Does Cloudflare's SOC 2 report cover our own SOC 2?

No. Cloudflare's own SOC 2 report covers the controls Cloudflare operates for its platform. Your examination covers how your company configures and uses Cloudflare: who has access, how it is authenticated, what is logged and how data in it is protected. Auditors read the vendor's report to decide what they can rely on, and the Vendor and Third-Party Risk Management Policy tells you to collect it at onboarding and annually.

What does the generator pre-fill when I arrive from this page?

The link on this page opens the generator with a preset that sets the cloud platform to Cloudflare. The other answers (company, product, headcount, owners, data types, scope and review cadence) are yours to fill in. The policies render in your browser as Markdown; nothing is sent to a server and there is no signup.

Which policies change when I add Cloudflare to my answers?

5 policies name Cloudflare once it is in the intake: Access Control Policy, Encryption and Key Management Policy, Logging and Monitoring Policy, Business Continuity and Disaster Recovery Policy, Network and Infrastructure Security Policy. The free generator names it in scope, roles and procedures; the Audit Kit ($39 one-time) rewrites sections 4 and 5 of each policy with statements specific to how Cloudflare is configured, like the examples on this page. Refunds are available within 14 days on request.

SOC 2 policies for Cloudflare teams

Name: Policyseed
Author: Policyseed

Cloudflare hosts your production environment, so it appears wherever the policies talk about who can reach production, how data is encrypted, what is logged, how services recover and how the network is segmented.

Cloud platforms · Referenced by 5 of 22 policies · Generator preset available

The 5 policies that reference Cloudflare

With Cloudflare in your intake, these policies name it in their scope, roles and procedures. The other 17 policies in the set apply to your company regardless of tooling; the template index lists all 22.

P03 Access Control Policy: Defines how access to systems and data is requested, approved, provisioned, reviewed and removed.
P08 Encryption and Key Management Policy: Sets minimum encryption standards for data in transit and at rest and defines how cryptographic keys, secrets and certificates are generated, stored, rotated and retired.
P12 Logging and Monitoring Policy: Defines which security-relevant events are logged across the product, cloud and corporate systems, how logs are protected and retained, and how alerts are triaged and acted on.
P14 Business Continuity and Disaster Recovery Policy: Sets recovery objectives by system tier, defines how a disaster is declared and recovered from, and requires the plan to be tested and maintained.
P20 Network and Infrastructure Security Policy: Defines how the cloud networks, compute and supporting infrastructure behind the product are segmented, hardened, administered and monitored.

What the Audit Kit writes for Cloudflare

The free generator fills in names. The Audit Kit goes further: Claude rewrites section 4 (Policy Statements) and section 5 (Procedures) of each policy using your full intake, so the text describes Cloudflare the way you actually run it. The statements below are examples of that output for Cloudflare; your own answers produce different text, and every statement should be checked against your configuration before management adopts it.

P03 Access Control Policy

Administrative interfaces and internal tools are published behind Cloudflare Access with policies that require login through the identity provider, membership of a named group and, for production tooling, a device posture check. Cloudflare account members hold scoped roles rather than Super Administrator, and two-factor authentication is enforced for every account member.

P08 Encryption and Key Management Policy

Every zone uses the Full (strict) SSL/TLS encryption mode with a minimum TLS version of 1.2, Always Use HTTPS and HTTP Strict Transport Security enabled, and Authenticated Origin Pulls so that origin servers accept only connections presenting a Cloudflare client certificate.

P12 Logging and Monitoring Policy

Cloudflare Logpush delivers HTTP request, firewall event and Access audit logs to the central logging tool, and the Cloudflare account audit log is reviewed at each quarterly access review for changes to DNS records, WAF rules and Access policies that do not match an approved ticket.

P14 Business Continuity and Disaster Recovery Policy

Production DNS is served by Cloudflare with proxied records and short TTLs, Cloudflare Load Balancing health checks steer traffic away from an unhealthy origin, and the disaster recovery runbook documents how origins are repointed during a hosting-provider outage.

P20 Network and Infrastructure Security Policy

The Cloudflare WAF runs the Cloudflare Managed Ruleset and the OWASP Core Ruleset in block mode, rate-limiting rules protect the login, password-reset and API endpoints, Bot Fight Mode is enabled, and origin firewalls accept HTTP traffic only from the published Cloudflare IP ranges.

How to use this page

Open the generator with the Cloudflare preset and answer the remaining questions: company, product, headcount, other tools, data types, owners, scope and review cadence.
Download the 22 policies as Markdown. Read the sections that mention Cloudflare with the admin console open and fix anything that is not true of your setup.
Optionally buy the Audit Kit to have sections 4 and 5 tailored to Cloudflare and the rest of your stack, and to get Word documents, the TSC crosswalk, an evidence checklist, acknowledgment forms and a review calendar in one ZIP built on your machine.
Have management approve the policies, collect acknowledgments, and start producing the evidence the procedures describe. The CPA firm performs the examination.

Other tools

Cloud platforms: AWS, Google Cloud, Microsoft Azure, Vercel

Source control and CI: GitHub, GitLab

Identity providers: Google Workspace, Okta, Microsoft 365

Vendors and subprocessors: Supabase, Clerk

Frequently asked questions

Does Cloudflare's SOC 2 report cover our own SOC 2?: No. Cloudflare's own SOC 2 report covers the controls Cloudflare operates for its platform. Your examination covers how your company configures and uses Cloudflare: who has access, how it is authenticated, what is logged and how data in it is protected. Auditors read the vendor's report to decide what they can rely on, and the Vendor and Third-Party Risk Management Policy tells you to collect it at onboarding and annually.
What does the generator pre-fill when I arrive from this page?: The link on this page opens the generator with a preset that sets the cloud platform to Cloudflare. The other answers (company, product, headcount, owners, data types, scope and review cadence) are yours to fill in. The policies render in your browser as Markdown; nothing is sent to a server and there is no signup.
Which policies change when I add Cloudflare to my answers?: 5 policies name Cloudflare once it is in the intake: Access Control Policy, Encryption and Key Management Policy, Logging and Monitoring Policy, Business Continuity and Disaster Recovery Policy, Network and Infrastructure Security Policy. The free generator names it in scope, roles and procedures; the Audit Kit ($39 one-time) rewrites sections 4 and 5 of each policy with statements specific to how Cloudflare is configured, like the examples on this page. Refunds are available within 14 days on request.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.