Product compatibility
The table below provides a summary of the Data Localization Suite product's behavior with Cloudflare products. Refer to the table legend for guidance on interpreting the table.
✅ Product works with no caveats
🚧 Product can be used with some caveats
✘ Product cannot be used
⚫️ Not applicable
Product | Geo Key Manager | Regional Services | Customer Metadata Boundary |
---|---|---|---|
Caching/CDN | ✅ | ✅ | ✅ |
Cache Reserve | ⚫️ | 🚧 | ✅ 1 |
DNS | ⚫️ | 🚧 2 | 🚧 3 |
HTTP/3 (with QUIC) | ⚫️ | ✘ | ⚫️ |
Image Resizing | ✅ | ✅ 4 | 🚧 5 |
Load Balancing | ✅ | ✅ | 🚧 5 |
Onion Routing | ✘ | ✘ | ✘ |
Orange-to-Orange (O2O) | ✘ | ✘ | ✘ |
Stream Delivery | ✅ | ✅ | ✅ |
Tiered Caching | ✅ | 🚧 6 | 🚧 7 |
Trace | ✘ | ✘ | ✘ |
Waiting Room | ⚫️ | ✅ | ✅ |
Zaraz | ✅ | ✅ | ✅ |
Product | Geo Key Manager | Regional Services | Customer Metadata Boundary |
---|---|---|---|
Advanced Certificate Manager | ⚫️ | ⚫️ | ⚫️ |
Advanced DDoS Protection | ✅ | ✅ | 🚧 8 |
API Shield | ✅ | ✅ | ✘ 9 |
Bot Management | ✅ | ✅ | 🚧 10 |
DNS Firewall | ⚫️ | ⚫️ | 🚧 5 |
Page Shield | ✅ | ✅ | ✅ |
Rate Limiting | ✅ | ✅ | 🚧 5 |
SSL | ✅ | ✅ | ✅ |
Cloudflare for SaaS | ✘ | ✅ | ✅ |
Turnstile | ⚫️ | ✘ | ✅ |
WAF/L7 Firewall | ✅ | ✅ | ✅ |
DMARC Management | ⚫️ | ⚫️ | ✅ |
Product | Geo Key Manager | Regional Services | Customer Metadata Boundary |
---|---|---|---|
Cloudflare Images | ⚫️ | ✅ 11 | 🚧 12 |
Cloudflare Pages | ✘ | ✅ 13 | 🚧 5 |
Durable Objects | ⚫️ | ✅ 14 | 🚧 5 |
Email Routing | ⚫️ | ⚫️ | ✅ |
R2 | ✅ 15 | ✅ 16 | ✅ 17 |
Smart Placement | ⚫️ | ✘ | ✘ |
Stream | ⚫️ | ✘ | 🚧 5 |
Workers (deployed on a Zone) | ✅ | ✅ | 🚧 5 |
Workers AI | ⚫️ | ✘ | ✅ |
Workers KV | ⚫️ | ✘ | ✅ 18 |
Workers.dev | ✘ | ✘ | ✘ |
Product | Geo Key Manager | Regional Services | Customer Metadata Boundary |
---|---|---|---|
Argo Smart Routing | ✅ | ✘ 19 | ✘ 20 |
Static IP/BYOIP | ⚫️ | ✅ 21 | ⚫️ |
Magic Firewall | ⚫️ | ⚫️ | ✅ |
Magic Transit | ⚫️ | ⚫️ | 🚧 5 |
Magic WAN | ⚫️ | ⚫️ | ✅ |
Spectrum | ✅ | ✅ | ✅ |
Product | Geo Key Manager | Regional Services | Customer Metadata Boundary |
---|---|---|---|
Logpull | ⚫️ | ⚫️ | 🚧 22 |
Logpush | ⚫️ | ✅ | 🚧 23 |
Product | Geo Key Manager | Regional Services | Customer Metadata Boundary |
---|---|---|---|
Access | 🚧 24 | 🚧 25 | 🚧 26 |
Browser Isolation | ⚫️ | 🚧 27 | ✅ |
CASB | ⚫️ | ⚫️ | ✘ |
Cloudflare Tunnel | ⚫️ | 🚧 28 | ⚫️ |
DLP | ⚫️ 29 | ⚫️ 29 | 🚧 30 |
Gateway | 🚧 31 | 🚧 32 | 🚧 33 |
WARP | ⚫️ | ⚫️ | 🚧 5 |
-
You cannot yet specify region location for object storage itself. ↩
-
Outgoing zone transfers will carry Earth region proxy IPs, thus making regional service dysfunctional when non-Cloudflare nameservers respond to the DNS queries. ↩
-
Dashboard Analytics are empty when using CMB outside the US region. Use Logpush instead. ↩
-
Only when using a Custom Domain set to a region, either through Workers or Transform Rules within the same zone. ↩
-
Logs / Analytics not available outside US region when using Customer Metadata Boundary. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10
-
Regular and Custom Tiered Cache works; Smart Tiered Caching not available with Regional Services. ↩
-
Regular/Generic and Custom Tiered Cache works; Smart Tiered Caching does not work with Customer Metadata Boundary (CMB).
With CMB set to EU, the Zone Dashboard Caching > Tiered Cache > Smart Tiered Caching option will not populate the Dashboard Analytics. ↩ -
Adaptive DDoS Protection is only supported for US CMB. ↩
-
API shield will not yet work with Customer Metadata Boundary enabled outside of US region. ↩
-
Some advanced Enterprise features, including the Anomaly Detection engine, are not available. ↩
-
Only when using a Custom Domain set to a region. ↩
-
Logs / Analytics not available outside US region when using Customer Metadata Boundary. Jurisdictional Restrictions (storage) options are not supported today. ↩
-
Only when using Custom Domain set to a region. ↩
-
Only when using a Custom Domain and a Custom Certificate or Keyless SSL. ↩
-
Only when using a Custom Domain set to a region and using jurisdictions with the S3 API. ↩
-
R2 Dashboard Metrics and Analytics are populated. Additionally, Jurisdictional Restrictions guarantee objects in a bucket are stored within a specific jurisdiction. ↩
-
Jurisdictional Restrictions (storage) for Workers KV pairs is not supported today. ↩
-
Argo cannot be used with Regional Services. ↩
-
Argo cannot be used with Customer Metadata Boundary. ↩
-
Static IP/BYOIP can be used with the legacy Spectrum setup. ↩
-
Logpull not available when using Customer Metadata Boundary outside US region. Logs may be stored and retrieved with Logs Engine ↗ which is adding region support in 2025. ↩
-
Logpush available with Customer Metadata Boundary for these datasets. Contact your account team if you need another dataset. ↩
-
Access App SSL keys can use Geo Key Manager. Access JWT is not yet localized. ↩
-
Can be localized to US FedRAMP region only. More regions coming in 2024. ↩
-
Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. ↩
-
Currently may only be used with US FedRAMP region. ↩
-
Only US FedRAMP region. ↩
-
DLP is part of Gateway HTTP, however, DLP datasets are not available outside US region when using Customer Metadata Boundary. ↩
-
You can bring your own certificate ↗ to Gateway but these cannot yet be restricted to a specific region. ↩
-
Gateway HTTP supports Regional Services. Gateway DNS does not yet support regionalization.
ICMP proxy and WARP-to-WARP proxy are not available to Regional Services users. ↩ -
Dashboard Analytics and Logs are empty when using CMB outside the US region. Use Logpush instead. ↩