Cloudflare Pages
Cloudflare, Inc. ·pages.cloudflare.com· As of: 2026-07-30
Our verdict
Delivery is table stakes. It only becomes a topic when it is missing, or when rules at the edge start carrying business logic. That is also exactly when switching hurts.
Who it fits
Solo
suitable
The free tier carries a complete website. Static assets are free and unmetered, per the vendor.
Mid-market
suitable
Predictable as long as the site is mostly files. Function invocations count against a shared daily limit.
Enterprise
suitable
Contract-ready: the vendor offers a DPA, a public subprocessor list, EU data localisation and attestations up to C5 and the EU Cloud Code of Conduct.
Buy, switch or build
Off-the-shelf
Classic hosting or a managed server
Familiar, available everywhere, with a clear invoice. In return you carry availability and network distribution yourself, and worldwide delivery gets expensive fast.
AI-native
No AI-native category
Delivery is not an AI question. Anyone chasing AI promises here is optimising in the wrong place.
Build it yourself
Your own server or container
Worth it when data must not leave the building or a regulator dictates where it runs. Costs on-call duty, updates and a second person who can also do it.
Our advice
- Solo: Free tier; nothing more is needed.
- Mid-market: Take it, but document the edge rules so they are not lost when you move.
- Enterprise: Take it, with EU localisation as an add-on and documented edge rules.
Who is behind it
Staying power: Established
A listed vendor with a broad certification record. The risk is not the vendor disappearing but the tie to its edge.
Cost of leaving: Moderate
The files are portable, the edge is not. Redirect rules, access rules and functions are vendor-specific and have to be rebuilt when you move. In our case the redirect logic sits in four zone rules rather than in code; that is convenient, and it is exactly the lock-in you need to be aware of.
Regulation and data
| Data processing agreement | yes, publicly availableA standard DPA, incorporated into the self-serve and enterprise agreements.Source · As of 2026-07-30 |
|---|---|
| Storage location | EU localisation selectable as a paid add-onThe Data Localization Suite covers Regional Services, Metadata Boundary, Geo Key Manager and Keyless SSL. Without that add-on, processing happens across the global network.Source · As of 2026-07-30 |
| Subprocessors | public listSource · As of 2026-07-30 |
| Third-country transfer | EU standard contractual clauses with supplementary measures, or the EU-US Data Privacy FrameworkSource · As of 2026-07-30 |
| Training on customer data | not applicable to content deliveryFor the same vendor's AI services the question must be reviewed separately; this entry does not answer it.no source given · As of 2026-07-30 |
| Retention and deletion | unclearRetention periods for log data were not reviewed here.no source given · As of 2026-07-30 |
| Certifications | ISO 27001, ISO 27701, ISO 27018, SOC 2 Type II, PCI DSS Level 1, EU Cloud Code of Conduct, C5 2020C5 and the EU Cloud Code of Conduct are the two attestations German procurement asks about first.Source · As of 2026-07-30 |
| EU AI Act, Article 50 | not engaged for content deliveryno source given · As of 2026-07-30 |
| Audit logging | depends on the plan, not reviewedWhich logs are available in which plan remained open in this review.no source given · As of 2026-07-30 |
What it really costs
Entry price
Free tier with 100,000 daily requests for functions, counted together with Workers. Requests to static assets are free and unlimited, per the vendor.
Source · As of2026-07-30
What gets expensive
Only once you use edge functions and the add-ons. The Pages page names no prices for the paid tier and points to the Workers plans, so that is where any calculation has to happen.
What it displaces
- Your own web server for static sites
- A separate CDN line item
Interfaces
- Git integration
- Command line tool
- Rules at the zone level
At Convios: In use at Convios
convios.com is delivered through Cloudflare Pages. Four redirect rules in the zone carry the redirect logic, and their order is documented.
Matching methods
Evidence
- 1.DPA, EU localisation, subprocessors, certifications, third-country basis · As of 2026-07-30
- 2.Free allowance for function invocations and free static delivery · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.