EU data residency for your clients’ Webflow media.
Video and files stored in the EU, with a signed DPA and residency committed in writing, so your client’s legal team can sign off before launch.
EU by default, on every plan.
Stored in the EU
Files, video and their backups sit in Cloudflare’s Western Europe region by default, including on the free plan.
DPA §11.1Delivered fast everywhere
Visitors get files from Cloudflare’s global network, so a client’s site loads quickly outside Europe too.
Cloudflare CDNA public DPA and subprocessor list
Your client’s legal team can read both today, without an NDA or a sales call.
/dpa, /complianceBreach notice within 72 hours
We tell you without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach.
DPA §13What legal asks for, in writing.
Everything in Business+, plus the commitments a procurement review needs before anyone signs. Priced on the contract, not on gigabytes.
- 01 EU residency, committed in writing The standard DPA says EU by default. Enterprise turns that into a written commitment for your account.
- 02 A signed DPA, ours or theirs We countersign our DPA, or review and sign the one your client’s legal team sends.
- 03 Questionnaires done by us Vendor and security questionnaires, including your client’s own forms.
- 04 Notice before subprocessors change Advance notice of any change to who processes the data, so you can tell your client first.
- 05 Annual invoicing Purchase orders and bank transfer, not just a card.
- 06 A named contact Manuel, the founder, replies within one working day.
Three steps, and your sites don’t change.
- 1
Tell us what your clients need
The form below takes two minutes. Say which documents legal has asked for.
- 2
Get the DPA and a quote
Within one working day: the DPA, answers to your questionnaire, and a price.
- 3
Sign, and it’s in writing
Residency is pinned for your account and invoiced yearly. Your sites keep running as they are.
The DPA and a quote, within one working day.
It comes straight to Manuel, the founder. If your client has their own DPA or a security questionnaire, mention it and he’ll start there.
Prefer email? [email protected]
Straight answers to the usual questions.
What does Enterprise cost?
It’s priced on the contract and the review work, not on capacity. Requests, storage and file limits match Business+. Send the form and you’ll have a quote within one working day.
Do files leave the EU when someone outside Europe views them?
The stored files and their backups stay in the EU. Like any CDN, Cloudflare serves cached copies from close to each visitor so the site stays fast. If your client’s policy also covers delivery, say so in the form and we’ll put exactly what’s possible in writing.
Which services process data outside the EU?
Video transcoding (Qencode) runs globally, and only when you use video processing. Payments (Stripe) and email delivery (SendPulse) may process account details in the US. Each is covered by a data protection agreement and EU Standard Contractual Clauses. The full list is on the compliance page.
Can our client sign their own DPA instead of yours?
Yes. Send it with the form or by reply, and we’ll review it and sign it, or come back with specific changes.
Do we have to move our sites or change how files are linked?
No. Residency and the paperwork are added to your account. Files keep the same URLs, on your client’s own domain if you use one.
Running the review yourself? The DPA, subprocessors and safeguards are all public.