Mesh VPNs and private networks
Cloudflare Mesh privacy rating
Private networking in Cloudflare One that gives devices and servers running the WARP client or connector private addresses, with all traffic passing through Cloudflare's network.
Summary
Cloudflare Mesh scores 18 out of 100 (grade F) on the mesh VPNs and private networks criteria. It partly meets no ads or data sales, independent audit and no connection logs by default. It does not meet open source, no trackers or telemetry, keys stay on devices and self-hosted coordination server. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.
Score 18 out of 100. How scoring works
Criteria
-
No
Open source Weight 3 of 3
Is all the source code needed to run the product public?
The WARP client and Cloudflare One are closed source.
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
The website loads Google Tag Manager, and the privacy policy describes advertising cookies.
-
Partial
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid plans and does not sell personal information, but marketing and advertising partners receive website data to advertise Cloudflare's services.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
SOC 2, ISO 27001 and PCI reports exist but are only available to account administrators in the dashboard.
-
No
Keys stay on devices Weight 3 of 3
Is traffic encrypted between devices with private keys created on each device, so the coordination server and relays cannot read it?
All traffic passes through Cloudflare, where Gateway policies are applied. Devices do not encrypt traffic end to end to each other.
-
No
Self-hosted coordination server Weight 2 of 3
Can the coordination or control server be self-hosted with open-source software?
Only Cloudflare's hosted service can be used.
-
Partial
No connection logs by default Weight 2 of 3
Are connection logs and client diagnostic logs kept off the vendor's servers unless a user or admin turns them on?
Gateway logs all DNS, network and HTTP activity by default. Admins can turn logging off or keep only blocked requests.