The complete Cloudflare playbook for a vibe coder

The origin (2004-2010)

Cloudflare grew out of Project Honey Pot, a 2004 open-source project by Matthew Prince and Lee Holloway that tracked how spammers harvested email addresses from websites. Thousands of websites in more than 185 countries joined, and users kept asking the same thing: don't just track the bad guys, stop them. In 2009, while Prince was getting his MBA at Harvard Business School, he described the project to classmate Michelle Zatlyn, who saw the bigger opportunity: turn that threat intelligence into a service that protects and speeds up any website. The three (Prince, Zatlyn, and technical genius Holloway) formally founded the company on July 26, 2009. The original idea, in Prince's words: "Could you take a firewall and put it in the cloud?" They launched publicly at TechCrunch Disrupt on September 27, 2010. Holloway stepped away in 2016 after being diagnosed with frontotemporal dementia; Cloudflare honored him by codenaming its IPO "Project Holloway."

Funding history

Cloudflare raised over $330 million across roughly seven private rounds. The Series A (about $2.1 million, November 2009) was led by Pelion Venture Partners and Venrock. NEA led the Series B in 2010. Union Square Ventures, Fidelity, Google's CapitalG, Microsoft (M12), Qualcomm Ventures, Baidu, and Franklin Templeton participated over time. It hit unicorn status ($1.8 billion valuation) with a $110 million Series D in September 2015, and the largest pre-IPO round was a $150 million Series E in March 2019 led by Franklin Templeton.

IPO and stock

Cloudflare went public on the NYSE as NET on September 13, 2019, pricing at $15 per share (above the raised $12-14 range), implying roughly a $3.8 billion valuation. A dual-class share structure gives insiders' shares 10 votes each, keeping founders Prince and Zatlyn firmly in control. As of July 2, 2026 the stock traded around $242 with a market cap of roughly $86 billion. Institutional investors (Vanguard, BlackRock, State Street, and similar) own the large majority of economic shares, commonly cited between 77% and 78%.

Revenue and employees

Revenue: $287M (2019), $431M (2020), $656M (2021), $975M (2022), $1.30B (2023), $1.67B (2024), $2.168B (2025, up about 30%). 2025 showed an operating loss of roughly $207M and a net loss of about $102M, consistent with a growth company reinvesting heavily. Trailing-twelve-month revenue as of Q1 2026 was $2.33B. Headcount grew from about 3,217 (2023) to 5,156 (end of 2025). Notably, on May 7, 2026 Cloudflare announced cuts of more than 1,100 jobs (about 20% of staff) the same day it reported 34% revenue growth, framed as a restructuring toward an "AI-first" operating model, and explicitly protecting sales hiring.

The "20% of the internet" claim: verified, with nuance

Essentially accurate and, if anything, conservative. W3Techs (June 2026) puts Cloudflare at 23.4% of all websites and 83.5% of all sites with a known reverse proxy; Statista put Amazon CloudFront, its nearest rival, at just 1-2% in November 2025. Cloudflare separately says it has visibility into roughly 20% of all global internet traffic. Different measurements (websites vs. traffic vs. reverse-proxy share) produce numbers in the 10-24% range, so "about a fifth of the web" is a fair, defensible summary.

Acquisitions and milestones

A disciplined, mostly small-scale acquirer, buying teams and technology rather than revenue: Vectrix (SaaS security, Jan 2022, ~$7.6M), Area 1 Security (email security, Apr 2022, ~$156.6M, its largest), Nefeli Networks (2024), Baselime (2024), and PartyKit. Cloudflare's stated philosophy is to avoid the technical debt of stitching together many acquisitions and to build most products in-house.

Controversies and outages: criticism over content-moderation decisions given its role as neutral infrastructure; the July 2019 outage (a bad regular-expression rule); the big November 18, 2025 outage, where per Cloudflare's official post-mortem a database permissions change caused a bot-management configuration file to double in size, exceed a hard-coded limit, and crash the proxy software, taking down X, ChatGPT, Spotify, Canva, and others for roughly five and a half hours; a December 5, 2025 event from a bad firewall rule; and a February 20, 2026 outage that prompted an internal "Code Orange: Fail Small" initiative forcing gradual, quickly-reversible rollouts. CEO Matthew Prince has generally earned praise for transparent post-mortems.

Think of Cloudflare as three big buckets: (A) protect and speed up things you already have, (B) build and host new applications, and (C) add AI (covered in Part 6).

Bucket A: Protect and speed up (the classic Cloudflare)

• CDN (Content Delivery Network). Keeps copies of your site's images, videos, and files in 300+ cities so they load from a server near each visitor. End-user experience: pages load fast whether the visitor is in Manila or Miami.
• DNS. The internet's phone book, translating your domain name into a server address. Cloudflare runs the world's fastest public DNS (1.1.1.1). End-user experience: the site simply comes up quickly and reliably.
• DDoS protection. Blocks attacks that flood a site with fake traffic to knock it offline. Per Cloudflare's 2025 Q4 report, it mitigated 47.1 million DDoS attacks in 2025 (up 121% year over year), including a record 31.4 terabit-per-second attack that lasted just 35 seconds. Unmetered and free on all plans. End-user experience: the app stays up even under attack.
• WAF (Web Application Firewall). Inspects incoming traffic and blocks hacking attempts (like people trying to break into your database through a login form). Invisible to users, but it is why the app doesn't get breached.
• SSL/TLS. The padlock in the browser; encrypts traffic. Free. End-user experience: the browser shows "secure" and doesn't scare users away.
• Bot Management, Rate Limiting, Turnstile. Tools to tell humans from bots. Turnstile is a free, privacy-friendly replacement for "click all the traffic lights" CAPTCHAs; it usually verifies people invisibly. End-user experience: real users sail through forms; spammers get stopped.
• Load Balancing, Waiting Room, Argo Smart Routing. Spread traffic across servers, hold visitors in an orderly online queue during spikes (think concert tickets), and route traffic over the fastest network paths. End-user experience: no crashes during a rush, just a friendly "you are number 3,412 in line" page.
• Spectrum. Extends protection to non-website services (game servers, email servers).
• Zaraz. Loads third-party scripts (analytics, chat widgets, pixels) efficiently so they don't slow your site.
• Web Analytics. Privacy-first traffic stats without cookies.
• Registrar. Buy and manage domains at wholesale cost, famously with no markup.

Bucket B: Build and host applications (where your projects live)

• Workers. Serverless compute: upload code and it runs on Cloudflare's global network with no servers to manage. This is the engine of any app you build. Over 3 million developers since its 2017 launch; more than 40% of Y Combinator's Winter 2025 cohort built on it. End-user experience: the app responds instantly worldwide.
• Pages. Hosting for websites and web apps with automatic deployment. This is where your front-end (what users see) lives.
• D1. A serverless SQL database (SQLite-based). SQL is the standard way to store structured data in tables (users, orders, tasks). End-user experience: the app remembers everything correctly.
• KV (Key-Value store). Ultra-fast storage for simple settings and lookups (preferences, feature flags). End-user experience: personalized settings load instantly.
• Durable Objects. A special kind of Worker with its own private storage and a stable identity, each with its own embedded SQLite database. End-user experience: live collaboration, multiplayer, chat rooms, and presence ("Sarah is typing...") that stay in sync.
• R2. S3-compatible object storage for files: PDFs, images, videos, backups. Works with the huge ecosystem of tools built for Amazon's storage, but with zero egress fees. End-user experience: uploads and downloads are fast and never rate-limited by cost.
• Queues. Lets parts of your app hand off work to the background. End-user experience: the app feels instant because slow tasks (emails, processing uploads) happen behind the scenes.
• Hyperdrive. Makes an existing traditional database (like PostgreSQL hosted elsewhere) fast to reach from Workers by pooling and caching connections.
• Workflows. "Durable execution" for multi-step processes: if step 4 of 7 fails, it resumes from step 4 rather than restarting. Now generally available. End-user experience: long processes (onboarding, document pipelines) reliably finish even if something hiccups.
• Containers. GA since June 2025; runs heavier, traditional software that doesn't fit the lightweight Workers model. Expands what's possible.
• Workers for Platforms. Build a platform where your own customers can deploy code; useful for hosting many client tenants.
• Cloudflare for SaaS / Custom Hostnames. Serve many customers each on their own domain, with automatic SSL for each. End-user experience: each client sees the app on their own branded address with a working padlock.
• Email Routing and Email Service. Route incoming email addresses to real inboxes for free, and (newer) send transactional emails (receipts, password resets) from your app.
• Stream. Upload, store, and play video with an adaptive player. Smooth video like YouTube, without buffering.
• Images. Store, resize, and optimize images on the fly; photos load fast and look right on every device.
• Browser Rendering. Runs real, headless web browsers on Cloudflare (now with Playwright support, up to 30 concurrent browsers). Powers features like "generate a PDF of this page" or lets an AI agent actually browse websites.
• VibeSDK. Announced at Birthday Week 2025: an open-source vibe-coding platform you can deploy yourself, complete with AI code generation, a sandbox, and one-click deployment. Directly relevant to how you build.

Zero Trust / Cloudflare One (the login and security layer for internal tools)

• Access. Puts a login wall in front of any app, tool, or document, controlling exactly who gets in (by email, Google login, device). End-user experience: employees and clients log in once and only see what they're allowed to see, no VPN needed.
• Gateway. Filters web traffic and blocks malware and risky sites for your team.
• Browser Isolation. Runs risky websites in a remote browser so nothing malicious reaches the employee's computer.
• CASB and DLP. Scan your SaaS apps (Google Workspace, GitHub) for misconfigurations and prevent sensitive data from leaking.
• WARP. The client app that connects devices securely.

Cloudflare is used by a very large share of well-known products. Documented examples, plus clearly-labeled estimates where usage isn't officially published:

Company	What they use it for	Confidence
Shopify	Securing and personalizing online shopping for millions; industry analysis estimates 70-80% of storefront traffic served at the edge. Likely CDN, WAF, Workers, bot management.	Case study
Canva	Connects employees and protects user assets; one analysis estimates up to 95% of asset delivery runs through Cloudflare. Likely CDN, image delivery, Zero Trust for staff.	Case study
Discord	Front-end protection, CDN, DNS (listed Workers customer with an official sample bot); its own real-time chat servers run elsewhere. Estimated 20-40% of critical traffic.	Listed + estimate
DoorDash	Built its marketing platform with Workers and Next.js (per DoorDash Engineering, Feb 2022).	Documented
OpenAI / ChatGPT	Cloudflare in front of its services (widely reported; confirmed affected by the Nov 2025 outage). Likely CDN, DDoS, WAF, bot management.	Reported
VSCO	Migrated 2+ petabytes of image data using Workers, saving a reported $400,000/year.	Case study
THG	Rebuilt its e-commerce front-end on Workers; deployments went from 8 hours to 10 minutes and organic traffic rose 20%.	Case study
Stack Overflow	Stops DDoS attacks; launched an AI-driven revenue model on Cloudflare.	Case study
Others	Marriott, United Airlines, 23andMe, Broadcom, Glossier, npm, Codepen; plus X/Twitter, Spotify, Coinbase, and League of Legends (all affected by the Nov 2025 outage, indicating reliance).	Listed / observed

What you genuinely cannot (easily) do on Cloudflare

• Run software that needs a persistent filesystem, long-running background processes, or large in-memory state (Workers is designed for short, stateless bursts, though Containers and Durable Objects relax this).
• Run a heavy, single always-on server the traditional way.
• Get a built-in user-authentication system as polished as Supabase's or Firebase's; you assemble it from Access and/or third-party auth.
• Store regulated health data with clear, documented HIPAA coverage across the developer products (see Part 7).
• Some database-heavy code AI tools generate assumes a traditional Postgres/MySQL connection; use Hyperdrive or a partner like PlanetScale/Neon, or accept D1's constraints.

Cloudflare organizes pricing into three separate systems, which confuses people.

System 1: Website plans (priced per domain)

Plan	Price	Highlights
Free	$0	Unlimited-bandwidth CDN, free SSL, DDoS protection, basic WAF, DNS. Genuinely powerful.
Pro	$20/mo	(billed annually; $25 monthly) Better WAF, image optimization, more analytics.
Business	$200/mo	(annual; $250 monthly) Advanced features and support.
Enterprise	Custom	Negotiated annually.

Crucially, bandwidth and DDoS mitigation are unmetered across all tiers, so no surprise overage bills from traffic spikes.

System 2: Zero Trust / Access (priced per user)

Plan	Price	Highlights
Free	$0	Up to 50 users; the most generous free tier in the industry. Real Zero Trust access control plus a secure web gateway.
Pay-as-you-go	$7/user/mo	No user cap; adds uptime SLA and 30-day logs.
Enterprise	Custom	Email security, full DLP, longer log retention.

System 3: Developer platform (usage-based)

Product	Free tier	Paid
Workers	100,000 requests/day, 10ms CPU/request	$5/mo minimum incl. 10M requests, then $0.30/M; 30M CPU-ms included, then $0.02/M. No bandwidth charge.
D1 (database)	5 GB storage, 5M rows read/day	Scales cheaply; no egress charges.
R2 (storage)	10 GB storage, 1M Class A + 10M Class B ops/mo	$0.015/GB/mo storage, and $0 egress, forever. (Compare S3: ~$0.023/GB storage plus ~$0.09/GB egress after the first 100 GB.)
KV, Durable Objects, Queues	Generous free tiers (Durable Objects now on free)	Usage-based.
Workers AI	10,000 "Neurons"/day (a Neuron is Cloudflare's unified unit of AI work)	$0.011 per 1,000 Neurons; per-model token pricing also published (e.g. Llama 3.1 8B ~$0.045/M input, ~$0.384/M output tokens).
Vectorize	30M queried vector-dimensions/mo, 5M stored	Usage-based beyond.

What real companies pay: a small login-protected app with a database and file storage often costs $0 to $5/month. A busy internal tool for a few hundred users: on the order of $5-50/month plus $7/user if using Access beyond 50 users. A media-heavy product serving terabytes: tens to low hundreds of dollars, where competitors would charge thousands.

This is Cloudflare's fastest-growing frontier and the most relevant to your goals. On its fiscal Q1 2025 earnings call, Cloudflare reported Workers AI inference requests up roughly 4,000% year over year, AI Gateway requests up more than 1,200%, and the largest contract in company history (a milestone deal of more than $100 million) driven by the Workers developer platform.

• Workers AI. Run AI models with one API call, no GPU to rent or manage. 50+ models across text (Llama, Mistral, Qwen, DeepSeek), image generation (Flux), embeddings (BGE), and audio, running in 200+ cities. Enables: AI features inside your app (summarize this, classify that, transcribe this call) at a fraction of OpenAI's cost, often 60-90% cheaper for tasks a small model handles well.
• AI Gateway. A control panel in front of any AI provider (Workers AI, OpenAI, Anthropic, Google, Groq). It caches responses, controls costs, retries failed calls, falls back to another provider, and logs everything. Enables: frontier models for hard reasoning and cheap local models for simple tasks, with one dashboard and no surprise bills.
• Vectorize. A vector database, which stores the "meaning" of text as numbers so you can search by concept, not just keywords. Enables: an AI that can answer questions about your company's own documents.
• AutoRAG / AI Search. A fully-managed retrieval-augmented generation pipeline (renamed AI Search in 2025). Point it at an R2 bucket of documents and it automatically indexes them, keeps them in sync, and lets an AI answer questions grounded in them; supports external models like OpenAI and Anthropic. Enables: "chat with your documents" with almost no setup, the core of most business AI tools.
• Agents SDK. The framework for building autonomous AI agents. Each agent is a Durable Object, giving it a stable identity, its own SQLite memory, WebSocket connections (costing nothing while idle via "hibernation"), and built-in scheduling. As of late 2025 it supports sessions long enough for an agent to clone a code repository, run tests, and open a pull request in one continuous run. Enables: agents that send scheduled emails, monitor systems, act without being prompted, and connect to Slack, Discord, email, or webhooks.
• Remote MCP servers. Cloudflare launched the industry's first remote MCP server in April 2025. MCP (Model Context Protocol) is the emerging standard that lets AI agents securely connect to and use external tools and data (email, business systems). Cloudflare handles authentication (partnering with Auth0, Stytch, WorkOS) so users can safely grant an agent permission to act on their behalf. Enables: an AI agent that can actually do things in your other software, not just talk.
• Browser Rendering for agents. Gives agents a real browser to navigate websites, fill forms, and extract information.
• Code Mode. Converts AI tools into a TypeScript interface so the AI writes code to call tools rather than making individual tool calls, improving accuracy.

The certifications Cloudflare holds (high confidence, from Cloudflare's Trust Hub)

• SOC 2 Type II: Yes, since 2019, renewed annually, report available under NDA. Importantly, the scope explicitly includes the developer platform (Workers, D1, R2, KV, Durable Objects, Workers AI, Pages, Hyperdrive, Queues, AI Gateway, and more). Building SOC 2-compliant internal tools on Cloudflare is well-supported.
• ISO 27001, ISO 27701 (privacy), ISO 27018 (cloud PII): all certified. Cloudflare was among the first in its industry certified as both a PII processor and controller under 27701.
• PCI DSS Level 1 (v4.0): Yes, audited annually; Workers, R2, KV, Durable Objects, and Secrets Store are in scope. Combined with a payment processor like Stripe, you can build payment-handling apps.
• FedRAMP: "Cloudflare for Government" is FedRAMP Moderate authorized (since 2022) and now In Process for FedRAMP High. This applies to a separate government environment, not the commercial platform.
• GDPR: Supported via a Data Processing Addendum and a Data Localization Suite (Regional Services, Customer Metadata Boundary, Geo Key Manager) that can keep traffic, metadata, and logs inside the EU or US.

The HIPAA situation (the important part)

HIPAA is the U.S. law protecting patient health information (PHI). To handle PHI on someone else's infrastructure, you need them to sign a Business Associate Agreement (BAA), a contract making them responsible for protecting that data. What the research found:

• Cloudflare will sign a BAA, but only for Enterprise customers, and the BAA is non-negotiable and requires minimum spending thresholds. Cloudflare's Trust Hub states plainly that it will only enter BAAs with enterprise customers.
• Cloudflare's public HIPAA documentation names only its security and edge products as in-scope examples (CDN, WAF, Bot Management), and names DNS and Magic Transit as out of scope if purchased alone. It does NOT publicly confirm that Workers, D1, R2, KV, Durable Objects, or Workers AI are covered by the BAA. Inclusion in SOC 2, PCI, and FedRAMP audit scopes is reassuring, but it is NOT the same as HIPAA BAA coverage, which is contractual.
• This is a real, documented ambiguity: developers building healthcare apps on Cloudflare have reported (late 2025) being unable to get a clear public answer on whether Workers and D1 are BAA-covered, and had to escalate to Cloudflare sales.
• Cloudflare's core public HIPAA whitepaper carries a 2020 revision date, predating much of the developer platform. The current position must be confirmed in writing with a Cloudflare account executive.

The shared responsibility model

Cloudflare secures the platform: physical data centers, isolation between customers, encryption in transit, DDoS/WAF protection, and the certifications above. YOU are responsible for how your app is built: who can log into it, what data you store and where, whether you accidentally cache sensitive data, whether you redact sensitive information from logs, and your own policies. Workers "does not allow any access to the local filesystem" and tightly defines what code can do, but fine-grained access control within your app is your responsibility. Note that Workers logs do not automatically aggregate into a central, tamper-proof audit store; if you need comprehensive audit trails (regulated tools often do), ship logs to a central system via Logpush. In short: Cloudflare gives you a secure building; you are responsible for locking your own office inside it.

(a) Replacing Google Sheets with real login-protected dashboards

A perfect fit and arguably Cloudflare's sweet spot for you. The pattern: build the dashboard as a web app on Pages + Workers, store the data in D1 (tables of clients, employees, tasks, KPIs), store uploaded files in R2, and put Access in front so each client and employee logs in (with Google login, since you already use Google) and sees only their data. End result: instead of a shared spreadsheet, each client gets a clean branded dashboard at their own login; you control exactly who sees what; and it costs on the order of $5/month plus $7/user for Access if you exceed 50 users.

(b) Moving OA's internal AI ecosystem off Google Workspace

Largely feasible and sensible while keeping Gmail, Chat, and Drive. Rebuild internal AI tools (document Q&A, drafting assistants, workflow automations) on Workers AI + AI Search + Agents SDK; Cloudflare can connect to Google via MCP or APIs. Recommendation: migrate incrementally, tool by tool, and keep Google as the system of record for email and documents. You get cost control and custom AI without abandoning the Google tools your team relies on.

(c) Secure document storage (PDFs) with controlled staff access

R2 + Access is a strong fit. Store the PDFs in R2 (cheap, and no egress fees means lots of downloads cost nothing), gate access through Access so only specified staff reach specified folders and files, with every login logged. Caveat: for truly sensitive documents, build the permission logic carefully (shared responsibility), and if any documents contain regulated health or financial data, revisit Part 7 first.

(d) New products

• Coach lineup / team database tool: a classic Workers + D1 + Access app. Coaches log in, create teams, drag players into lineups (D1 stores it), share a view with parents. Add Workers AI to auto-suggest balanced lineups.
• Family hub with AI: Pages + Workers + D1 + R2 for the app, calendars and lists in D1, photos in R2/Images, and an Agents SDK assistant that answers questions and schedules reminders. Durable Objects enable real-time shared updates across family members' devices.
• Hyper-custom personal CRM ("Brad's Command Center"): this is an AI-agent product. Use the Agents SDK for the assistant, remote MCP servers to connect it to email and calendar (with proper authentication), Vectorize/AI Search so it can recall notes and documents, and a D1 database for contacts and history. The agent can run scheduled tasks (daily briefings) and take actions on your behalf.

(e) Learning from Cloudflare's own marketing and sales

Cloudflare is a textbook case of product-led growth: give away a genuinely useful free product, let users adopt it bottom-up, then land and expand into paid tiers and enterprise deals. Its marketing engine runs on themed "Innovation Weeks" (Developer Week, Security Week, Birthday Week) that concentrate announcements into media-friendly bursts, plus heavy investment in high-quality educational content (its blog and docs teach, they don't just sell) and purpose-driven programs (Project Galileo protects at-risk nonprofits and journalists for free). For OA: consider a free or low-cost entry product that showcases your AI capabilities, a content engine that teaches offshore-staffing best practices, and periodic launch moments that bundle announcements for attention.

(f) Client-facing AI-agent products: architecture and pricing

A repeatable architecture: front-end on Pages, logic on Workers, per-client data isolation using Workers for Platforms or careful D1/Access design, files in R2, AI via Workers AI + AI Gateway (mix cheap and frontier models, control spend), agents via the Agents SDK, client logins via Access or a third-party auth provider. Pricing your product: your underlying Cloudflare cost per client is likely single-digit to low-double-digit dollars monthly at modest scale, so you can price per-seat or per-client SaaS subscriptions with healthy margins, mirroring Cloudflare's own model: start clients on a shared cheap tier and only incur meaningful cost as usage grows.

1. Stage 1 (now, next 30 days): prove the pattern once. Build a single internal dashboard, replacing your most-used Google Sheet, on Pages + Workers + D1 + Access. This teaches you (and your AI coding tools) the core stack cheaply and safely. Benchmark to advance: it works, your team logs in with Google, and it costs under $20/month.
2. Stage 2 (60-90 days): add AI and go client-facing. Layer Workers AI + AI Search onto that dashboard (chat with your documents), then build one client-facing tool (the coach lineup tool or a client dashboard). Introduce the Agents SDK for one automation. Benchmark: a paying or pilot client uses it daily.
3. Stage 3 (quarter 2+): productize. Turn the repeatable architecture into a real SaaS product for staffing clients, using Workers for Platforms for multi-tenant isolation and Access (or third-party auth) for logins. Price per-seat with margin over your low Cloudflare cost.

Guardrails that would change the plan

• If you ever handle real patient health data (PHI): stop and get written HIPAA BAA confirmation from Cloudflare sales for the specific products, or keep PHI on AWS/Google/Azure and use Cloudflare only for the security front door. The single most important guardrail.
• If an app needs a full traditional database, long-running server processes, or heavy always-on compute: pair Cloudflare with Supabase (Postgres + auth), Neon/PlanetScale (via Hyperdrive), or Render/Fly.io (the always-on server). Don't force it onto Workers alone.
• If your AI tools keep generating Next.js and fighting the Cloudflare adapter: it is acceptable to host that specific front-end on Vercel while keeping data, storage, and AI on Cloudflare. Don't let tooling friction stall you.
• Always keep backups off-platform. Given the late-2025 and early-2026 outages, export D1 and R2 backups elsewhere on a schedule so a Cloudflare outage is an inconvenience, not a catastrophe.

• Pricing and free-tier limits change frequently. Reconfirm every dollar figure and limit on Cloudflare's live pricing pages before relying on it.
• The "which features does company X use" mappings are partly estimated. Where marked "likely" or "estimated," treat it as informed inference from case studies and third-party traffic analysis, not confirmed architecture.
• The HIPAA developer-product coverage question is genuinely unresolved in public sources and must be confirmed directly with Cloudflare. Do not build a PHI app assuming Workers/D1/R2 are BAA-covered.
• Some sources are secondary. Cloudflare's own docs, SEC filings, and established outlets were prioritized, but third-party analyses (traffic percentages, cost comparisons) are estimates.
• Outage history is a real reliability consideration. Cloudflare is highly reliable overall, but its central role means rare failures are widely felt; plan for it.
• This is educational analysis, not professional legal, security, or engineering advice. Validate compliance-critical and architecture-critical decisions with qualified professionals.