Digital Audit: Cloudflare

Enterprise Technology Stack & Vendor Relationships

Cloudflare maintains an active, expanding technology partnership with SentinelOne, combining Cloudflare Logpush telemetry with SentinelOne’s Singularity AI SIEM for automated threat detection and response, alongside a joint SASE/Zero Trust reference architecture ¹². On April 14, 2026, Cloudflare and Wiz - an Israeli-founded company built by Unit 8200 alumni and acquired by Google Cloud in 2026 for $32 billion - announced a partnership integrating Cloudflare’s “AI Security for Apps” LLM-traffic inspection capability with the Wiz Security Graph for unified AI-application risk visibility ³⁴⁵. Both relationships are current as of 2026 and are structured as technology-partner integrations and joint solution briefs rather than embedding of Israeli-origin software into Cloudflare’s own core network or edge infrastructure. No public evidence identified of a direct Cloudflare licensing or integration relationship with Check Point, CyberArk, Nice, Verint, Claroty, or Palo Alto Networks. In Israel specifically, CYBERcom became an official Cloudflare channel partner delivering application and network security solutions ⁶, and Nanosek is described as Cloudflare’s “elite technology partner” in Israel for deployment and management support ⁷; no evidence surfaced tying either integrator to settlement-linked business activity.

Surveillance, Biometrics & Retail Technology

No public evidence identified of Cloudflare using or integrating facial-recognition, biometric-identification, or gait-analysis technology from vendors such as Trigo, BriefCam, AnyVision/Oosto, or Trax; Cloudflare’s business is infrastructure and security services rather than retail or physical-surveillance operations. No public evidence identified of Cloudflare using Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools, whether directly or through bundled third-party suites.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Cloudflare has operated a data center in Tel Aviv, Israel since approximately 2018, described in company materials as its “135th data center” and credited with reducing median local response times from roughly 86ms to 29ms ⁸. No public evidence identified linking Cloudflare to Project Nimbus, the Google/Amazon-led Israeli government cloud program; searches on this point surfaced only unrelated Cloudflare products that separately carry the “Nimbus” name (a Certificate Transparency log and an internal documentation platform). No public evidence identified of a Cloudflare colocation agreement specifically with Bezeq International or Bynet Data Communications, Israel’s leading colocation operators. No public evidence identified of Cloudflare marketing or contracting data-sovereignty or resilience services explicitly to Israeli state or military institutions.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of a direct contract between Cloudflare and the Israeli Ministry of Defence, the IDF, or Israeli intelligence agencies. A 2014 Times of Israel report found that Cloudflare’s neutral-provision policy resulted in the company protecting both IDF websites and the Al-Quds Brigades, the armed wing of Palestinian Islamic Jihad, illustrating a dual-use pattern; the current status of that specific relationship is unconfirmed in later sources ⁹. Separately, December 2018 reporting found Cloudflare providing DDoS protection to State Department-designated terrorist organizations’ websites, including Hamas, al-Shabab, and the Popular Front for the Liberation of Palestine, which prompted public pressure from the Israeli legal center Shurat HaDin beginning in 2017 ^10111213. By February 2019, reporting indicated the Hamas, PFLP, and a Taliban-affiliated site no longer used Cloudflare’s services, though the company never publicly explained why ¹³.

A more recent and apparently still-live finding concerns four websites associated with Benzion (Benzi) Gopstein, founder of the Lehava organization, who was sanctioned by the U.S. State Department on July 11, 2024 for contributing to violence and instability in the West Bank, with an earlier related sanctions round reported on April 19, 2024 ¹⁴¹⁵. DAWN (Democracy for the Arab World Now) reported in a submission to U.S. Treasury and Justice dated September 3, 2024, updated February 3, 2025, that ozma-yeudit.co.il (Otzma Yehudit), leava.co.il (Lehava), and rabbikahane.org/rabbikahane.co.il (Kahanist material, including an e-commerce storefront) were using Cloudflare for DNS services, and that these domains remained active on Cloudflare notwithstanding the July 2024 sanctions designation ¹⁶. DAWN explicitly called on Treasury and Justice to ensure that “U.S. companies like Cloudflare do not inadvertently - or knowingly - provide services to sanctioned violent Israeli settlers” ¹⁶. No public evidence identified of Cloudflare terminating service to these domains as of the most recent February 2025 reporting located, and current mid-to-late 2026 status is unconfirmed. Separately, Cloudflare’s 2019 IPO S-1 filing disclosed a voluntary self-report to OFAC that its services had been used by, or for the benefit of, persons or entities on OFAC sanctions lists tied to counter-terrorism and counter-narcotics programs and comprehensively sanctioned jurisdictions, alongside a separate voluntary disclosure to the Census Bureau over export-control filing errors ¹⁷¹⁸; this disclosure is general rather than Israel-specific and predates the West Bank settler-sanctions program, with no confirmed direct link between the two matters.

AI, Algorithmic & Autonomous Systems

No public evidence identified of Cloudflare providing AI/ML, computer-vision, or autonomous decision-support systems directly to Israeli state, military, or security bodies. No public evidence identified that Cloudflare’s AI models or platforms have been trained on, or given access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the occupied Palestinian territories. No public evidence identified of Cloudflare providing autonomous target-generation, threat-detection, or tracking systems to Israeli military or security forces.

Technology Ecosystem & R&D Footprint

Cloudflare’s confirmed Israeli-origin technology acquisition is Zaraz, a Tel Aviv-headquartered startup founded in 2019 by Yair Dovrat and Yo’av Moshe that built server-side third-party-tag-loading technology on Cloudflare Workers; the deal closed October 15, 2021 for $7.2 million ¹⁹²⁰. Whether Zaraz continues to operate as a distinct Tel Aviv R&D site within Cloudflare, and at what current scale, could not be confirmed with a primary source. No public evidence identified of other Israeli-company acquisitions by Cloudflare among its roughly 21 total acquisitions, the most recent of which (VoidZero, Astro, Human Native AI) are not flagged as Israeli. No public evidence identified of Cloudflare strategic investment in Israeli venture funds or startups beyond the Zaraz acquisition. No public evidence identified of patent, licensing, or co-development arrangements between Cloudflare and the Technion, Hebrew University, or the Weizmann Institute.

Civil Society Scrutiny & Regulatory History

Cloudflare’s Form 10-K for FY2023, filed February 21, 2024, lists the Hamas-Israel conflict as a geopolitical risk factor that could materially affect customers, vendors, and partners, though this is a general risk disclosure rather than an operational admission ²¹. The UN Special Rapporteur’s June 30, 2025 report “From economy of occupation to economy of genocide” (A/HRC/59/23) discusses technology-sector complicity broadly, but No public evidence identified of Cloudflare being named specifically within it ²². No public evidence identified of Cloudflare appearing in the UN OHCHR settlement-business database, the Who Profits database, or the AFSC Investigate database. The most substantive civil-society scrutiny located concerns Cloudflare’s neutrality policy enabling continued service to U.S.-designated terrorist organizations’ sites in 2017–2019 ^10111213 and to U.S. Treasury-sanctioned Israeli settler-extremist-linked domains reported as still active as of February 2025 ¹⁶; no organized boycott or divestment campaign specifically targeting Cloudflare over Israel-related technology provision was identified. No public evidence identified of any regulatory enforcement action - an OFAC penalty, DOJ action, or export-control fine - actually imposed on Cloudflare in connection with either the 2019 self-disclosure or the Gopstein-domain matter; both remain, per available sources, at the disclosure or advocacy stage. Separately, Cloudflare’s Radar and blog have published traffic-pattern analyses during regional conflict events, including the October 2023 Israel-Gaza escalation and the April 2024 Iran-Israel attack ²³²⁴, data that was also cited by Access Now in its “Palestine Unplugged” report on Gaza internet disruption ²⁵. Cloudflare’s Project Galileo, marking a decade of operation, provides free protective services to at-risk civil-society organizations globally ²⁶²⁷.

End Notes