# Cloudinary

> Takes images and videos in once and delivers them through the URL in the right size and format over a delivery network, so variants no longer have to be produced and stored by hand.

- Vendor: Cloudinary Ltd., Petah Tikva (Israel), with Cloudinary Inc. (USA), Cloudinary UK Ltd. and Cloudinary Poland Sp. z o.o.
- Canonical URL: https://www.convios.com/en/toolbox/cloudinary
- Language version: https://www.convios.com/de/werkzeugkasten/cloudinary
- Area: Content & web · Cluster: image and media delivery
- Role: Building block · Origin: Established, AI retrofitted
- As of: 2026-08-28 · Reviewed: 2026-08-28 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Prevents falling behind: Optimised image and video delivery has become baseline. Without it you pay in load time, bounces and weaker search results. Buying it makes you indistinguishable from anyone else, because a competitor can rent the same URL. The difference is created one level up, in the catalogue itself and in how fast one product photo becomes a complete campaign.

## Suitability by company size

- Solo: suitable with caveats — The free tier with 25 monthly credits carries a small site in full. The jump to 99 dollars comes abruptly once storage, transformations and traffic together use up the credit budget.
- Mid-market: suitable — Ninety-nine dollars on Plus and 249 dollars on Advanced stay predictable. Before signing it pays to work out how many credits your own traffic consumes, because storage and delivery draw on one shared budget.
- Enterprise: suitable with caveats — Everything procurement checks sits in the Enterprise plan: sign-in via SAML 2.0, delivery logs, storage inside the European Economic Area, a custom service level commitment and the security review. The data processing agreement (Auftragsverarbeitungsvertrag) takes effect only once an order form is signed, and the opt-out from generative model training hangs on that same signature.

## Vendor staying power

Established: Cloudinary Ltd. has been on the market since 2012, and the British subsidiary Cloudinary UK Ltd. has been registered under number 11334866 since 28.04.2018. The company grew without venture capital and publicly names dated revenue milestones. The one large capital story, Blackstone Growth in February 2022, was a secondary transaction: shares changed hands and no money went into the company. Product releases run through to August 2026, and the incident history is public and dated.

- Legal form and company register entry of the British subsidiary: CLOUDINARY UK LTD, Companies House number 11334866, incorporated on 28.04.2018, registered office at 30 Old Bailey, London EC4M 7AU. The parent is Cloudinary Ltd. in Israel; the sub-processor list additionally names Cloudinary Inc. (USA) and Cloudinary Poland Sp. z o.o. No German entity is named anywhere, and the site carries no Impressum (German-law legal notice). (source: https://find-and-update.company-information.service.gov.uk/company/11334866, as of 2026-08-28)
- 2022 capital story was a secondary transaction: On 15 and 16 February 2022 the press reported a Blackstone Growth stake of more than 100 million US dollars at a 2 billion US dollar valuation. The reports consistently describe it as a secondary investment: shares changed hands and no fresh capital reached the company. Some of the headlines drop that distinction. (source: https://cloudinary.com/newsroom, as of 2022-02-16)
- Revenue milestones without venture capital, per the company: The vendor's press collection lists passing 60 million US dollars in annual recurring revenue without venture capital on 15.01.2020 and the 100 million mark on 10.01.2022. On 15.06.2026 an item appears titled around 150 million US dollars, adding that this was reached without investors. All three figures come from the vendor or from interviews with it; no audited accounts are public. (source: https://cloudinary.com/newsroom, as of 2026-06-15)
- Continuing product releases: Dated announcements in 2026: 23.02. developer community, 24.03. AI-based moderation, 29.04. video automation, 05.05. AI agents for media management, 23.06. image to video, 05.08. agent-native development. Development is visibly continuing four years after the capital story. (source: https://cloudinary.com/newsroom, as of 2026-08-05)
- Alliance with the delivery network Akamai: On 11.06.2025 Akamai and Cloudinary announced a strategic alliance. Akamai also appears in the sub-processor list as a delivery provider and sells a competing product of its own with Image and Video Manager. (source: https://cloudinary.com/newsroom, as of 2025-06-11)
- Analyst positioning: On 06.11.2025 the vendor reported being placed as a Visionary in the 2025 Gartner Magic Quadrant for Digital Asset Management Platforms, after the same placement the year before (announcement of 08.01.2025). The placement concerns asset management, not delivery. (source: https://cloudinary.com/newsroom, as of 2025-11-06)
- User numbers per the vendor: On 22.07.2026 the vendor states four million developers, up 82 per cent within a year, and 13,000 brands on its company page. No method of counting is stated, and an account is not a paying customer. (source: https://cloudinary.com/about, as of 2026-07-22)
- Public incident history: The status page lists fifty dated incidents between 19.03.2025 and 13.08.2026. Five of those fall in 2026 with a major rating, most recently elevated error rates on 12.07.2026 for requests using automatic image framing. The vendor commits to 99.9 per cent availability. (source: https://status.cloudinary.com/history, as of 2026-08-13)

## Cost of leaving

Moderate: Original files can be fetched through the admin API, and from the Plus plan on Cloudinary also backs up into an S3 bucket the customer owns. What is missing after the export are the URLs: the transformation sits in the path, so pages, feeds, newsletters and third-party caches all hang on a URL pattern the next vendor does not understand. Add named transformations, upload presets, structured metadata and the automatically assigned tags.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | public as a PDF, effective only once an order form is signed — The data processing agreement dated June 2026 is freely available as a PDF and is properly built: standard contractual clauses 2021/914 in modules two and three, the UK addendum, breach notification within 72 hours, the Irish supervisory authority as the competent body. The opening sentence draws the line: it takes effect on execution of an order form. Anyone booking the product on the website with a credit card has no order form and therefore no data processing agreement. | partially evidenced | 2026-08-28 |
| Storage location | AWS, United States or European Union depending on location; EEA binding only for enterprise customers — The privacy policy names AWS servers in the United States or the European Union depending on the customer's location and grants the restriction to the European Economic Area explicitly to enterprise customers only. Processing and access also take place in the European Union, the United States, the United Kingdom, Singapore and Israel. The sub-processor list confirms this for AWS, adding that EU and APAC environments are available to enterprise customers as needed. | partially evidenced | 2026-08-28 |
| Subprocessors | public list with purpose, country of headquarters and country of storage, dated 03.02.2025 — The list names 24 entries with purpose, country of headquarters and country of storage, among them AWS and Google Cloud for hosting, four delivery networks and OpenAI under support and operations. Two things keep it below full evidential weight: the vendor itself describes it as a list of its main sub-processors, and it carries a last-updated date of 03.02.2025 while moderation, AI agents and image-to-video have been added since. The column on certification under the EU-US Data Privacy Framework is empty in almost every row. | partially evidenced | 2026-08-28 |
| Third-country transfer | standard contractual clauses 2021/914 and the EU-US Data Privacy Framework, with no mapping per recipient — The legal bases are named and anchored in the contract: standard contractual clauses under implementing decision 2021/914, the UK addendum, and Cloudinary Inc.'s self-certification under the EU-US Data Privacy Framework including the UK and Swiss extensions. What stays open is the mapping. The sub-processor list has its own column for Data Privacy Framework certification and leaves it empty almost everywhere, so it cannot be read off per recipient which basis applies. | partially evidenced | 2026-08-28 |
| Training on customer data | exclusion for generative models only for enterprise customers with an order form — Two statements part ways here, and the dividing line is the order form. Asked whether customer data and assets feed the training of generative models, the vendor answers: for enterprise customers who have signed an order form, no, they are deemed opted out by default. For everyone else the general answer is that it may use users' data and content to provide, maintain, develop and improve the services, in aggregated and non-identifiable form; only data carrying personal information is expressly excluded. Product photography, brand material and video footage carry no personal information. This matches the term of use granting the vendor permission to use contributed content for providing, developing and supporting the services. Both commitments sit on a marketing page of frequently asked questions rather than in the contract. | partially evidenced | 2026-08-28 |
| Retention and deletion | deletion of personal data within 30 days after the contract ends, backups excepted — Section 10 of the data processing agreement puts the deadline at 30 days after termination or expiry and in the same breath excepts copies held in routine backup and archiving. For the content itself the privacy policy adds that it will be deleted after termination or deactivation, without a deadline and with the note that the vendor is not responsible for any backup; delivery logs are kept with no stated period so that an account can be resumed. | partially evidenced | 2026-08-28 |
| Certifications | SOC 2 Type II (Deloitte), ISO 27001 (IQC seal dated 2025), ISO/IEC 42001, ISO 14001; reports on request only — Four proofs are named, and the trust page carries an audit seal for ISO 27001 with the year 2025. Two limitations remain. Under section 9.2 of the data processing agreement the vendor hands out reports and certificates only on written request, at most once a year; certificate number, certifying body and scope are published nowhere. And annex two of the same agreement, dated June 2026, names the edition ISO/IEC 27001:2013, whose transition period to the 2022 edition ended on 31.10.2025, while wording it in one paragraph as certified to and as based upon. | partially evidenced | 2026-08-28 |
| EU AI Act, Article 50 | certification to ISO/IEC 42001 stated, C2PA provenance data switched on by default for all generative transformations — The vendor states that it is certified to ISO/IEC 42001 for artificial intelligence management systems and, by its own account, attaches provenance data under the C2PA standard to all generative transformations without the operator having to do anything. That is precisely what carries the marking duty for artificially generated content under Article 50 of the AI Act. The regulation itself is named on none of the pages checked, and the certification lacks a number and a certifying body. The reference in the terms of use to an AI Trust page leads to this marketing page of frequently asked questions. | evidenced | 2026-08-28 |
| Audit logging | delivery logs only in the Enterprise plan, with scope and retention unpublished — The plan comparison lists delivery logs together with provisioning APIs, sign-in via SAML 2.0 and a custom service level commitment in the block that applies to Enterprise only. Which events are captured, how long they are held and how they are exported into your own systems is not published. Anyone who has to plan for evidence obligations cannot do so from the published material. | partially evidenced | 2026-08-28 |

## Cost

- Entry: Free with 25 monthly credits, 3 users and 1 account. Plus costs 99 dollars a month, or 89 billed yearly, and includes 225 credits. Advanced costs 249 dollars, or 224 billed yearly, and includes 600 credits. One credit equals 1,000 transformations or 1 GB of storage or 1 GB of delivered image traffic. (as of 2026-08-28)
- Where it gets expensive: The credit allowance is one shared budget. Storage, transformations and delivered traffic all draw on it at the same time, so a traffic spike eats into the storage allowance as well. Video traffic counts two to one on paid plans only. Sign-in via SAML 2.0, delivery logs, storage inside the European Economic Area and a custom service level commitment sit in the Enterprise plan alone, and searching across more than ten million assets may cost extra according to the vendor.

## Three routes compared

### Adobe Experience Manager Assets or Akamai Image and Video Manager

Large groups stay with Adobe because the asset system is coupled to approvals, rights and campaign planning, that is to processes outside delivery. Akamai sells the optimisation as an add-on to a delivery network already under contract, saving one contract, one invoice and one security review. The odd part: Akamai and Cloudinary announced an alliance on 11.06.2025, and Akamai also appears as a sub-processor in Cloudinary's own list.

### ImageKit

ImageKit costs 9 dollars on Lite and 89 dollars on Pro, keeps traffic and storage as separate budgets and bills overage instead of cutting off at a fixed credit allowance. Pro includes 225 GB of traffic and 225 GB of storage, where at Cloudinary 225 credits have to cover both together. What you give up is the depth of the video pipeline, the breadth of integrations and the contractual path on which Cloudinary hangs both the data processing agreement and the training opt-out.

### Object storage, a transformation service and your own delivery network

The route is real and often taken: originals into object storage such as Supabase Storage, an open-source transformation service such as imgproxy or Thumbor in front of it, Cloudflare as the delivery network in front of that, wired with n8n and built with Claude Code. For static sites Astro already covers the variants at build time through its image pipeline. Cropping is never where it fails. It fails in four places: purging caches across every derived variant, the rights layer for material that must not be public, video transcoding with adaptive streaming, and the on-call duty for a path that sits in front of every single page. The fifth point arrives later: maintenance once the builder has left the house.

Recommendation by size:

- Solo: Free tier, or on a static site use Astro's image pipeline and sign no contract at all.
- Mid-market: Buy, Plus or Advanced, and convert your own traffic into credits before you sign.
- Enterprise: Buy, but sign the order form before the first data goes in: the data processing agreement, EEA storage and the model training opt-out all hang on it. Price in logs and SAML sign-in from the start.

## Context

- Implements method: [70/20/10 Creative Reskinning](https://www.convios.com/en/methods/creative-reskinning) — The method multiplies what demonstrably works, and delivery is exactly what that hangs on: as long as every variation is a fresh export, the number of tests depends on design capacity rather than on demand.
- Implements method: [Value Metric Pricing](https://www.convios.com/en/methods/value-metric-pricing) — The credit, covering either 1,000 transformations, 1 GB of storage or 1 GB of delivery, is a textbook value metric and a textbook case of how one shared unit makes the customer's bill unpredictable.
- Implements method: [Regulatory Density Test](https://www.convios.com/en/methods/regulatory-density-test) — This is what the test is for: the data processing agreement, EEA storage, logs and the model training opt-out all hang on the same signature, and anyone who notices that only at procurement has long since put the data in.
- Alternative: [Astro](https://www.convios.com/en/toolbox/astro)
- Alternative: [Cloudflare Pages](https://www.convios.com/en/toolbox/cloudflare-pages)
- Displaces: Image resizing inside your own application server, Hand-produced variants in the file system, A separate pipeline for video transcoding

## Evidence

- Plans, credit logic and prices — https://cloudinary.com/pricing (as of 2026-08-28)
- Enterprise-bound features: SAML 2.0 sign-in, delivery logs, custom service level commitment — https://cloudinary.com/pricing/compare-plans (as of 2026-08-28)
- Data processing agreement, standard contractual clauses, deletion periods, audit rights, technical measures — https://cloudinary-marketing-res.cloudinary.com/image/upload/v1780332751/Cloudinary_Data_Processing_Agreenent_DPA_June_2026.pdf (as of 2026-08-28)
- Storage location, processing in third countries, deletion of content, public default for uploaded files — https://cloudinary.com/privacy (as of 2026-08-28)
- Sub-processors with purpose and country, and the date of the list — https://cloudinary.com/trust/subprocessors (as of 2026-08-28)
- Model training on customer content, enterprise opt-out, ISO/IEC 42001, C2PA provenance data — https://cloudinary.com/products/cloudinary_ai/faq (as of 2026-08-28)
- Permission to use contributed content, governing law and jurisdiction — https://cloudinary.com/tou (as of 2026-08-28)
- Certificates, availability commitment and audit seal — https://cloudinary.com/trust (as of 2026-08-28)
- Company register entry of the British subsidiary — https://find-and-update.company-information.service.gov.uk/company/11334866 (as of 2026-08-28)
- Prices and included volumes of the AI-native counterpart ImageKit — https://imagekit.io/plans (as of 2026-08-28)