Risk Score
0 = very fair · 100 = very risky
Summary
This is a SaaS Terms of Service agreement for Cloudflare's self-serve subscription platform, governing access to cloud-based security, performance, and networking services. The agreement is moderately one-sided, as expected for a B2B/B2C SaaS product, with notable provisions including mandatory arbitration, class action waiver, no-refund policy, and broad termination rights. Cloudflare retains ownership of aggregated network data derived from user traffic, and users are granted only a limited, revocable license to use the services. Several clauses significantly favor Cloudflare, particularly around unilateral termination without cause, non-refundable fees, and broad indemnification obligations placed on the user.
Flagged Clauses
Disputes with Cloudflare must go through private arbitration rather than court, and users cannot join together in a class action lawsuit. This limits the ability to challenge Cloudflare collectively or through the court system.
“THIS AGREEMENT CONTAINS PROVISIONS REQUIRING THAT YOU AGREE TO THE USE OF ARBITRATION TO RESOLVE ANY DISPUTES ARISING UNDER THIS AGREEMENT RATHER THAN A JURY TRIAL OR ANY OTHER COURT PROCEEDINGS, AND TO WAIVE YOUR PARTICIPATION IN CLASS ACTION OF ANY KIND AGAINST CLOUDFLARE.”
Users do not 'own' access to Cloudflare services — they are granted a limited, revocable license that can be taken away. This is standard for SaaS products.
“Cloudflare hereby grants to you a limited, revocable, non-exclusive, non-transferable, and non-sublicensable... right, to access and use the Services.”
Cloudflare can terminate an account at any time, for any reason, without warning. There is no stated obligation to notify users or provide an opportunity to correct issues before termination.
“We may at our sole discretion terminate your user account or Suspend or terminate your use or access to the Service at any time, with or without notice for any reason or no reason at all.”
Cloudflare can change, limit, or shut down any feature or the entire service at any time with no notice and no obligation to compensate users, even if users are mid-subscription.
“We also reserve the right to modify or discontinue the Service at any time (including, without limitation, by limiting or discontinuing certain features of the Service) without notice to you. We will have no liability whatsoever on account of any change to the Service or any suspension or termination of your access to or use of the Service.”
If a subscription is cancelled, no refund is given for any remaining time in the billing period. Users pay for the full term regardless of when they cancel.
“FEES ARE NONREFUNDABLE. YOU WILL BE BILLED IN FULL FOR THE SUBSCRIPTION TERM IN WHICH YOU CANCEL AND NO REFUNDS WILL BE PROVIDED FOR THE UNUSED PORTION OF SUCH SUBSCRIPTION TERM.”
Subscriptions auto-renew automatically at potentially new (higher) rates. Users must remember to cancel before the billing date to avoid being charged for another full term, and can only cancel through the account dashboard.
“All of your subscriptions to Paid Services with a Subscription Term will automatically renew for periods equal to your initial Subscription Term, and you will be charged at our then-current rates unless you cancel your subscription through the Services' account dashboard prior to your next scheduled billing date.”
Cloudflare can raise prices at any time with 30 days notice. If users do not cancel before the next billing cycle, they will be charged the new, higher rate.
“We reserve the right to change the fees that we charge for the Service, at any time in our sole discretion, provided that we give you at least thirty (30) days' prior notice of such changes.”
Users grant Cloudflare broad rights to their content, including the ability to sublicense it, modify it, and create derivative works — though this is scoped to what is 'necessary to provide the Services.'
“Subject to the terms of this Agreement, you hereby grant us a non-exclusive, fully sublicensable, worldwide, royalty-free right to collect, use, copy, store, transmit, modify and create derivative works of Customer Content, in each case to the extent necessary to provide the Services.”
Cloudflare owns all aggregated data, analytics, and intelligence derived from processing user traffic. While individual personal data has GDPR/CCPA protections, Cloudflare retains full ownership of insights and models built from user traffic data.
“Cloudflare retains all right, title, and interest in all models, observations, reports, analyses, statistics, databases and other information created, compiled, analyzed, generated or derived by Cloudflare from server, network or traffic data generated by Cloudflare in the course of providing the Service ('Network Data'), and shall have the right to use Network Data for purposes of providing, maintaining, developing, and improving its Services.”
Cloudflare can inspect traffic and logs passing through its network. This is expected for a CDN/security service provider but means all traffic routed through Cloudflare is visible to them.
“Cloudflare may monitor and inspect the traffic on the Cloudflare network, including any related logs, as necessary to perform the Services or protect the security or integrity of Cloudflare's network.”
Any feedback, suggestions, or feature requests submitted to Cloudflare become Cloudflare's property permanently, with no compensation owed to the user. This is common in SaaS agreements.
“You hereby grant Cloudflare a non-exclusive, royalty-free, worldwide, transferable, irrevocable, sublicensable, and perpetual license to use or incorporate into the Services any suggestions, enhancement requests, recommendations, corrections, or other feedback ('Feedback') you provide to Cloudflare relating to the Services.”
Users are responsible for covering Cloudflare's legal costs and damages in a wide range of scenarios, including cases involving 'alleged use' — meaning even unproven accusations could trigger indemnification obligations.
“You agree to defend, indemnify, and hold harmless Cloudflare and its officers, directors, employees, consultants, Affiliates, subsidiaries and agents from and against any and all claims, liabilities, damages, losses, and expenses, including reasonable attorneys fees and costs, arising out of or in any way connected with your access to, use of, or alleged use of the Service.”
Cloudflare takes on zero liability for free tier or beta services, even if those services cause data loss or business disruption. Users relying on free or beta products have no recourse.
“We will have no liability for any harm or damage arising out of or in connection with any Free Services... Notwithstanding Section 12, we will have no liability for any harm or damage arising out of or in connection with any Beta Services.”
Cloudflare may actively modify website content, add tracking cookies to user domains, inject scripts into web pages, and add firewall rules — all as part of normal service operation. Users can disable some features but this is broad operational authority over their web properties.
“Cloudflare may modify certain components of Customer Content on or transmitted to or from your Internet Properties... depending on the Services you select or the Apps that you enable, Cloudflare may: (i) intercept requests... (ii) add cookies to your domain to track visitors... (iii) add scripts to your pages to perform additional performance tracking... (iv) add firewall rules to your website.”
Users retain ownership of their own content. Cloudflare only receives a license to use it for service delivery purposes, not outright ownership. This is a user-protective provision.
“You and your End Users... will retain all right, title and interest in and to any data, content, code, video, images or other materials of any type that you or your End Users transmit to or through the Services (collectively, 'Customer Content') in the form provided to Cloudflare.”
Data stored in beta services can be deleted by Cloudflare at any time with no obligation to preserve or return it. Users storing important data in beta features take on full risk of data loss.
“Beta Services... may be discontinued, suspended, or removed (including any of Customer Content stored as part of the Beta Services) or your access thereto at any time in our sole discretion and may never make them generally available.”
Missing Protections
- No explicit data deletion/portability rights upon account termination (beyond GDPR/CCPA references)
- No grace period or cure period for most agreement violations before account termination
- No SLA (Service Level Agreement) or uptime guarantee in this base agreement — referenced as potentially in other documents
- No explicit opt-out mechanism for arbitration clause (common in more user-friendly agreements)
- No cap or limit on indemnification obligations imposed on users
- No explicit commitment to notify users before terminating accounts for 'any reason'
- No explicit process for disputing erroneous charges before auto-renewal
- No explicit data retention period or deletion timeline after account termination
Fair Terms
- Users explicitly retain ownership of their Customer Content (Section 2.5.1)
- Cloudflare provides at least 30 days notice before price changes (Section 4.2)
- Cloudflare commits to comply with GDPR and CCPA for Personal Data processing (Section 6.1)
- Cloudflare provides indemnification to users for IP infringement claims on Paid Services (Section 10.1)
- Benchmarking is explicitly permitted, including public disclosure of results (Section 2.2.2)
- Two-factor authentication is encouraged and supported for account security (Section 2.3)
- Cloudflare commits to make it clear when a feature will materially modify Customer Content and provide a disable mechanism where possible (Section 2.5.3)
- Access to Paid Services continues through the end of the billing term even after cancellation (Section 4.3)
Document information only — not legal advice.