Loading the catalogue…
Cloudflare Workers AI
L0 · Third-country operatorcloudflare-workers-aiUnited StatesNorth America
Cloudflare, Inc. (US) serves open-weight models on its global edge network through Workers AI. Inference cannot be limited to the EU, because Cloudflare's Regional Services feature does not cover Workers AI.
Operated by Cloudflare · first-partywww.cloudflare.com ↗
Compliance posture · Stav's assessment
Jurisdiction
US · United States
Data residency
UNKNOWN
CLOUD Act / FISA 702
Exposed
Stav sovereignty level
Stav's assessment
Five dimensions
Serving residency
Poor
Legal exposure
Poor
Serving retention
Weak
Security posture
Weak
Contractual posture
Weak
Bands only. The scores and Stav's notes per dimension are read in the workspace.
Customers only
The full assessment
Stav's narrative, every risk item with its source, the safeguards that offset them and the privacy-policy issues found: the part of the page a procurement review runs on.
Stav's narrative · 7 risk items · 9 safeguards · 2 privacy-policy issues · DPA, sub-processor list, terms, privacy policy — sign in to read them.
Traffic through Stav is covered by Stav's customer DPA, which lists Stav's sub-processors.
Stav's serving-side assessment, compiled from the provider's published documentation and Stav's operational review. Last reviewed 20 Oct 2026. An assessment, not a guarantee or regulatory determination. Confirm against the provider's own documentation before contracting.
Sovereignty ladder · how the level was reached
L0Third-country operatorIndicativeregistry 4.1
This level applies to traffic routed through Stav.
Cloudflare is at L0. L1 is blocked: Workers AI cannot be limited to the EU, its sub-processors include US and English compute suppliers, and Cloudflare, Inc. is a US company subject to US legal process.
3 criteria from L1: Customer data in the Union, Infrastructure in the Union, No coerced vulnerability silence.
Stav's own assessment against criterion registry 4.1. Indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung. CADA itself still says “in the Union”: until the Act is incorporated into the EEA Agreement, a Norwegian, Icelandic or Liechtenstein route does not evidence formal Union assurance for an EU public-sector buyer. UK and Swiss providers are capped at L1.
Verified 17 Oct 2026About the ladder →Certifications & legal documents · the provider's own facts
ISO/IEC 27001 (scope includes Cloudflare Workers AI)
Holder: Cloudflare, Inc. Registration scope covers all declared services incl. Workers AI, per the EU Cloud Code of Conduct report verified by SCOPE Europe SRL. Valid for the Declaration of Adherence, until March 2027. · substantial assurance · Current
ISO 27018:2019
Cloudflare global cloud platform and subsidiary offices. A Cloudflare blog snippet says the auditor was Schellman and the certificate is a single joint certificate for ISO 27001:2013, 27018:2019 and 27701:2019. · Claimed by the provider
ISO 27701:2019
Cloudflare global cloud platform and subsidiary offices (privacy information management). · Claimed by the provider
SOC 2 Type II
AICPA Trust Services Criteria: security, confidentiality and availability. Report shared under NDA; first SOC 2 Type II in 2019. · Claimed by the provider
BSI C5
C5:2020 attestation, not a certification. Auditor and covered services not known. · Claimed by the provider
PCI DSS Level 1 Service Provider
Network, platform and infrastructure services, limited to a defined subset of Cloudflare products (PCI DSS 4.0). Attestation of Compliance downloadable from the Cloudflare dashboard. · Claimed by the provider
“Claimed by the provider” means the provider states the certification. Stav has not seen the certificate or report.
Terms of servicepublished
Privacy policypublished
Data processing agreement (DPA)published
Sub-processor listpublished
Links to every document and certificate — 4 legal documents, 6 certification sources
Compiled by Stav from the provider's published documentation. Last verified 11 Oct 2026. Reflects what the provider states, not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.
Endpoints served · 3
| Model | Input / M | Output / M | TTFT | Tok/s |
|---|---|---|---|---|
| clef-omni | €0.13 | Free | — | — |
| clef | €0.22 | Free | — | — |
| clef-flash | €0.03 | Free | — | — |