Cloudinary
Cloudinary Ltd., Petah Tikva (Israel), with Cloudinary Inc. (USA), Cloudinary UK Ltd. and Cloudinary Poland Sp. z o.o. ·cloudinary.com· As of: 2026-08-28
Work through this tool with an AI
Our verdict
Optimised image and video delivery has become baseline. Without it you pay in load time, bounces and weaker search results. Buying it makes you indistinguishable from anyone else, because a competitor can rent the same URL. The difference is created one level up, in the catalogue itself and in how fast one product photo becomes a complete campaign.
Evidence:Plans, credit logic and pricesOpen sourceEnterprise-bound features: SAML 2.0 sign-in, delivery logs, custom service level commitmentOpen sourceData processing agreement, standard contractual clauses, deletion periods, audit rights, technical measuresOpen sourceStorage location, processing in third countries, deletion of content, public default for uploaded filesOpen sourceSub-processors with purpose and country, and the date of the listOpen sourceModel training on customer content, enterprise opt-out, ISO/IEC 42001, C2PA provenance dataOpen sourcePermission to use contributed content, governing law and jurisdictionOpen sourceCertificates, availability commitment and audit sealOpen sourceCompany register entry of the British subsidiaryOpen sourcePrices and included volumes of the AI-native counterpart ImageKitOpen source
Who it fits
Solo
suitable with caveats
The free tier with 25 monthly credits carries a small site in full. The jump to 99 dollars comes abruptly once storage, transformations and traffic together use up the credit budget.
Mid-market
suitable
Ninety-nine dollars on Plus and 249 dollars on Advanced stay predictable. Before signing it pays to work out how many credits your own traffic consumes, because storage and delivery draw on one shared budget.
Enterprise
suitable with caveats
Everything procurement checks sits in the Enterprise plan: sign-in via SAML 2.0, delivery logs, storage inside the European Economic Area, a custom service level commitment and the security review. The data processing agreement (Auftragsverarbeitungsvertrag) takes effect only once an order form is signed, and the opt-out from generative model training hangs on that same signature.
Buy, switch or build
Off-the-shelf
Adobe Experience Manager Assets or Akamai Image and Video Manager
Large groups stay with Adobe because the asset system is coupled to approvals, rights and campaign planning, that is to processes outside delivery. Akamai sells the optimisation as an add-on to a delivery network already under contract, saving one contract, one invoice and one security review. The odd part: Akamai and Cloudinary announced an alliance on 11.06.2025, and Akamai also appears as a sub-processor in Cloudinary's own list.
AI-native
ImageKit
ImageKit costs 9 dollars on Lite and 89 dollars on Pro, keeps traffic and storage as separate budgets and bills overage instead of cutting off at a fixed credit allowance. Pro includes 225 GB of traffic and 225 GB of storage, where at Cloudinary 225 credits have to cover both together. What you give up is the depth of the video pipeline, the breadth of integrations and the contractual path on which Cloudinary hangs both the data processing agreement and the training opt-out.
Build it yourself
Object storage, a transformation service and your own delivery network
The route is real and often taken: originals into object storage such as Supabase Storage, an open-source transformation service such as imgproxy or Thumbor in front of it, Cloudflare as the delivery network in front of that, wired with n8n and built with Claude Code. For static sites Astro already covers the variants at build time through its image pipeline. Cropping is never where it fails. It fails in four places: purging caches across every derived variant, the rights layer for material that must not be public, video transcoding with adaptive streaming, and the on-call duty for a path that sits in front of every single page. The fifth point arrives later: maintenance once the builder has left the house.
Our advice
- Solo: Free tier, or on a static site use Astro's image pipeline and sign no contract at all.
- Mid-market: Buy, Plus or Advanced, and convert your own traffic into credits before you sign.
- Enterprise: Buy, but sign the order form before the first data goes in: the data processing agreement, EEA storage and the model training opt-out all hang on it. Price in logs and SAML sign-in from the start.
Who is behind it
Staying power: Established
Cloudinary Ltd. has been on the market since 2012, and the British subsidiary Cloudinary UK Ltd. has been registered under number 11334866 since 28.04.2018. The company grew without venture capital and publicly names dated revenue milestones. The one large capital story, Blackstone Growth in February 2022, was a secondary transaction: shares changed hands and no money went into the company. Product releases run through to August 2026, and the incident history is public and dated.
- Legal form and company register entry of the British subsidiary: CLOUDINARY UK LTD, Companies House number 11334866, incorporated on 28.04.2018, registered office at 30 Old Bailey, London EC4M 7AU. The parent is Cloudinary Ltd. in Israel; the sub-processor list additionally names Cloudinary Inc. (USA) and Cloudinary Poland Sp. z o.o. No German entity is named anywhere, and the site carries no Impressum (German-law legal notice).Company register entry of the British subsidiaryOpen source · As of 2026-08-28
- 2022 capital story was a secondary transaction: On 15 and 16 February 2022 the press reported a Blackstone Growth stake of more than 100 million US dollars at a 2 billion US dollar valuation. The reports consistently describe it as a secondary investment: shares changed hands and no fresh capital reached the company. Some of the headlines drop that distinction.cloudinary.com/newsroomOpen source · As of 2022-02-16
- Revenue milestones without venture capital, per the company: The vendor's press collection lists passing 60 million US dollars in annual recurring revenue without venture capital on 15.01.2020 and the 100 million mark on 10.01.2022. On 15.06.2026 an item appears titled around 150 million US dollars, adding that this was reached without investors. All three figures come from the vendor or from interviews with it; no audited accounts are public.cloudinary.com/newsroomOpen source · As of 2026-06-15
- Continuing product releases: Dated announcements in 2026: 23.02. developer community, 24.03. AI-based moderation, 29.04. video automation, 05.05. AI agents for media management, 23.06. image to video, 05.08. agent-native development. Development is visibly continuing four years after the capital story.cloudinary.com/newsroomOpen source · As of 2026-08-05
- Alliance with the delivery network Akamai: On 11.06.2025 Akamai and Cloudinary announced a strategic alliance. Akamai also appears in the sub-processor list as a delivery provider and sells a competing product of its own with Image and Video Manager.cloudinary.com/newsroomOpen source · As of 2025-06-11
- Analyst positioning: On 06.11.2025 the vendor reported being placed as a Visionary in the 2025 Gartner Magic Quadrant for Digital Asset Management Platforms, after the same placement the year before (announcement of 08.01.2025). The placement concerns asset management, not delivery.cloudinary.com/newsroomOpen source · As of 2025-11-06
- User numbers per the vendor: On 22.07.2026 the vendor states four million developers, up 82 per cent within a year, and 13,000 brands on its company page. No method of counting is stated, and an account is not a paying customer.cloudinary.com/aboutOpen source · As of 2026-07-22
- Public incident history: The status page lists fifty dated incidents between 19.03.2025 and 13.08.2026. Five of those fall in 2026 with a major rating, most recently elevated error rates on 12.07.2026 for requests using automatic image framing. The vendor commits to 99.9 per cent availability.status.cloudinary.com/historyOpen source · As of 2026-08-13
Cost of leaving: Moderate
Original files can be fetched through the admin API, and from the Plus plan on Cloudinary also backs up into an S3 bucket the customer owns. What is missing after the export are the URLs: the transformation sits in the path, so pages, feeds, newsletters and third-party caches all hang on a URL pattern the next vendor does not understand. Add named transformations, upload presets, structured metadata and the automatically assigned tags.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, tied to a conditionpublic as a PDF, effective only once an order form is signedData processing agreement, standard contractual clauses, deletion periods, audit rights, technical measuresOpen sourceThe data processing agreement dated June 2026 is freely available as a PDF and is properly built: standard contractual clauses 2021/914 in modules two and three, the UK addendum, breach notification within 72 hours, the Irish supervisory authority as the competent body. The opening sentence draws the line: it takes effect on execution of an order form. Anyone booking the product on the website with a credit card has no order form and therefore no data processing agreement.As of 2026-08-28 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, tied to a conditionAWS, United States or European Union depending on location; EEA binding only for enterprise customersStorage location, processing in third countries, deletion of content, public default for uploaded filesOpen sourceThe privacy policy names AWS servers in the United States or the European Union depending on the customer's location and grants the restriction to the European Economic Area explicitly to enterprise customers only. Processing and access also take place in the European Union, the United States, the United Kingdom, Singapore and Israel. The sub-processor list confirms this for AWS, adding that EU and APAC environments are available to enterprise customers as needed.As of 2026-08-28 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, tied to a conditionpublic list with purpose, country of headquarters and country of storage, dated 03.02.2025Sub-processors with purpose and country, and the date of the listOpen sourceThe list names 24 entries with purpose, country of headquarters and country of storage, among them AWS and Google Cloud for hosting, four delivery networks and OpenAI under support and operations. Two things keep it below full evidential weight: the vendor itself describes it as a list of its main sub-processors, and it carries a last-updated date of 03.02.2025 while moderation, AI agents and image-to-video have been added since. The column on certification under the EU-US Data Privacy Framework is empty in almost every row.As of 2026-08-28 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, tied to a conditionstandard contractual clauses 2021/914 and the EU-US Data Privacy Framework, with no mapping per recipientData processing agreement, standard contractual clauses, deletion periods, audit rights, technical measuresOpen sourceThe legal bases are named and anchored in the contract: standard contractual clauses under implementing decision 2021/914, the UK addendum, and Cloudinary Inc.'s self-certification under the EU-US Data Privacy Framework including the UK and Swiss extensions. What stays open is the mapping. The sub-processor list has its own column for Data Privacy Framework certification and leaves it empty almost everywhere, so it cannot be read off per recipient which basis applies.As of 2026-08-28 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, but unfavourableexclusion for generative models only for enterprise customers with an order formModel training on customer content, enterprise opt-out, ISO/IEC 42001, C2PA provenance dataOpen sourceTwo statements part ways here, and the dividing line is the order form. Asked whether customer data and assets feed the training of generative models, the vendor answers: for enterprise customers who have signed an order form, no, they are deemed opted out by default. For everyone else the general answer is that it may use users' data and content to provide, maintain, develop and improve the services, in aggregated and non-identifiable form; only data carrying personal information is expressly excluded. Product photography, brand material and video footage carry no personal information. This matches the term of use granting the vendor permission to use contributed content for providing, developing and supporting the services. Both commitments sit on a marketing page of frequently asked questions rather than in the contract.As of 2026-08-28 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, tied to a conditiondeletion of personal data within 30 days after the contract ends, backups exceptedData processing agreement, standard contractual clauses, deletion periods, audit rights, technical measuresOpen sourceSection 10 of the data processing agreement puts the deadline at 30 days after termination or expiry and in the same breath excepts copies held in routine backup and archiving. For the content itself the privacy policy adds that it will be deleted after termination or deactivation, without a deadline and with the note that the vendor is not responsible for any backup; delivery logs are kept with no stated period so that an account can be resumed.As of 2026-08-28 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, tied to a conditionSOC 2 Type II (Deloitte), ISO 27001 (IQC seal dated 2025), ISO/IEC 42001, ISO 14001; reports on request onlyCertificates, availability commitment and audit sealOpen sourceFour proofs are named, and the trust page carries an audit seal for ISO 27001 with the year 2025. Two limitations remain. Under section 9.2 of the data processing agreement the vendor hands out reports and certificates only on written request, at most once a year; certificate number, certifying body and scope are published nowhere. And annex two of the same agreement, dated June 2026, names the edition ISO/IEC 27001:2013, whose transition period to the 2022 edition ended on 31.10.2025, while wording it in one paragraph as certified to and as based upon.As of 2026-08-28 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, no condition attachedcertification to ISO/IEC 42001 stated, C2PA provenance data switched on by default for all generative transformationsModel training on customer content, enterprise opt-out, ISO/IEC 42001, C2PA provenance dataOpen sourceThe vendor states that it is certified to ISO/IEC 42001 for artificial intelligence management systems and, by its own account, attaches provenance data under the C2PA standard to all generative transformations without the operator having to do anything. That is precisely what carries the marking duty for artificially generated content under Article 50 of the AI Act. The regulation itself is named on none of the pages checked, and the certification lacks a number and a certifying body. The reference in the terms of use to an AI Trust page leads to this marketing page of frequently asked questions.As of 2026-08-28 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, but unfavourabledelivery logs only in the Enterprise plan, with scope and retention unpublishedEnterprise-bound features: SAML 2.0 sign-in, delivery logs, custom service level commitmentOpen sourceThe plan comparison lists delivery logs together with provisioning APIs, sign-in via SAML 2.0 and a custom service level commitment in the block that applies to Enterprise only. Which events are captured, how long they are held and how they are exported into your own systems is not published. Anyone who has to plan for evidence obligations cannot do so from the published material.As of 2026-08-28 |
What it really costs
Entry price
Free with 25 monthly credits, 3 users and 1 account. Plus costs 99 dollars a month, or 89 billed yearly, and includes 225 credits. Advanced costs 249 dollars, or 224 billed yearly, and includes 600 credits. One credit equals 1,000 transformations or 1 GB of storage or 1 GB of delivered image traffic.Plans, credit logic and pricesOpen source
As of 2026-08-28
What gets expensive
The credit allowance is one shared budget. Storage, transformations and delivered traffic all draw on it at the same time, so a traffic spike eats into the storage allowance as well. Video traffic counts two to one on paid plans only. Sign-in via SAML 2.0, delivery logs, storage inside the European Economic Area and a custom service level commitment sit in the Enterprise plan alone, and searching across more than ten million assets may cost extra according to the vendor.
What it displaces
- Image resizing inside your own application server
- Hand-produced variants in the file system
- A separate pipeline for video transcoding
Interfaces
- Transformation through the URL, for uploaded and for remotely fetched files
- Upload and admin API following REST
- Libraries for common languages and frameworks
- Webhooks for upload and processing events
- Backup into an S3 bucket you own from the Plus plan on
Matching methods
- 70/20/10 Creative ReskinningThe method multiplies what demonstrably works, and delivery is exactly what that hangs on: as long as every variation is a fresh export, the number of tests depends on design capacity rather than on demand.
- Value Metric PricingThe credit, covering either 1,000 transformations, 1 GB of storage or 1 GB of delivery, is a textbook value metric and a textbook case of how one shared unit makes the customer's bill unpredictable.
- Regulatory Density TestThis is what the test is for: the data processing agreement, EEA storage, logs and the model training opt-out all hang on the same signature, and anyone who notices that only at procurement has long since put the data in.
Alternatives
Sources
- 1.Plans, credit logic and prices (opens in a new tab)cloudinary.com/pricing · As of 2026-08-28
- 2.Enterprise-bound features: SAML 2.0 sign-in, delivery logs, custom service level commitment (opens in a new tab)cloudinary.com/pricing/compare-plans · As of 2026-08-28
- 3.Data processing agreement, standard contractual clauses, deletion periods, audit rights, technical measures (opens in a new tab)cloudinary-marketing-res.cloudinary.com/… · As of 2026-08-28
- 4.Storage location, processing in third countries, deletion of content, public default for uploaded files (opens in a new tab)cloudinary.com/privacy · As of 2026-08-28
- 5.Sub-processors with purpose and country, and the date of the list (opens in a new tab)cloudinary.com/trust/subprocessors · As of 2026-08-28
- 6.Model training on customer content, enterprise opt-out, ISO/IEC 42001, C2PA provenance data (opens in a new tab)cloudinary.com/products/cloudinary_ai/faq · As of 2026-08-28
- 7.Permission to use contributed content, governing law and jurisdiction (opens in a new tab)cloudinary.com/tou · As of 2026-08-28
- 8.Certificates, availability commitment and audit seal (opens in a new tab)cloudinary.com/trust · As of 2026-08-28
- 9.Company register entry of the British subsidiary (opens in a new tab)find-and-update.company-information.service.gov.uk/…/11334866 · As of 2026-08-28
- 10.Prices and included volumes of the AI-native counterpart ImageKit (opens in a new tab)imagekit.io/plans · As of 2026-08-28
- 11.cloudinary.com/newsroom (opens in a new tab)As of 2026-08-05
- 12.cloudinary.com/about (opens in a new tab)As of 2026-07-22
- 13.status.cloudinary.com/history (opens in a new tab)As of 2026-08-13
Last reviewed: 2026-08-28 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.