Cloudflare
Verified“US-owned edge giant, in the EU web's data path.”
- Listing
- NYSE: NET
- FY2025 revenue
- $2.17B
- Employees
- 5,156
- Founder voting power
- ~50%
20 = midpoint of Control 15 & Data 25
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 13 sourced facts across 10 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 88% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
18
Incorporated in Delaware and run from San Francisco; the main operating entity is US, and even EU-region data sits under a US-law-governed contract and the CLOUD Act. EU law reaches its EU activities via GDPR but cannot override US compulsion of the parent.
Why 18? 3 sourced facts · click to expand
Cloudflare, Inc. was incorporated in Delaware in July 2009 and is headquartered in San Francisco, California.
Cloudflare S-1 (SEC) · as of 2019-08-15
An R2 bucket in the EEUR region is physically in Europe, but the legal relationship between the data controller and Cloudflare is still governed by US law.
Cloudflare R2 data location docs · as of 2026-06-12
Cloudflare acknowledges the US CLOUD Act permits US-government access to data and that requests may conflict with EU privacy law, which it says should be legally challenged.
Cloudflare Transparency Report (H2 2025) · as of 2026-01-01
Control & Ownership
12
Founder-controlled dual-class structure (Class B = 10 votes) gives co-founders Prince and Zatlyn ~50% of voting power, and the company is NYSE-listed with US-domiciled economics. No meaningful EU voting or economic control.
Why 12? 3 sourced facts · click to expand
Cloudflare has a dual-class structure: Class B carries ten votes per share, Class A one vote per share.
JLens analysis of Cloudflare 2026 proxy · as of 2026-06-05
Co-founders Matthew Prince and Michelle Zatlyn together held approximately 50% of combined voting power as of June 5, 2026.
JLens analysis of Cloudflare 2026 proxy · as of 2026-06-05
Cloudflare trades on the New York Stock Exchange under the ticker NET.
Cloudflare Q4/FY2025 results (8-K) · as of 2026-02-10
Data →
Where your data lives and who can reach it
Data & Infrastructure
22
Cloudflare owns and operates its own global edge network (it sits in the data path of much of the EU web) and offers real EU data-residency controls, but it is US-owned infrastructure under a US operator, so EU regions are EU-located, not EU-controlled.
Why 22? 4 sourced facts · click to expand
Cloudflare's Data Localization Suite (Regional Services, Customer Metadata Boundary, Geo Key Manager) lets customers confine TLS termination, logs and keys to a chosen region such as the EU.
Cloudflare Data Localization Suite · as of 2026-06-12
R2 object storage supports an EU (EEUR) jurisdiction and D1 supports an EU jurisdiction set at creation to keep data within the EU.
Cloudflare D1 jurisdiction changelog · as of 2025-11-05
Cloudflare certifies to the EU-US Data Privacy Framework and falls back to EU standard contractual clauses for transfers to the United States.
Cloudflare Privacy Policy · as of 2026-06-12
Cloudflare's network spans 300+ cities in over 120 countries, placing it in the data path of a large share of EU-facing web traffic.
Cloudflare global network · as of 2026-06-12
Operations & People
30
Leadership, control functions and reporting currency are US-centered, but Cloudflare has a substantial and growing EU presence (Lisbon tech hub, London EMEA HQ) including engineering and the CTO. Mixed, tilted US.
Why 30? 3 sourced facts · click to expand
Cloudflare had 5,156 employees as of December 31, 2025.
Cloudflare FY2025 10-K (SEC) · as of 2025-12-31
Cloudflare operates a Lisbon technical hub (engineering, security, product, support) that has grown to 350+ employees, with John Graham-Cumming as CTO based there, and an EMEA HQ in London.
Cloudflare press release (2024) · as of 2024-01-01
Cloudflare reports financials in US dollars and is headquartered in San Francisco.
Cloudflare Q4/FY2025 results (8-K) · as of 2026-02-10
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
What share of Cloudflare's revenue and customers is EU-based versus US/rest-of-world?
Would sharpen the operations and economic-exposure read; Cloudflare reports geographic revenue only at a coarse US/international split.
- ?
How many EU customers actually enable the Data Localization Suite / R2-EU / D1-EU jurisdictions by default?
The residency controls exist but are opt-in; without adoption data we cannot tell whether EU data typically stays in the EU in practice.
- ?
Does Cloudflare own its EU edge hardware outright or operate via colocation/leased space, and under which legal entities?
Affects how exposed EU-located infrastructure is to seizure, insolvency, or US-parent control.
EU Cloud Sovereignty Framework lens
The EU Cloud Sovereignty Framework (SEAL) is designed to assess cloud service providers; this is an analogous mapping for comparison, not an official certification or audit of Cloudflare.
Strategic
US-owned, founder-controlled NYSE company; EU has no strategic or governance leverage over it.
Legal & jurisdictional
Delaware-incorporated, US-operated and CLOUD Act-exposed; EU-region data still sits under US-law contracts.
Data & AI
Real EU residency controls (Data Localization Suite, R2/D1 EU jurisdictions) but opt-in and US-operated; DPF/SCC reliance for US transfers.
Operational
Substantial EU presence (Lisbon engineering hub, London EMEA HQ, CTO in Lisbon) but control functions and reporting are US-centered.
Supply chain
Hardware vendors and colocation/transit suppliers for EU edge sites are not publicly itemized.
Technological
Core platform (network, Workers, R2, D1) is proprietary US-developed technology; no EU sovereign-stack independence.
Security & compliance
ISO 27001, SOC 2, GDPR DPA, EU Cloud Code of Conduct and DPF certification are in place and well documented.
Environmental sustainability
Cloudflare publishes ESG/impact reporting, but it was not evaluated against EU sovereignty criteria here.
EU alternatives
Luxembourg-headquartered CDN, edge and DDoS provider; EU-incorporated alternative for edge/CDN, though smaller and with global (incl. non-EU) presence.
EU buyers seeking CDN/WAF/DDoS often pair an EU CDN with EU-operated WAF; few match Cloudflare's scale, so multi-vendor EU stacks are the realistic path.
French-controlled, EU-listed provider offering CDN, anti-DDoS and EU-sovereign hosting; strong on jurisdiction though narrower edge/Workers feature set.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology