# Cloudflare Pages

> Delivers a website's files worldwide and runs small functions at the network edge, without operating your own server.

- Vendor: Cloudflare, Inc.
- Canonical URL: https://www.convios.com/en/toolbox/cloudflare-pages
- Language version: https://www.convios.com/de/werkzeugkasten/cloudflare-pages
- Area: Product & engineering · Cluster: hosting and edge
- Role: Building block · Origin: Established
- As of: 2026-07-30 · Reviewed: 2026-07-30 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: Delivery keeps nobody ahead, and missing it puts you behind. It only becomes a topic when it is absent, or when rules at the edge start carrying business logic. That is also exactly when switching hurts.

## Suitability by company size

- Solo: suitable — The free tier is enough for a complete website. Static assets are free and unmetered, per the vendor.
- Mid-market: suitable — Predictable as long as the site is mostly files. Function invocations count against a shared daily limit.
- Enterprise: suitable — Contract-ready: the vendor offers a DPA, a public subprocessor list, EU data localisation and attestations up to C5 and the EU Cloud Code of Conduct.

## Vendor staying power

Established: A listed vendor with a broad certification record. The risk is not the vendor disappearing but the tie to its edge.

- Ownership: publicly listed (NYSE: NET) (source: https://cloudflare.net/, as of 2026-07-30)
- Certifications: ISO 27001, ISO 27701, ISO 27018, SOC 2 Type II, PCI DSS Level 1, EU Cloud Code of Conduct, C5 2020 (source: https://www.cloudflare.com/trust-hub/gdpr/, as of 2026-07-30)
- Transparency: subprocessor list maintained publicly (source: https://www.cloudflare.com/gdpr/subprocessors/, as of 2026-07-30)

## Cost of leaving

Moderate: The files are portable, the edge is not. Redirect rules, access rules and functions are vendor-specific and have to be rebuilt when you move. In our case the redirect logic sits in four zone rules rather than in code; that is convenient, and it is exactly the lock-in you need to be aware of.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | yes, publicly available — A standard DPA, incorporated into the self-serve and enterprise agreements. | evidenced | 2026-07-30 |
| Storage location | EU localisation selectable as a paid add-on — The Data Localization Suite covers Regional Services, Metadata Boundary, Geo Key Manager and Keyless SSL. Without that add-on, processing happens across the global network. | partially evidenced | 2026-07-30 |
| Subprocessors | public list | evidenced | 2026-07-30 |
| Third-country transfer | EU standard contractual clauses with supplementary measures, or the EU-US Data Privacy Framework | evidenced | 2026-07-30 |
| Training on customer data | not applicable to content delivery — For the same vendor's AI services the question must be reviewed separately; this entry does not answer it. | partially evidenced | 2026-07-30 |
| Retention and deletion | unclear — Retention periods for log data were not reviewed here. | partially evidenced | 2026-07-30 |
| Certifications | ISO 27001, ISO 27701, ISO 27018, SOC 2 Type II, PCI DSS Level 1, EU Cloud Code of Conduct, C5 2020 — C5 and the EU Cloud Code of Conduct are the two attestations German procurement asks about first. | evidenced | 2026-07-30 |
| EU AI Act, Article 50 | not engaged for content delivery | evidenced | 2026-07-30 |
| Audit logging | depends on the plan, not reviewed — Which logs are available in which plan remained open in this review. | partially evidenced | 2026-07-30 |

## Cost

- Entry: Free tier with 100,000 daily requests for functions, counted together with Workers. Requests to static assets are free and unlimited, per the vendor. (as of 2026-07-30)
- Where it gets expensive: Only once you use edge functions and the add-ons. The Pages page names no prices for the paid tier and points to the Workers plans, so that is where any calculation has to happen.

## Three routes compared

### Classic hosting or a managed server

Familiar, available everywhere, with a clear invoice. In return you carry availability and network distribution yourself, and worldwide delivery gets expensive fast.

### No AI-native category

Delivery is not an AI question. Anyone chasing AI promises here is optimising in the wrong place.

### Your own server or container

Worth it when data must not leave the building or a regulator dictates where it runs. Costs on-call duty, updates and a second person who can also do it.

Recommendation by size:

- Solo: Free tier; nothing more is needed.
- Mid-market: Take it, but document the edge rules so they are not lost when you move.
- Enterprise: Take it, with EU localisation as an add-on and documented edge rules.

## Context

- Implements method: [DORA Delivery Diagnostic](https://www.convios.com/en/methods/dora-delivery-diagnose) — The diagnosis measures lead time into production and time to restore after a failure, and both figures hang on the delivery step Cloudflare Pages performs for every change.
- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — The test asks whether a rule hits you specifically, and edge rules on storage location or access restriction are where a specific exposure gets implemented technically.
- Displaces: Your own web server for static sites, A separate CDN line item

## Evidence

- DPA, EU localisation, subprocessors, certifications, third-country basis — https://www.cloudflare.com/trust-hub/gdpr/ (as of 2026-07-30)
- Free allowance for function invocations and free static delivery — https://developers.cloudflare.com/pages/functions/pricing/ (as of 2026-07-30)