What we could verify

Cloudflare can appear as a supplier in another company’s disclosure and use suppliers for its own products. Read each direction separately: the role and product explain what the connection means.

The reviewed AI Gateway relationships do not describe every Cloudflare service. Combining an OpenAI delivery connection with a Cloudflare AI Gateway connection does not prove a round trip for anyone’s data.

4 reviewed outbound connections are available in this research. 40 reviewed connections point to this exact company record. This is selected coverage, not a complete recipient list.

Explore Cloudflare in the map

Who it works with

Connections from Cloudflare, with the purpose and scope attached to each source. A connection documents a relationship; it does not show that your data was transferred.

Processes data on behalf of another company

Anthropic PBC

Cloudflare → Anthropic PBC

AI Gateway service processing

Applies to: AI Gateway.

When this applies

  • Applies to AI Gateway.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third-party table — Anthropic row
Source retrieved
Claim independently reviewed

Source: Sub-Processors — For Cloudflare services · Reviewed

Processes data on behalf of another company

Amazon Web Services (AWS)

Cloudflare → Amazon Web Services (AWS)

Cloudflare Email Security processing

Applies to: Cloudflare Email Security.

When this applies

  • Applies to Cloudflare Email Security, formerly Area 1.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (location type not established); European Economic Area (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third-party table — AWS row
Source retrieved
Claim independently reviewed

Source: Sub-Processors — For Cloudflare services · Reviewed

Processes data on behalf of another company

OpenAI, Inc.

Cloudflare → OpenAI, Inc.

AI Gateway service processing

Applies to: AI Gateway.

When this applies

  • Applies to AI Gateway.

What remains unclear

  • Source refers to OpenAI's global infrastructure list; it does not specify a country or show a customer-specific path.
  • Disclosed legal name differs from OpenAI DPA current contracting entities; provider resolution requires review.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third-party table — OpenAI row
Source retrieved
Claim independently reviewed

Source: Sub-Processors — For Cloudflare services · Reviewed

Processes data on behalf of another company

Oracle America, Inc.

Cloudflare → Oracle America, Inc.

Developer Platform and Cache Reserve processing

Applies to: Developer Platform and Cache Reserve.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (location type not established); European Economic Area (location type not established); UK (location type not established); Japan (location type not established); Australia (location type not established); Canada (location type not established); Singapore (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third-party table — Oracle row
Source retrieved
Claim independently reviewed

Source: Sub-Processors — For Cloudflare services · Reviewed

Who names Cloudflare

These disclosures belong to the companies named below. They do not establish which of Cloudflare’s own suppliers are involved further on.

Processes data on behalf of another company

Attio

Attio → Cloudflare

Web infrastructure and website security.

Applies to: Attio customer CRM services.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Annex A, Cloudflare row
Source retrieved
Claim independently reviewed

Source: Attio approved subprocessors in Annex A · Reviewed

Processes data on behalf of another company

Better Stack

Better Stack → Cloudflare, Inc.

Cloud services

Applies to: Better Stack contracted observability and incident services.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
Global (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Cloudflare, Inc. row
Source retrieved
Effective date
Claim independently reviewed

Source: Schedules — Schedule A Authorized Subprocessors · Reviewed

Processes data on behalf of another company

BigID

BigID → Cloudflare

Provide a web application firewall

Applies to: BigID software and services.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
US (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Subprocessor table / Cloudflare
Source retrieved
Claim independently reviewed
· Agent review

Source: BigID Sub-processors · Reviewed

Processes data on behalf of another company

Braze

Braze → Cloudflare, Inc.

Routes encrypted API calls and optimizes content delivery.

Applies to: Braze Services.

When this applies

  • Applicability varies with customer geography and use.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
Global (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
PDF p.1, Cloudflare row
Source retrieved
Effective date
Claim independently reviewed

Source: List of Sub-processors Used in Connection with the Services · Reviewed

Processes data on behalf of another company

Check Point

Check Point → Cloudflare

Hosting and CDN

Applies to: AI Guardrails.

When this applies

  • US/EU* location is determined by customer region or selection, limited to the regions available for the applicable product.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (processing location); European Union (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Cloudflare row
Source retrieved
Claim independently reviewed

Source: Subprocessor disclosure · Reviewed

Processes data on behalf of another company

Descope

Descope → Cloudflare, Inc.

Content delivery, DDoS protection and edge computing

Applies to: Descope customer service.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

What remains unclear

  • The source uses a generic Location column; processing purpose does not independently establish hosting or processing geography.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
Global (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Cloudflare, Inc. row
Source retrieved
Claim independently reviewed

Source: Subprocessor disclosure · Reviewed

Processes data on behalf of another company

DigitalOcean

DigitalOcean → Cloudflare

Platform security

Applies to: DigitalOcean Services.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
USA (CA) (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Service Subprocessors — All DigitalOcean Services / Cloudflare
Source retrieved
Claim independently reviewed

Source: DigitalOcean Subprocessors · Reviewed

Processes data on behalf of another company

Fortinet

Fortinet → Cloudflare, Inc.

Cloud infrastructure and security

Applies to: Lacework Cloud and Code.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

What remains unclear

  • The source uses a generic Location column; processing purpose does not independently establish hosting or processing geography.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
Global (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Cloudflare, Inc. row
Source retrieved
Claim independently reviewed

Source: Subprocessor disclosure · Reviewed

Showing 8 of 40 reviewed incoming connections. Browse all 40 connections to Cloudflare.

Sources behind this explanation

Retrieval records when a source was opened. Review records when a particular claim was independently checked. Neither date guarantees that a source has stayed unchanged.