Skip to content
Cloudflare Docs

Product compatibility

The table below provides a summary of the Data Localization Suite product's behavior with Cloudflare products. Refer to the table legend for guidance on interpreting the table.

✅ Product works with no caveats
🚧 Product can be used with some caveats
✘ Product cannot be used
⚫️ Not applicable

Application Performance

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Caching/CDN✅✅✅
Cache Reserve⚫️🚧✅ 1
DNS⚫️🚧 2🚧 3
HTTP/3 (with QUIC)⚫️✘⚫️
Image Resizing✅✅ 4🚧 5
Load Balancing✅✅🚧 5
Onion Routing✘✘✘
Orange-to-Orange (O2O)✘✘✘
Stream Delivery✅✅✅
Tiered Caching✅🚧 6🚧 7
Trace✘✘✘
Waiting Room⚫️✅✅
Zaraz✅✅✅

Application Security

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Advanced Certificate Manager⚫️⚫️⚫️
Advanced DDoS Protection✅✅🚧 8
API Shield✅✅🚧 9
Bot Management✅✅🚧 10
DNS Firewall⚫️⚫️🚧 11
Page Shield✅✅✅
Rate Limiting✅✅✅ 12
SSL✅✅✅
Cloudflare for SaaS✘✅✅
Turnstile⚫️✘✅ 13
WAF/L7 Firewall✅✅✅
DMARC Management⚫️⚫️✅

Developer Platform

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Cloudflare Images⚫️✅ 14🚧 15
AI Gateway✘✘🚧 16
Cloudflare Pages✅ 17✅ 17🚧 5
Cloudflare D1⚫️⚫️🚧 18
Durable Objects⚫️✅ 19🚧 5
Email Routing⚫️⚫️✅
R2✅ 20✅ 21✅ 22
Smart Placement⚫️✘✘
Stream⚫️✘🚧 5
Workers (deployed on a Zone)✅✅🚧 23
Workers AI⚫️✘✅
Workers KV⚫️✘✅ 24
Workers.dev✘✘✘
Workers Analytics Engine (WAE)⚫️⚫️🚧 5

Network Services

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Argo Smart Routing✅✘ 25✘ 26
Static IP/BYOIP⚫️✅ 27⚫️
Magic Firewall⚫️⚫️✅
Magic Network Monitoring⚫️⚫️🚧 5
Magic Transit⚫️⚫️🚧 5
Magic WAN⚫️⚫️✅
Spectrum✅✅ 28✅

Platform

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Logpull⚫️⚫️🚧 29
Logpush⚫️✅🚧 30

Zero Trust

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Access🚧 31🚧 32🚧 33
Browser Isolation⚫️🚧 34✅
CASB⚫️⚫️✘
Cloudflare Tunnel⚫️🚧 35⚫️
DLP⚫️ 36⚫️ 36🚧 37
Gateway🚧 38🚧 39🚧 11
WARP⚫️⚫️🚧 5

Footnotes

  1. You cannot yet specify region location for object storage itself. ↩

  2. Outgoing zone transfers will carry Earth region proxy IPs, thus making regional service dysfunctional when non-Cloudflare nameservers respond to the DNS queries. ↩

  3. Dashboard Analytics are empty when using CMB outside the US region. Use Logpush instead. ↩

  4. Only when using a Custom Domain set to a region, either through Workers or Transform Rules within the same zone. ↩

  5. Logs / Analytics not available outside US region when using Customer Metadata Boundary. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9

  6. Regular and Custom Tiered Cache works; Smart Tiered Caching not available with Regional Services. ↩

  7. Regular/Generic and Custom Tiered Cache works; Smart Tiered Caching does not work with Customer Metadata Boundary (CMB).
    With CMB set to EU, the Zone Dashboard Caching > Tiered Cache > Smart Tiered Caching option will not populate the Dashboard Analytics. ↩

  8. Adaptive DDoS Protection is only supported for US CMB. ↩

  9. Features such as API Discovery and Volumetric Abuse Detection will not work with CMB set to EU only. ↩

  10. Some advanced Enterprise features, including the Anomaly Detection engine, are not available. ↩

  11. Dashboard Analytics and Logs are empty when using CMB outside the US region. Use Logpush instead. ↩ ↩2

  12. Legacy Zone Analytics & Logs section not available outside US region when using CMB. Use Security Analytics instead. ↩

  13. Turnstile Analytics are available. However, there are no regionalization guarantees for the Siteverify API yet. ↩

  14. Only when using a Custom Domain set to a region. ↩

  15. Logs / Analytics not available outside US region when using Customer Metadata Boundary. Jurisdictional Restrictions (storage) options are not supported today. ↩

  16. Jurisdictional Restrictions (storage) options for Logs are not supported today. ↩

  17. Only when using Custom Domain set to a region. ↩ ↩2

  18. Jurisdictional Restrictions (data location / storage) options are not supported today. ↩

  19. Jurisdiction restrictions for Durable Objects. ↩

  20. Only when using a Custom Domain and a Custom Certificate or Keyless SSL. ↩

  21. Only when using a Custom Domain set to a region and using jurisdictions with the S3 API. ↩

  22. R2 Dashboard Metrics and Analytics are populated. Additionally, Jurisdictional Restrictions guarantee objects in a bucket are stored within a specific jurisdiction. ↩

  23. Logs / Analytics not available outside US region when using Customer Metadata Boundary. Use Logpush instead. ↩

  24. Jurisdictional Restrictions (storage) for Workers KV pairs is not supported today. ↩

  25. Argo cannot be used with Regional Services. ↩

  26. Argo cannot be used with Customer Metadata Boundary. ↩

  27. Static IP/BYOIP can be used with the legacy Spectrum setup. ↩

  28. Only applies to HTTP/S Spectrum applications. ↩

  29. Logpull not available when using Customer Metadata Boundary outside US region. Logs may be stored and retrieved with Logs Engine ↗ which is adding region support in 2025. ↩

  30. Logpush available with Customer Metadata Boundary for these datasets. Contact your account team if you need another dataset. ↩

  31. Access App SSL keys can use Geo Key Manager. Access JWT is not yet localized. ↩

  32. Can be localized to US FedRAMP region only. More regions coming in 2024. ↩

  33. Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. ↩

  34. Currently may only be used with US FedRAMP region. ↩

  35. The only connectivity option is US FedRAMP region. Regional Services only applies when using Public Hostnames set to a region. ↩

  36. Uses Gateway HTTP and CASB. ↩ ↩2

  37. DLP is part of Gateway HTTP, however, DLP datasets are not available outside US region when using Customer Metadata Boundary. ↩

  38. You can bring your own certificate ↗ to Gateway but these cannot yet be restricted to a specific region. ↩

  39. Gateway HTTP supports Regional Services. Gateway DNS does not yet support regionalization.
    ICMP proxy and WARP-to-WARP proxy are not available to Regional Services users. ↩