Skip to content
Cloudflare Docs

Product compatibility

The table below provides a summary of the Data Localization Suite product's behavior with Cloudflare products. Refer to the table legend for guidance on interpreting the table.

✅ Product works with no caveats
🚧 Product can be used with some caveats
✘ Product cannot be used
⚫️ Not applicable

Application Performance

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Caching/CDN✅✅✅
Cache Reserve⚫️🚧✅ 1
DNS⚫️🚧 2🚧 3
HTTP/3 (with QUIC)⚫️✘⚫️
Image Resizing✅✅ 4🚧 5
Load Balancing✅✅🚧 5
Onion Routing✘✘✘
Orange-to-Orange (O2O)✘✘✘
Stream Delivery✅✅✅
Tiered Caching✅🚧 6🚧 7
Trace✘✘✘
Waiting Room⚫️✅✅
Web Analytics / Real User Monitoring (RUM)⚫️⚫️✘ 8
Zaraz✅✅✅

Application Security

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Advanced Certificate Manager⚫️⚫️⚫️
Advanced DDoS Protection✅✅🚧 9
API Shield✅✅🚧 10
Bot Management✅✅🚧 11
DNS Firewall⚫️⚫️🚧 12
Page Shield✅✅✅
Rate Limiting✅✅✅ 13
SSL✅✅✅
Cloudflare for SaaS✘✅✅
Turnstile⚫️✘✅ 14
WAF/L7 Firewall✅✅✅
DMARC Management⚫️⚫️✅

Developer Platform

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Cloudflare Images⚫️✅ 15🚧 16
AI Gateway✘✘🚧 17
Cloudflare Pages✅ 18✅ 18🚧 5
Cloudflare D1⚫️⚫️🚧 19
Durable Objects⚫️✅ 20🚧 5
Email Routing⚫️⚫️✅
R2✅ 21✅ 22✅ 23
Smart Placement⚫️✘✘
Stream⚫️✘🚧 5
Workers (deployed on a Zone)✅✅🚧 24
Workers AI⚫️✘✅
Workers KV⚫️✘✅ 25
Workers.dev✘✘✘
Workers Analytics Engine (WAE)⚫️⚫️🚧 5

Network Services

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Argo Smart Routing✅✘ 26✘ 27
Static IP/BYOIP⚫️✅ 28⚫️
Magic Firewall⚫️⚫️✅
Magic Network Monitoring⚫️⚫️🚧 5
Magic Transit⚫️⚫️🚧 5
Magic WAN⚫️⚫️✅
Spectrum✅✅ 29✅

Platform

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Logpull⚫️⚫️🚧 30
Logpush⚫️✅🚧 31

Zero Trust

ProductGeo Key ManagerRegional ServicesCustomer Metadata Boundary
Access🚧 32🚧 33🚧 34
Browser Isolation⚫️🚧 35✅
CASB⚫️⚫️✘
Cloudflare Tunnel⚫️🚧 36⚫️
DLP⚫️ 37⚫️ 37🚧 38
Gateway🚧 39🚧 40🚧 12
WARP⚫️⚫️🚧 5

Footnotes

  1. You cannot yet specify region location for object storage itself. ↩

  2. Outgoing zone transfers will carry Earth region proxy IPs, thus making regional service dysfunctional when non-Cloudflare nameservers respond to the DNS queries. ↩

  3. Dashboard Analytics are empty when using CMB outside the US region. Use Logpush instead. ↩

  4. Only when using a Custom Domain set to a region, either through Workers or Transform Rules within the same zone. ↩

  5. Logs / Analytics not available outside US region when using Customer Metadata Boundary. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9

  6. Regular and Custom Tiered Cache works; Smart Tiered Caching not available with Regional Services. ↩

  7. Regular/Generic and Custom Tiered Cache works; Smart Tiered Caching does not work with Customer Metadata Boundary (CMB).
    With CMB set to EU, the Zone Dashboard Caching > Tiered Cache > Smart Tiered Caching option will not populate the Dashboard Analytics. ↩

  8. Web Analytics collects the minimum amount of information. Alternatively, you can exclude EU Visitors from RUM. ↩

  9. Adaptive DDoS Protection is only supported for US CMB. ↩

  10. Features such as API Discovery and Volumetric Abuse Detection will not work with CMB set to EU only. ↩

  11. Some advanced Enterprise features, including the Anomaly Detection engine, are not available. ↩

  12. Dashboard Analytics and Logs are empty when using CMB outside the US region. Use Logpush instead. ↩ ↩2

  13. Legacy Zone Analytics & Logs section not available outside US region when using CMB. Use Security Analytics instead. ↩

  14. Turnstile Analytics are available. However, there are no regionalization guarantees for the Siteverify API yet. ↩

  15. Only when using a Custom Domain set to a region. ↩

  16. Logs / Analytics not available outside US region when using Customer Metadata Boundary. Jurisdictional Restrictions (storage) options are not supported today. ↩

  17. Jurisdictional Restrictions (storage) options for Logs are not supported today. ↩

  18. Only when using Custom Domain set to a region. ↩ ↩2

  19. Jurisdictional Restrictions (data location / storage) options are not supported today. ↩

  20. Jurisdiction restrictions for Durable Objects. ↩

  21. Only when using a Custom Domain and a Custom Certificate or Keyless SSL. ↩

  22. Only when using a Custom Domain set to a region and using jurisdictions with the S3 API. ↩

  23. R2 Dashboard Metrics and Analytics are populated. Additionally, Jurisdictional Restrictions guarantee objects in a bucket are stored within a specific jurisdiction. ↩

  24. Logs / Analytics not available outside US region when using Customer Metadata Boundary. Use Logpush instead. ↩

  25. Jurisdictional Restrictions (storage) for Workers KV pairs is not supported today. ↩

  26. Argo cannot be used with Regional Services. ↩

  27. Argo cannot be used with Customer Metadata Boundary. ↩

  28. Static IP/BYOIP can be used with the legacy Spectrum setup. ↩

  29. Only applies to HTTP/S Spectrum applications. ↩

  30. Logpull not available when using Customer Metadata Boundary outside US region. Logs may be stored and retrieved with Logs Engine ↗ which is adding region support in 2025. ↩

  31. Logpush available with Customer Metadata Boundary for these datasets. Contact your account team if you need another dataset. ↩

  32. Access App SSL keys can use Geo Key Manager. Access JWT is not yet localized. ↩

  33. Can be localized to US FedRAMP Moderate Domestic region only. ↩

  34. Customer Metadata Boundary can be used to limit data transfer outside region, but Access User Logs will not be available outside US region. ↩

  35. Currently may only be used with US FedRAMP region. ↩

  36. The only connectivity option is US FedRAMP Moderate Domestic region. Regional Services only applies when using Public Hostnames set to a region. ↩

  37. Uses Gateway HTTP and CASB. ↩ ↩2

  38. DLP is part of Gateway HTTP, however, DLP datasets are not available outside US region when using Customer Metadata Boundary. ↩

  39. You can bring your own certificate ↗ to Gateway but these cannot yet be restricted to a specific region. ↩

  40. Gateway HTTP supports Regional Services. Gateway DNS does not yet support regionalization.
    ICMP proxy and WARP-to-WARP proxy are not available to Regional Services users. ↩