Skip to content
Cloudflare Docs

Product compatibility

The table below provides a summary of the Data Localization Suite product's behavior with Cloudflare products. Refer to the table legend for guidance on interpreting the table.

✅ Product works with no caveats
🚧 Product can be used with some caveats
✘ Product cannot be used
⚫️ Not applicable

Application Performance

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Caching/CDN✅✅✅
Cache Reserve⚫️🚧✅ 1
DNS⚫️🚧 2🚧 3
HTTP/3 (with QUIC)⚫️✘⚫️
Image Resizing✅✅ 4🚧 5
Load Balancing✅✅🚧 5
Onion Routing✘✘✘
Orange-to-Orange (O2O)✘✘✘
Stream Delivery✅✅✅
Tiered Caching✅🚧 6🚧 7
Trace✘✘✘
Waiting Room⚫️✅✅
Web Analytics / Real User Monitoring (RUM)⚫️⚫️✘ 8
Zaraz✅✅✅

Application Security

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Advanced Certificate Manager⚫️⚫️⚫️
Advanced DDoS Protection✅✅🚧 9
API Shield✅✅🚧 10
Bot Management✅✅🚧 11
DNS Firewall⚫️⚫️🚧 12
Page Shield✅✅✅
Rate Limiting✅✅✅ 13
SSL✅✅✅
Cloudflare for SaaS✘✅✅
Turnstile⚫️✘✅ 14
WAF/L7 Firewall✅✅✅
DMARC Management⚫️⚫️✅

Developer Platform

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Cloudflare Images⚫️✅ 15🚧 16
AI Gateway✘✘🚧 17
Cloudflare Pages✅ 18✅ 18🚧 5
Cloudflare D1⚫️⚫️🚧 19
Durable Objects⚫️✅ 20🚧 5
Email Routing⚫️⚫️✅
R2✅ 21✅ 22✅ 23
Smart Placement⚫️✘✘
Stream⚫️✘🚧 5
Workers (deployed on a Zone)✅✅🚧 24
Workers AI⚫️✘✅
Workers KV⚫️✘✅ 25
Workers.dev✘✘✘
Workers Analytics Engine (WAE)⚫️⚫️🚧 5

Network Services

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Argo Smart Routing✅✘ 26✘ 27
Static IP/BYOIP⚫️✅ 28⚫️
Magic Firewall⚫️⚫️✅
Magic Network Monitoring⚫️⚫️🚧 5
Magic Transit⚫️⚫️🚧 5
Magic WAN⚫️⚫️✅
Spectrum✅✅ 29✅

Platform

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Logpull⚫️⚫️🚧 30
Logpush⚫️✅🚧 31
Log Explorer⚫️⚫️✘ 32

Zero Trust

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Access🚧 33🚧 34🚧 35
Browser Isolation⚫️🚧 36✅
CASB⚫️⚫️✘
Cloudflare Tunnel⚫️🚧 37⚫️
DLP⚫️ 38⚫️ 38🚧 39
Gateway🚧 40🚧 41🚧 12
WARP⚫️⚫️🚧 5

Footnotes

  1. You cannot yet specify region location for object storage itself. ↩

  2. Outgoing zone transfers will carry Earth region proxy IPs, thus making regional service dysfunctional when non-Cloudflare nameservers respond to the DNS queries. ↩

  3. Dashboard Analytics are empty when using CMB outside the US region. Use Logpush instead. ↩

  4. Only when using a Custom Domain set to a region, either through Workers or Transform Rules within the same zone. ↩

  5. Logs / Analytics not available outside US region when using Customer Metadata Boundary. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9

  6. Regular and Custom Tiered Cache works; Smart Tiered Caching not available with Regional Services. ↩

  7. Regular/Generic and Custom Tiered Cache works; Smart Tiered Caching does not work with Customer Metadata Boundary (CMB).
    With CMB set to EU, the Zone Dashboard Caching > Tiered Cache > Smart Tiered Caching option will not populate the Dashboard Analytics. ↩

  8. Web Analytics collects the minimum amount of information. Alternatively, you can exclude EU Visitors from RUM. ↩

  9. Adaptive DDoS Protection is only supported for US CMB. ↩

  10. Features such as API Discovery and Volumetric Abuse Detection will not work with CMB set to EU only. ↩

  11. Some advanced Enterprise features, including the Anomaly Detection engine, are not available. ↩

  12. Dashboard Analytics and Logs are empty when using CMB outside the US region. Use Logpush instead. ↩ ↩2

  13. Legacy Zone Analytics & Logs section not available outside US region when using CMB. Use Security Analytics instead. ↩

  14. Turnstile Analytics are available. However, there are no regionalization guarantees for the Siteverify API yet. ↩

  15. Only when using a Custom Domain set to a region. ↩

  16. Logs / Analytics not available outside US region when using Customer Metadata Boundary. Jurisdictional Restrictions (storage) options are not supported today. ↩

  17. Jurisdictional Restrictions (storage) options for Logs are not supported today. ↩

  18. Only when using Custom Domain set to a region. ↩ ↩2

  19. Jurisdictional Restrictions (data location / storage) options are not supported today. ↩

  20. Jurisdiction restrictions for Durable Objects. ↩

  21. Only when using a Custom Domain and a Custom Certificate or Keyless SSL. ↩

  22. Only when using a Custom Domain set to a region and using jurisdictions with the S3 API. ↩

  23. R2 Dashboard Metrics and Analytics are populated. Additionally, Jurisdictional Restrictions guarantee objects in a bucket are stored within a specific jurisdiction. ↩

  24. Logs / Analytics not available outside US region when using Customer Metadata Boundary. Use Logpush instead. ↩

  25. Jurisdictional Restrictions (storage) for Workers KV pairs is not supported today. ↩

  26. Argo cannot be used with Regional Services. ↩

  27. Argo cannot be used with Customer Metadata Boundary. ↩

  28. Static IP/BYOIP can be used with the legacy Spectrum setup. ↩

  29. Only applies to HTTP/S Spectrum applications. ↩

  30. Logpull not available when using Customer Metadata Boundary outside US region. Logs may be stored and retrieved with Logs Engine ↗ which is adding region support in 2025. ↩

  31. Logpush available with Customer Metadata Boundary for these datasets. Contact your account team if you need another dataset. ↩

  32. Currently, customers do not have the ability to choose the location of the Cloudflare-managed R2 bucket for Log Explorer. ↩

  33. Access App SSL keys can use Geo Key Manager. Access JWT is not yet localized. ↩

  34. Can be localized to US FedRAMP Moderate Domestic region only. ↩

  35. Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. ↩

  36. Currently may only be used with US FedRAMP region. ↩

  37. When Cloudflare Tunnel connects to Cloudflare, the connectivity options available are the Global Region (default) and US FedRAMP Moderate Domestic region. For incoming requests to the Cloudflare Edge, Regional Services only applies when using Public Hostnames. In this case, the region associated with the DNS record will apply. ↩

  38. Uses Gateway HTTP and CASB. ↩ ↩2

  39. DLP is part of Gateway HTTP, however, DLP datasets are not available outside US region when using Customer Metadata Boundary. ↩

  40. You can bring your own certificate ↗ to Gateway but these cannot yet be restricted to a specific region. ↩

  41. Gateway HTTP supports Regional Services. Gateway DNS does not yet support regionalization.
    ICMP proxy and WARP-to-WARP proxy are not available to Regional Services users. ↩