10 Total
3 High severity
7 Medium severity
0 Low severity
Summary

This is Cloudflare's standard subscription contract that applies when you sign up for any of their internet security and performance services — including their CDN, DDoS protection, DNS, and Zero Trust products — directly through their website. The most important thing to know is that by agreeing, you waive your right to sue Cloudflare in court or join a class action lawsuit, and instead must resolve disputes through individual arbitration. If you disagree with mandatory arbitration, you have a 30-day window from account creation to opt out by sending a written notice to Cloudflare.

Technical Summary

This document is Cloudflare's Self-Serve Subscription Agreement, governing the contractual relationship between Cloudflare, Inc. and individual or business subscribers who purchase Cloudflare services directly through its self-serve portal, with the agreement forming a binding contract upon account creation or service use. The agreement imposes significant obligations including payment of fees (with automatic renewal and no refund provisions for most services), compliance with Cloudflare's Acceptable Use Policy, and restrictions on reselling or sublicensing services without authorization. Notable deviations from industry standard include a unilateral right for Cloudflare to modify service terms and fees with limited notice, broad indemnification obligations placed on the subscriber, and an explicit disclaimer of warranties including service availability guarantees. The agreement engages GDPR and CCPA frameworks through its data processing addendum references and privacy policy incorporation, and includes mandatory arbitration and class action waiver provisions that significantly restrict users' legal recourse under US consumer protection law. Compliance teams should note that the governing law is Delaware with arbitration administered under AAA rules, and that subscribers accepting on behalf of organizations represent they have authority to bind the entity.

Evidence Provenance
Captured April 22, 2026 06:22 UTC
Document ID CA-D-000281
Version ID CA-V-000899
Wayback Machine View archived versions →
SHA-256 ec6cd2a28d6a89b67fe0664fc18d98c498f8a0e4a3b457f187ff38c47a687390
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Cryptographically signed
Institutional Analysis

🔒 Institutional analysis locked

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Professional.

Upgrade to Professional — $149/mo
Change Timeline
View full version history (0 captures) →
High Severity — 3 provisions
Medium Severity — 7 provisions

Cross-platform context

See how other platforms handle Broad Subscriber Indemnification and similar clauses.

Compare across platforms →

Applicable Regulations

CCPA/CPRA
California, USA
CFAA
United States Federal
CAN-SPAM
United States Federal
GDPR
European Union