include global Cloudflare IP addresses rather than region-specific ones. This means Regional Services will not function correctly when end users receive DNS answers from non-Cloudflare nameservers. [^34]: Jurisdictional Restrictions (storage) for Workers KV pairs is not supported today. @@ -215,6 +192,4 @@ The tables below show whether each Cloudflare product is compatible with each DL [^48]: The following are exceptions and are supported: AI Gateway Analytics (GraphQL Analytics datasets) and Logs (Logpush), R2 Dashboard Metrics & Analytics, Workers AI GraphQL Analytics datasets like aiInferenceAdaptive. -[^49]: Dashboard Analytics are empty when using CMB outside the US region. Use [Logpush](/logs/logpush/) instead. - [^50]: Email and webhook notifications for DDoS and WAF events may not fire reliably when Customer Metadata Boundary is set to `eu`. This behavior is intermittent and under investigation. If timely alerts are critical, use [Logpush](/logs/logpush/) as a complementary monitoring mechanism. diff --git a/src/content/docs/data-localization/how-to/zero-trust.mdx b/src/content/docs/data-localization/how-to/zero-trust.mdx index 5ff2cec26ab..89759428104 100644 --- a/src/content/docs/data-localization/how-to/zero-trust.mdx +++ b/src/content/docs/data-localization/how-to/zero-trust.mdx @@ -1,7 +1,7 @@ --- title: Zero Trust pcx_content_type: how-to -description: Use Zero Trust products with the Data Localization Suite, including Gateway and CASB. +description: Configure data localization controls for Cloudflare One traffic, private keys, and supported logs. products: - data-localization - cloudflare-one @@ -12,78 +12,98 @@ sidebar: order: 1 --- -import { Render } from "~/components"; +Cloudflare One provides separate controls for where Cloudflare processes supported traffic and where Cloudflare stores supported logs. These controls have different settings and supported regions. -The following sections describe how to configure Zero Trust products with the Data Localization Suite, including which features support Regional Services and Customer Metadata Boundary. +| Control | What it controls | Current availability | +| - | - | - | +| [Regional Services for Gateway](#regional-services-for-gateway) | Where Gateway decrypts and inspects supported HTTPS traffic | Available for supported on-ramps and Cloudflare One regions | +| [Cloudflare Tunnel region](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#region) | Where `cloudflared` establishes its tunnel connections | Global or United States | +| [Customer Metadata Boundary (CMB)](#customer-metadata-boundary) | Where Cloudflare stores supported Customer Logs | European Union and United States | +| [Access with Regional Services](#access) | Where Cloudflare processes reverse proxy requests for Access-protected applications | FedRAMP Moderate Compliant (Domestic) only | +| [Browser Isolation for FedRAMP accounts](#browser-isolation) | Where Cloudflare processes supported Browser Isolation traffic | US FedRAMP region only | +| [Email Security regional processing](/cloudflare-one/email-security/reference/regional-processing/) | Where Email Security examines messages for supported deployment types | Refer to the Email Security documentation | -## Gateway +This guide describes the current scope of Cloudflare One data localization controls. -Regional Services can be used with Gateway in all [supported regions](/data-localization/region-support/). Be aware that Regional Services only apply when using the Cloudflare One Client in Traffic and DNS mode. +## Regional Services for Gateway -### Egress policies +Regional Services controls where Cloudflare Gateway performs HTTP and Transport Layer Security (TLS) inspection. Gateway decrypts and inspects supported HTTPS traffic only within the selected region. -Enterprise customers can purchase a [dedicated egress IP](/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/) (IPv4 and IPv6) or range of IPs geolocated to one or more Cloudflare network locations. -This allows your egress traffic to geolocate to the city selected in your [egress policies](/cloudflare-one/traffic-controls/egress-policies/). +Regional Services for Gateway is configured at the Cloudflare One account level. The selected region applies to supported Gateway traffic for the account. Contact your account team to configure the region. -Zero Trust [dedicated egress IPs](/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/) control the IPs used by WARP and Gateway traffic when it leaves Cloudflare toward the Internet. They are different from [Dedicated CDN Egress IPs](/smart-shield/configuration/dedicated-egress-ips/), which control the IPs used by the Cloudflare CDN when connecting to your origin server. For guaranteed egress IP geolocation from the Cloudflare CDN to your origin, refer to the [Cache](/data-localization/how-to/cache/#egress-to-origin) guide. +Cloudflare One supports this behavior for traffic sent to Gateway through these on-ramps: -### HTTP policies +- [Cloudflare One Client](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) in [Traffic and DNS mode](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/#traffic-and-dns-mode-default) +- [Cloudflare Mesh](/cloudflare-one/networks/connectors/cloudflare-mesh/) +- [Cloudflare WAN](/cloudflare-one/networks/connectors/cloudflare-wan/) using IPsec -As part of Regional Services, Cloudflare Gateway will only perform [TLS decryption](/cloudflare-one/traffic-controls/http-policies/tls-decryption/) when using the [Cloudflare One Client](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/) (in default [Traffic and DNS mode](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/modes/)). +Connections from these on-ramps may terminate at a Cloudflare data center outside the selected region. For supported HTTPS traffic, Gateway forwards the still-encrypted HTTPS request to the selected region before TLS decryption and inspection. -{/* TODO: Reintroduce */} -{/* */} +Regional Services for Gateway is available in these regions: -#### Data Loss Prevention (DLP) +- European Union +- Exclusive of Hong Kong and Macau +- Exclusive of Russia and Belarus +- FedRAMP Moderate Compliant (Domestic) +- FedRAMP Moderate Compliant (International) +- IRAP Protected +- NATO +- United States of America -You are able to [log the payload of matched DLP rules](/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#log-the-payload-of-matched-rules) and encrypt them with your public key so that only you can examine them later. +Refer to [Region support](/data-localization/region-support/) for region definitions. Contact your account team to inquire about the availability of other regions. -[Cloudflare cannot decrypt encrypted payloads](/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/#data-privacy). +### Egress traffic -### DNS policies +Regional Services controls where Gateway decrypts and inspects supported HTTPS traffic. Dedicated egress IPs provide predictable, account-specific source IP addresses. Customers can use them for origin allowlisting or to associate Gateway traffic with a selected IP geolocation. -Regional Services controls where Cloudflare decrypts traffic. Because most DNS traffic is not encrypted, Gateway DNS (domain name filtering) cannot be regionalized using Regional Services. +Use [dedicated egress IPs](/cloudflare-one/traffic-controls/egress-policies/dedicated-egress-ips/) and [Gateway egress policies](/cloudflare-one/traffic-controls/egress-policies/) to select these source IP addresses for Gateway traffic. -Refer to the [Cloudflare One Client settings](/data-localization/how-to/zero-trust/#cloudflare-one-client-settings) section below for more information. +## Access -### Custom certificates +Cloudflare Access uses two HTTPS connections: -You can [bring your own certificate](/cloudflare-one/team-and-resources/devices/user-side-certificates/custom-certificate/) to Gateway but these cannot yet be restricted to a specific region. +1. The user connects to the [Access team domain](/cloudflare-one/faq/getting-started-faq/#what-is-a-team-domainteam-name), such as `.cloudflareaccess.com`, to authenticate. +2. The user connects to the protected application hostname, such as `app.example.com`, to access the application. -### Logs and Analytics +### Regional Services -By default, Cloudflare will store and deliver logs from data centers across our global network. To maintain regional control over your data, you can use [Customer Metadata Boundary](/data-localization/metadata-boundary/) and restrict data storage to a specific geographic region. For more information refer to the section about [Logpush datasets supported](/data-localization/metadata-boundary/logpush-datasets/). +Regional Services controls where Cloudflare decrypts and processes supported HTTPS requests. Access supports Regional Services in the FedRAMP Moderate Compliant (Domestic) region. -Customers also have the option to reduce the logs that Cloudflare stores: +Both Access connections require configuration: -- You can [exclude PII from logs](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/manage-pii/) -- You can [disable logging, or only log blocked requests](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/#selective-logging). +1. Contact your account team to configure the Access team domain. +2. Assign the FedRAMP Moderate Compliant (Domestic) region to the protected application hostname using [Regional Services](/data-localization/regional-services/regional-hostnames/). -#### Verify regional map application +When both are configured, Regional Services restricts supported reverse proxy request processing to FedRAMP-compliant data centers. For supported Access log storage, refer to [Customer Metadata Boundary](/data-localization/metadata-boundary/). - +### Geo Key Manager -## Access +If the protected application hostname uses a supported custom certificate, [configure Geo Key Manager](/ssl/edge-certificates/geokey-manager/setup/) to restrict where Cloudflare stores the private TLS key for that hostname. + +## Browser Isolation + +Browser Isolation supports Regional Services in the US FedRAMP region. Contact your account team to set up a FedRAMP account. + +## Customer Metadata Boundary -To ensure that all reverse proxy requests for applications protected by Cloudflare Access will only occur in FedRAMP-compliant data centers, you should use [Regional Services](/data-localization/regional-services/regional-hostnames/) with the region set to FedRAMP. +[Customer Metadata Boundary](/data-localization/metadata-boundary/) is an account-level setting that stores supported Customer Logs in the European Union or United States. It is configured independently from Regional Services. -## Cloudflare Tunnel +Support varies by dataset. Refer to the current lists of [CMB-supported Logpush datasets](/data-localization/metadata-boundary/logpush-datasets/) and [CMB-supported GraphQL datasets](/data-localization/metadata-boundary/graphql-datasets/). -The [`--region` parameter](/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/run-parameters/#region) in `cloudflared` controls where the tunnel connector establishes its connection to Cloudflare. This setting is separate from Regional Services, which controls where user traffic is decrypted and processed. +Some Cloudflare One dashboards and APIs cannot retrieve data stored with EU CMB. For supported datasets, use [Logpush](/logs/logpush/) to send a copy of the logs to a destination you control. -For public hostnames served through a tunnel, Regional Services is configured at the DNS record level. The tunnel connector region and the Regional Services region operate independently. +## Additional log controls -## Cloudflare One Client settings +Some Cloudflare One products provide additional product-specific controls for reducing or protecting logged data. -### Local Domain Fallback +### Gateway logs -You can use the WARP setting [Local Domain Fallback](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/local-domains/) in order to use a private DNS resolver, which you can manage yourself. +Use Gateway logging controls to [exclude supported personally identifiable information fields](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/manage-pii/) or [select which events appear in Cloudflare One activity logs](/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/#selective-logging). -### Split Tunnels +### DLP payload and AI prompt logging -[Split Tunnels](/cloudflare-one/team-and-resources/devices/cloudflare-one-client/configure/route-traffic/split-tunnels/) allow you to decide which IP addresses/ranges and/or domains are routed through or excluded from Cloudflare. +[Configure DLP payload and AI prompt logging](/cloudflare-one/data-loss-prevention/dlp-policies/logging-options/) to encrypt matched content with a customer-provided public key. Only the customer holds the private key required to decrypt the protected content. -:::caution +### SSH command logs -Gateway policies will not apply for excluded traffic. -::: +[SSH command logs](/cloudflare-one/insights/logs/dashboard-logs/ssh-command-logs/) can encrypt downloadable logs with a customer-provided public key for local decryption. This encryption only applies to downloadable SSH logs, not to logs exported through Logpush.