Data Localization Suite
The Data Localization Suite (DLS) is a set of products that helps customers who want to maintain local control over their traffic while retaining the security benefits of a global network.
DLS is currently available for customers on the Enterprise plan. Reach out to your Customer Success Manager for more information about purchasing DLS.
The Data Localization Suite consists of the following products:
Support by product and region is summarized in the following table:
| Region | Geo Key Manager | Regional Services | Customer Metadata Boundary |
|---|---|---|---|
| US | ✅ | ✅ | ✅ |
| EU | ✅ | ✅ | ✅ |
| UK | ✅ | ✅ | Can use EU metadata boundary. |
| Canada | ✅ | ✅ | ✘ |
| Australia | ✅ | ✅ | ✘ |
| Japan | ✅ | ✅ | ✘ |
| India | ✅ | ✅ | ✘ |
Overview by product-behavior is summarized in the following table. Below you can find the table legend to help you read the table:
✅ Product works with no caveats
🚧 Product can be used with some caveats
✘ Product cannot be used
⚫️ Not applicable
| Suite/Category | Product | Geo Key Manager | Regional Services | Customer Metadata Boundary |
|---|---|---|---|---|
| Application Performance | Caching/CDN | ✅ | ✅ | ✅ |
| DNS | ⚫️ | ⚫️ | 🚧1 | |
| Image Resizing | ✅ | ✅ | 🚧1 | |
| Load Balancing | ✅ | ✅ | 🚧1 | |
| Stream Delivery | ✅ | ✅ | ✅ | |
| Tiered Caching | ✅ | 🚧2 | 🚧2 | |
| Waiting Room | ⚫️ | ✅ | 🚧1 | |
| Zaraz | ✅ | ✅ | 🚧1 | |
| Application Security | Advanced Certificate Manager | ⚫️ | ⚫️ | ⚫️ |
| Advanced DDoS Protection | ✅ | ✅ | 🚧3 | |
| API Shield | ✅ | ✅ | ✘4 | |
| Bot Management | ✅ | ✅ | 🚧5 | |
| DNS Firewall | ⚫️ | ⚫️ | 🚧1 | |
| Page Shield | ✅ | ✅ | ✘6 | |
| Rate Limiting | ✅ | ✅ | 🚧1 | |
| SSL | ✅ | ✅ | ✅ | |
| Cloudflare for SaaS | ✅ | ✅ | ✅ | |
| WAF/L7 Firewall | ✅ | ✅ | ✅ | |
| Developer Platform | Cloudflare Images | ⚫️ | ✘ | ✘ |
| Cloudflare Pages | ✘ | ✘ | ✘ | |
| Durable Objects | ⚫️ | ✅7 | 🚧1 | |
| R2 | ⚫️ | 🚧8 | 🚧1 | |
| Stream | ⚫️ | ✘ | ✘ | |
| Workers (deployed on a Zone) | ✅ | ✅ | 🚧1 | |
| Workers KV | ⚫️ | ✘ | ✘ | |
| Workers.dev | ✘ | ✘ | ✘ | |
| Network Services | Argo Smart Routing | ✅ | ✘9 | ✘10 |
| BYOIP | ⚫️ | ✘11 | ⚫️ | |
| Magic Firewall | ⚫️ | ⚫️ | 🚧1 | |
| Magic Transit | ⚫️ | ⚫️ | 🚧1 | |
| Magic WAN | ⚫️ | ⚫️ | 🚧1 | |
| Spectrum | ✅ | ✅ | 🚧1 | |
| Platform | Logpull | ⚫️ | ✅ | 🚧12 |
| Logpush | ⚫️ | ✅ | 🚧13 | |
| Zero Trust | Access | 🚧14 | 🚧15 | 🚧16 |
| Browser Isolation | ⚫️ | 🚧17 | ✅ | |
| CASB | ⚫️ | ⚫️ | ✘ | |
| Cloudflare Tunnel | ⚫️ | 🚧18 | ⚫️ | |
| DLP | ⚫️19 | ⚫️19 | ✘ | |
| Gateway | 🚧20 | 🚧21 | 🚧22 | |
| WARP | ⚫️ | ⚫️ | 🚧1 |
Logs / Analytics not available outside US region when using Customer Metadata Boundary. ↩︎
Regular and Custom Tiered Cache works; Smart Tiered Caching not available with Regional Services. ↩︎
Network Analytics (including DoS analytics) will not be sent outside the region. However, these are only viewable today in US region. ↩︎
API shield will not yet work with Customer Metadata Boundary enabled outside of US region. ↩︎
Some advanced Enterprise features, including the Anomaly Detection engine, are not available. ↩︎
Cannot be used with Customer Metadata Boundary outside of US region. ↩︎
You can not yet specify region location for object storage; this is expected in 2023. ↩︎
Argo cannot be used with Regional Services. ↩︎
Argo cannot be used with Customer Metadata Boundary. ↩︎
BYOIP cannot be used with Regional Services. ↩︎
Logpull not available when using Customer Metadata Boundary outside US region. Logs may be stored and retrieved with Logs Engine which is adding region support in 2023. ↩︎
Logpush available with Customer Metadata Boundary for HTTP requests and Firewall events. Please contact your Customer Success Manager if you need to push another dataset. ↩︎
Access App SSL keys can use Geo Key Manager. Access JWT is not yet localized. ↩︎
Can be localized to US FedRAMP region only. More regions coming in 2023. ↩︎
Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. ↩︎
Currently may only be used with US FedRAMP region. ↩︎
Only US FedRAMP region. ↩︎
Uses Gateway and CASB. ↩︎
You can bring your own certificate to Gateway but these cannot yet be restricted to a specific region. ↩︎
Gateway HTTP supports Regional Services. Gateway DNS does not yet support regionalization. ↩︎
Logs are currently stored in the US only, but customers have the option to exclude PII from logs. ↩︎