# Cloudflare Workers privacy rating

Serverless platform that runs JavaScript, TypeScript, Python and WebAssembly on Cloudflare's global network, and hosts static sites and full-stack apps, including those formerly on Cloudflare Pages.

## Summary

Cloudflare Workers scores 47 out of 100 (grade D) on the app hosting platforms criteria. It meets 3 of 8 criteria: transparency report, tells users about requests and TLS configuration. It partly meets no ads or data sales, independent audit and security headers. It does not meet open source and no trackers or telemetry. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade B+.

- Website: https://www.cloudflare.com/products/workers/
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: Cloudflare Web Analytics (cookieless analytics), Google Tag Manager
- Category: [App hosting platforms](https://privacyratings.com/app-hosting/)
- Also rated: [Cloudflare Email Routing](https://privacyratings.com/email-forwarding/cloudflare-email-routing/) (Email forwarding and aliases), [1.1.1.1](https://privacyratings.com/mobile-security-apps/1-1-1-1/) (Mobile security apps), [Cloudflare](https://privacyratings.com/dns-resolvers/cloudflare/) (DNS resolvers), [Cloudflare DNS](https://privacyratings.com/dns-hosting/cloudflare-dns/) (DNS hosting), [Cloudflare Registrar](https://privacyratings.com/domain-registrars/cloudflare-registrar/) (Domain registrars), [Cloudflare Mesh](https://privacyratings.com/mesh-vpns/cloudflare-mesh/) (Mesh VPNs and private networks), [Cloudflare Web Analytics](https://privacyratings.com/web-analytics/cloudflare-web-analytics/) (Website analytics)
- Grade: D (47/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | The platform is closed source. The workerd runtime and the Wrangler CLI are open source. |  |
| No trackers or telemetry | No | The website loads Google Tag Manager and Intercom, and the privacy policy describes advertising cookies. | https://www.cloudflare.com/privacypolicy/ |
| No ads or data sales | Partial | Funded by paid plans and does not sell personal information, but marketing and advertising partners receive website data to advertise Cloudflare's services. | https://www.cloudflare.com/privacypolicy/ |
| Independent audit | Partial | SOC 2, ISO 27001 and PCI reports exist but are only available to account administrators in the dashboard. | https://developers.cloudflare.com/fundamentals/reference/policies-compliances/compliance-docs/ |
| Transparency report | Yes | Semi-annual reports with counts of legal requests and responses. | https://www.cloudflare.com/transparency/ |
| Tells users about requests | Yes | The transparency report states customers are notified of legal requests unless legally prohibited. | https://cf-assets.www.cloudflare.com/slt3lc6tev37/zItVXCvbb4LZpYG4Uh10R/7b27bba39755f0a4344acb946977704d/2H_2025_Cloudflare_s_Transparency_Report_Legal-v2.pdf |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=dash.cloudflare.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=dash.cloudflare.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/app-hosting/cloudflare-workers/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/app-hosting/cloudflare-workers.md