# Cloudflare Mesh privacy rating

Private networking in Cloudflare One that gives devices and servers running the WARP client or connector private addresses, with all traffic passing through Cloudflare's network.

## Summary

Cloudflare Mesh scores 18 out of 100 (grade F) on the mesh VPNs and private networks criteria. It partly meets no ads or data sales, independent audit and no connection logs by default. It does not meet open source, no trackers or telemetry, keys stay on devices and self-hosted coordination server. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.

- Website: https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Windows, macOS, Linux, Android, iOS
- Home page trackers: Cloudflare Web Analytics (cookieless analytics)
- Category: [Mesh VPNs and private networks](https://privacyratings.com/mesh-vpns/)
- Also rated: [Cloudflare Email Routing](https://privacyratings.com/email-forwarding/cloudflare-email-routing/) (Email forwarding and aliases), [1.1.1.1](https://privacyratings.com/mobile-security-apps/1-1-1-1/) (Mobile security apps), [Cloudflare](https://privacyratings.com/dns-resolvers/cloudflare/) (DNS resolvers), [Cloudflare DNS](https://privacyratings.com/dns-hosting/cloudflare-dns/) (DNS hosting), [Cloudflare Registrar](https://privacyratings.com/domain-registrars/cloudflare-registrar/) (Domain registrars), [Cloudflare Workers](https://privacyratings.com/app-hosting/cloudflare-workers/) (App hosting platforms), [Cloudflare Web Analytics](https://privacyratings.com/web-analytics/cloudflare-web-analytics/) (Website analytics)
- Grade: F (18/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | The WARP client and Cloudflare One are closed source. |  |
| No trackers or telemetry | No | The website loads Google Tag Manager, and the privacy policy describes advertising cookies. | https://www.cloudflare.com/privacypolicy/ |
| No ads or data sales | Partial | Funded by paid plans and does not sell personal information, but marketing and advertising partners receive website data to advertise Cloudflare's services. | https://www.cloudflare.com/privacypolicy/ |
| Independent audit | Partial | SOC 2, ISO 27001 and PCI reports exist but are only available to account administrators in the dashboard. | https://developers.cloudflare.com/fundamentals/reference/policies-compliances/compliance-docs/ |
| Keys stay on devices | No | All traffic passes through Cloudflare, where Gateway policies are applied. Devices do not encrypt traffic end to end to each other. | https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-mesh/concepts/ |
| Self-hosted coordination server | No | Only Cloudflare's hosted service can be used. |  |
| No connection logs by default | Partial | Gateway logs all DNS, network and HTTP activity by default. Admins can turn logging off or keep only blocked requests. | https://developers.cloudflare.com/cloudflare-one/insights/logs/gateway-logs/ |

Source: https://privacyratings.com/mesh-vpns/cloudflare-mesh/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/mesh-vpns/cloudflare-mesh.md