If Cloudflare's services fail and cause you financial harm, the maximum amount you can recover from Cloudflare is limited to whatever you paid in fees during the 12 months before you filed your claim.
This analysis describes what Cloudflare's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
For businesses relying on Cloudflare for mission-critical infrastructure, this cap may be far lower than actual damages suffered during a significant outage or security incident, leaving a substantial financial gap with no contractual remedy.
Interpretive note: Enforceability of the cap may vary by jurisdiction; courts in some states have declined to enforce liability caps in cases involving gross negligence or willful misconduct, and EU consumer protection frameworks may limit enforceability for qualifying consumer users.
This clause limits Cloudflare's financial responsibility to you, regardless of how serious the service failure or harm is, to only the fees you paid in the prior year. If you paid a small monthly plan but suffered large business losses due to a Cloudflare outage, your contractual recovery is capped at those modest fees.
How other platforms handle this
To the maximum extent permitted by applicable law, Kit shall not be liable for any indirect, incidental, special, consequential or punitive damages, or any loss of profits or revenues, whether incurred directly or indirectly, or any loss of data, use, goodwill, or other intangible losses, resulting ...
To the maximum extent permitted by applicable law, Pinterest shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or any loss of profits or revenues, whether incurred directly or indirectly, or any loss of data, use, goodwill, or other intangible losses, res...
You will remain responsible for any amounts you fail to pay in connection with your subscription, including collection costs, bank overdraft fees, collection agency fees, reasonable attorneys' fees, and arbitration or court costs.
Monitoring
Cloudflare has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"IN NO EVENT SHALL EITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT EXCEED THE TOTAL AMOUNT PAID BY CUSTOMER IN THE TWELVE (12) MONTH PERIOD PRECEDING THE CLAIM. THE ABOVE LIMITATIONS WILL APPLY WHETHER AN ACTION IS IN CONTRACT OR TORT AND REGARDLESS OF THE THEORY OF LIABILITY.— Excerpt from Cloudflare's Cloudflare Terms of Use
REGULATORY LANDSCAPE: Limitation of liability clauses are generally enforceable in commercial contracts in the US under applicable state contract law, though courts in some jurisdictions have found such caps unenforceable where they are unconscionable or where gross negligence or willful misconduct is involved. EU Directive 93/13/EEC on unfair contract terms and equivalent UK legislation may constrain the enforceability of broad liability caps in consumer contracts, though Cloudflare's self-serve services are predominantly used by business customers. No specific federal regulatory framework directly governs limitation of liability clauses in infrastructure service agreements. GOVERNANCE EXPOSURE: High for enterprise and business users. Organizations using Cloudflare for mission-critical services face a significant risk gap between potential operational impact of a service failure and contractual recovery. This exposure is particularly acute for financial services, healthcare, or e-commerce customers where downtime can produce losses many multiples above the annual service fee. JURISDICTION FLAGS: In EU and UK consumer contexts, broad limitation of liability clauses may be subject to fairness review under consumer contract regulations. In the US, gross negligence and willful misconduct carve-outs are sometimes implied by courts even when not explicit in the contract, though this varies by jurisdiction. California law governs under this agreement, and California courts have found liability caps unenforceable in certain contexts involving gross negligence. CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should treat this cap as a material risk item and evaluate whether contractual remedies beyond the 12-month fee cap can be negotiated in an enterprise agreement. Vendor risk assessments should document this limitation and consider whether supplementary cyber insurance or business interruption coverage is warranted given the service's operational role. COMPLIANCE CONSIDERATIONS: Compliance and risk management teams should document the liability gap created by this cap relative to the operational risk profile of Cloudflare services. Organizations in regulated industries should assess whether this liability cap is compatible with vendor management requirements under applicable regulatory guidance, including banking regulators' third-party risk management standards.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
For businesses relying on Cloudflare for mission-critical infrastructure, this cap may be far lower than actual damages suffered during a significant outage or security incident, leaving a substantial financial gap with no contractual remedy.
This clause limits Cloudflare's financial responsibility to you, regardless of how serious the service failure or harm is, to only the fees you paid in the prior year. If you paid a small monthly plan but suffered large business losses due to a Cloudflare outage, your contractual recovery is capped at those modest fees.
ConductAtlas has identified this type of provision across 265 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Cloudflare.