Each control below is in the code, not on a roadmap. Nothing is deployed yet. We list what we do and what we don't, because the absences are part of the architecture – they're not gaps to fill.
Append-only ledger by construction
Record entries are content-addressed and chained. Each entry's hash includes the previous entry's hash. Modifying or deleting an entry breaks the chain – detectable at next verification.
Workspace-scoped tokens, no shared API keys
Surface and gateway tokens are scoped to a single workspace. Lost or rotated, they only affect that workspace. A token can be DPoP-bound, so a stolen copy without the client's key is refused.
A staff read of your account lands in your ledger, not just ours
The staff admin console exists for legitimate operational work – incident triage, billing reconciliation, abuse response. When a staff member opens your account or one of your subscriptions, an append-only admin_read entry is written to your own workspace's Tops chain, naming the operator, the surface and the record. SQLite triggers enforce append-only at the database level, so even the admin console can't rewrite the trail of its own actions – and the entry is stamped platform-origin by a signed channel no customer holds, so nobody can forge one either way. Bulk operator sweeps that name no customer are recorded on our provider audit chain instead; we would rather your ledger stayed signal than padded it. The 9 Infrastructure kinds are customer-configurable per workspace (env filters, sampling rates, per-kind toggles) – kill-switch-floored to the actions that must always be recorded.
Jurisdictional data path
Pick a region at workspace creation. The three European regions store data under Cloudflare's EU jurisdiction: Cloudflare keeps it inside the EU and chooses the datacenter; Regional Services keeps compute in-jurisdiction. Checkpoints sign under WEUR or ENAM.
Encryption in transit and at rest
TLS 1.3 for all customer traffic. D1, Aurora and R2 encrypt at rest with provider-managed keys; checkpoint signing keys are held in Cloudflare Secrets, and upstream credentials are sealed under a key-encryption key.
No third-party telemetry on customer data
No third-party APM or analytics has access to customer record content. The marketing site is limited to cookieless, aggregate page-view analytics where enabled.
Database isolation by plan
Free and Starter workspaces share a regional Cloudflare D1 database, and every read and write carries the workspace id; Pro, Pro+ and Team each get their own separate store on Cloudflare in the chosen region, one per workspace, with strict tenant isolation, included in the plan. Scale, Enterprise and the isolation add-on get the workspace's own Amazon Web Services Aurora database, so there is no shared schema to query.
Personnel access logged
Every staff data-plane read writes a Tops entry against the affected workspace, with the staff member's identity, the timestamp, and the reason. The admin console authenticates via Cloudflare Access + per-administrator WebAuthn + per-admin API tokens. Provider-side admin access (Cloudflare admin, AWS admin) is logged at the provider.
